Bahasa Melayu← Malaysia Cyber Watch
Bank Rakyat website defacement
Bank Rakyat websites were defaced on the night of 6 November 2026. The bank says a third-party provider was at fault and that deposits, data and banking services were unaffected.
Key facts
- OrganisationBank Rakyat (Bank Kerjasama Rakyat Malaysia), Kuala Lumpur
- What happenedWebsite defacement. Several pages, including the iRakyat online banking login page, showed a MARLANWG message.
- CauseThe bank blames a technical problem at a third-party service provider, which it has not named.
- Not affectedCustomer deposits, personal information and banking services, according to the bank.
- ClaimedMARLANWG claims internal access and a data sample. No sample has been published.
- AuthoritiesCommunications Minister Fahmi Fadzil commented on 7 Nov 2026. No police report or NACSA statement on the bank itself has been reported as of 8 Nov 2026.
Timeline
- 6 Nov 202610.45pm: a defaced Bank Rakyat page with a MARLANWG message is captured. The iRakyat login page is also defaced. Lowyat · Screenshots on X
- 6 Nov 2026About 11.30pm: the bank says its corporate website is temporarily inaccessible. Most of its sites are taken offline. Malay Mail · Lowyat
- 7 Nov 20263.50am: search results still show the defaced text. Lowyat
- 7 Nov 2026The bank's Facebook statement blames a third-party provider and says only the corporate website was disrupted. Malay Mail
- 7 Nov 2026Communications Minister Fahmi Fadzil says the bank blocked the affected server, moved users to i-Rakyat and has found no data theft so far. Malay Mail
Incident record
| Organisation | Date | Sector | Type | Actor | What happened | Sources |
|---|---|---|---|---|---|---|
| ✅ ConfirmedBank RakyatKuala LumpurVia a vendor | 6 Nov 2026 | Finance | Defacement | MARLANWG | Confirmed. Websites defaced; the bank blames a third-party-managed site and says deposits, data and banking services were unaffected. On 7 November Fahmi Fadzil said the bank blocked the affected server and no data theft had been found so far. Claimed. The actor claims internal access and a data sample, and no sample has been published. Screenshots shared on the night of 6 November show the same MARLANWG message and Session contact ID on both bankrakyat.com.my and the i-Rakyat online banking site, irakyat.com.my. | Malay Mail · Lowyat · Screenshots on X (@Pelabur_Bijak) · Malay Mail✓ 8 Nov |
What to do
- Type the bank's address or open the official iRakyat app. Avoid search result links until they refresh.
- Ignore SMS, calls and emails about this incident. The bank will not ask for your password or TAC.
- Check recent transactions and report anything unusual to Bank Rakyat at once.
- If you lose money to a scam, call the National Scam Response Centre on 997.
FAQ
Was Bank Rakyat hacked?
Several Bank Rakyat web pages, including the iRakyat login page, were defaced on 6 November 2026. The bank blames a third-party service provider and has not called it a cyberattack.
Is my money in Bank Rakyat safe?
The bank says customer deposits, personal information and banking services were not affected. Banking continued through iRakyat, BRICK, QR2E and i-bizRAKYAT.
Who is MARLANWG?
The actor whose message appeared on the defaced pages. It claims internal access and a data sample, and has published no sample. It earlier claimed access to Royal Malaysian Customs Department databases, which is also unverified.
Related stories
- Amadeus airline data breach South Korea, Japan, Hong Kong +3 · 4 Nov 2026
- Rakuten Trade halts Bursa trading after a cyber attempt Malaysia · 30 Oct 2026
- Tabung Haji suspends all services after a cyberattack Malaysia · 8 Oct 2026
- Port of Tanjung Pelepas halted by a cyber incident Malaysia · 10 Sep 2026
Checked 8 Nov 2026. Methodology · Data CC BY 4.0