The bank claimed that its proactive measures allowed it to contain the potential data infringement. — Image by freepik
PETALING JAYA: In a statement today (Sept 3), Bank Rakyat claimed that it had addressed a “possible data infringement incident that may involve some customer information”.
It claimed that its proactive measures allowed it to contain the potential data infringement.
However, it’s unclear what the bank means by a “possible data infringement”. It did not state if any information was stolen or if its system was actually breached. LifestyleTech has reached out to Bank Rakyat for clarification.
“The Bank is committed to transparency and have (sic) notified customers accordingly. In the meantime, we strongly advise customers to remain vigilant against phishing tactics and other potential threats,” it added.
Yesterday (Sept 2), customers took to social media to complain about a message sent via SMS from Bank Rakyat that stated: "There is a possibility of data-related issues detected in our system. The security level and system improvements are actively being enhanced/carried out. If you experience any problems or notice any suspicious transactions, please contact the Bank Rakyat Call Centre immediately.”
“In response to the infringement, Bank Rakyat reported the incident to the relevant authorities. The Bank assures its customers, business partners and stakeholders that all business operations remain fully functional,” it said.
It said customers who suspect suspicious activities should immediately call Bank Rakyat's Contact Centre at 1300 800 800 or 03-5526 9200, or the National Scam Response Centre at 997.
The Cybersecurity Act 2024 (Act 854) took effect on Aug 26, requiring 11 NCII (National Critical Information Infrastructure) sectors including government, banking and finance, and transportation to report any cybersecurity incidents to the National Cyber Coordination and Command Centre (NC4) within six hours of discovery.
Additionally, the authorised representative of the NCII entity must submit further details within 14 days via the NC4 System, including the number of affected hosts, attack techniques used, and the incident's impact.
