The Health Ministry's cybersecurity incident this week did not hit its main system. On Saturday, 14 November, the Ministry of Health (MOH) said it had detected "unauthorised access to a support file storage and sharing platform at one of its facilities" two days earlier, Bernama reported. Its main databases and patient services were not affected, and it has not said whether any files were taken.
Most offices have a tool like that: the shared drive where quotes, invoices and customer files end up. So the ministry's fix list is worth an owner's time.
What happened in the Health Ministry incident?
| What the ministry has said | |
|---|---|
| Detected | Thursday, 12 November 2026 |
| What was accessed | A support file storage and sharing platform at one facility |
| Main systems | Not affected. The first investigation found the incident did not involve encrypting the main databases |
| Patient services | Appointments and treatment continue as usual |
| Who is helping | The National Cyber Security Agency (NACSA), under the Cyber Security Act 2024 |
| Not said | Which facility, which platform, which files, and how many people |
The ministry also warned that downloading, keeping or sharing government documents obtained unlawfully is a serious offence.
Was any data taken?
Nobody outside the ministry can say yet, and we won't guess. MOH calls it a cybersecurity incident and has not confirmed a data leak. It has not said what was stored on the platform or whether anything was copied.
"Did not involve the encryption of the ministry's main databases" rules out one thing only: the core systems were not locked up. It says nothing about the files on the side platform. Until the ministry says more, nobody outside it knows whether any files were copied.
Data breach Malaysia 2026: four fixes your office can copy
According to Bernama and FMT, the ministry blocked public access to the platform, reset user passwords, audited servers and made multi-factor authentication mandatory at the facility. Multi-factor login was also on the list NACSA gave critical operators when it raised the national cyber threat level on 4 November.
The office version, for a team on Google Drive, OneDrive or Dropbox:
- Close public access. Find the files and folders shared as "anyone with the link" and switch off the ones that don't need it.
- Reset passwords, starting with logins that several people share. Remove the accounts of staff who have left.
- Check who got in. Read the sign-in or activity log for logins at times and from places nobody on your team recognises.
- Make two-step login a rule. Multi-factor authentication means a password plus a second step, such as a code on your phone. The ministry made it mandatory, and so can you.
Close the public links first, then add the second login step.
Our take: the side tool is often the weak spot. Companies spend on the main system, like the accounting software or the customer app. The shared drive gets set up once and nobody reviews it again. We don't know how the access at the ministry happened, and we are not saying this is what went wrong there. Its four steps are still good housekeeping, and a small team can do them before an incident.
If customers' personal data does get out, Malaysia's data breach notification rules may apply, and the breach may need to be reported under the PDPA within 72 hours. And if your files sit in a custom-built portal, ask your developer who can reach it from the internet.
If you want a second pair of eyes on a system that holds customer files, we test it the way an attacker would. Talk to us and we'll tell you honestly whether a quick check is enough.
General information from news reports up to 15 November 2026, not legal or cybersecurity advice.
References
- Health Ministry's main systems, services unaffected by cybersecurity incident, Bernama via The Star, 14 November 2026
- Health ministry suffers cybersecurity breach, but patient services not affected, FMT, 14 November 2026
- Health Ministry reassures patients after cyber breach targets file-sharing platform, Malay Mail, 15 November 2026
- Nacsa raises level of cyber security threat to medium, The Star, 4 November 2026
