Late on Friday 6 November, visitors to Bank Rakyat's website saw a black page with green text: "MARLANWG IS HERE." The suspected Bank Rakyat hack hit public pages, including the iRakyat online banking login page, and the affected sites went offline. The bank has not confirmed a cyberattack.
What happened in the suspected Bank Rakyat hack?
As of 7 November:
- A screenshot in Lowyat.NET's report shows a defaced page at 10.45pm. The changed pages sat on more than one of the bank's domains.
- At about 11.30pm, Bank Rakyat said on Facebook that its corporate website was unavailable and pointed customers to its apps, Bernama reported.
- The Bank Rakyat website was down, then restored.
The defaced page at 10.45pm on 6 November, with the attacker's contact ID cropped out. Source: Lowyat.NET
The page claims the attacker "successfully accessed the internal infrastructure and retrieved a sample of your data." Bank Rakyat has not said whether that is true or whether customer data was taken.
What should Bank Rakyat customers do now?
The bank told customers to use its apps. Until it says more, type its address yourself instead of clicking a search result, ignore SMS or calls about the incident, and check your transactions.
Google at 3.50am on 7 November, still showing the attacker's text on two bank domains. Source: Lowyat.NET
The earlier RM1 million fine
Bank Negara fined Bank Rakyat RM1 million on 20 January, announced on 1 April, after an outsider got into its IT systems in 2024. BNM said the breaches were "attributed to inadequate cybersecurity controls and incident response." Bank Rakyat says it has since "implemented remedial measures and strengthened its cybersecurity framework," The Edge reported. Nobody has said whether the two incidents are linked, and we don't know how Friday's attacker got in.
What this means for your business website
Our take: this is a website story as much as a bank story. Most pages hit were public ones. At many companies, pages like these go to a vendor at launch and are forgotten. A defacement at least gets noticed. A webshell, a small script planted on a web server that lets an outsider run commands, can sit quietly for months.
On 4 November, NACSA raised Malaysia's national cyber threat level from Low to Medium and told critical infrastructure operators to apply nine measures, including 24-hour monitoring, patching and multi-factor authentication. A smaller version works for a 20-person company:
- List every website and subdomain you own. Old campaign pages and test sites still run code.
- Patch the server, CMS and plugins, and turn on two-step login for every admin account, a step the Health Ministry made mandatory at one facility after its file-sharing breach. If your site runs on PHP, check PHP2Shell first.
- Set up alerts for page changes and downtime, so you hear about a problem before your customers do.
- Write your first-hour plan: who takes the site offline, who tells customers, and who checks whether personal data left. A personal data breach may need to be reported under the PDPA within 72 hours.
- Have someone attack the site on purpose, with your permission, then retest the fixes. Until someone tries to break a fix, you only have a promise that it works. That is what a real penetration test is for. The Flexi Parking hack shows how basic the holes can be.
If nobody has checked your website or web app since launch, that is our job. We test it the way an attacker would, show your developer what to fix, and retest. Talk to us and we'll tell you honestly if a quick check is enough.
General information from news reports up to 7 November 2026, not legal or cybersecurity advice.
References
- Bank Rakyat Takes Down Sites After Suspected Cyber Attack, Lowyat.NET, 7 November 2026
- Bank Rakyat Under Suspected Cyberattack By Threat Actor "Marlanwg", Pokde.Net, 7 November 2026
- Bank Rakyat Website Experiences Temporary Disruption, Bernama, 6 November 2026
- Bank Rakyat fined RM1mil over cybersecurity, customer data protection breaches, FMT, 1 April 2026
- Bank Rakyat says remedial measures taken after BNM fine over cybersecurity incident, The Edge Malaysia
- Nacsa raises level of cyber security threat to medium, The Star, 4 November 2026
