Three Malaysian banks experienced service disruptions on the same day, with no evidence yet of a cyberattack
Malaysia’s National Savings Bank (BSN), Bank Islam, and Bank Rakyat successively issued notices of service disruptions on November 6, 2026, involving interbank withdrawals, mobile apps, and website access, respectively, raising outside concerns over whether the banks’ systems had been hit by a cyberattack.
Specifically: because BSN had a high volume of ATM transactions, customers had difficulty withdrawing cash at other banks’ ATMs through the MEPS interbank withdrawal network; the bank advised temporarily using its own ATMs. Bank Islam’s BIMB Mobile app version 2.10.1 has compatibility issues with the Android 17 system; the bank advised affected users to delay updating, and those who have already updated can use the website instead. Bank Rakyat’s website was temporarily inaccessible; the bank said only its corporate website was affected, and the cause was a technical issue with a third-party service provider’s system. The bank’s systems, customer data and deposit safety were not affected, and it advised using alternative channels such as iRakyat.
At present, there is no evidence that the three banks were attacked by cyberattacks, or confirmation that these disruptions are related to one another. PayNet said that no abnormalities were found after checking the shared withdrawal network.
Original source:
Title: Service disruptions at three Malaysian banks spark cyberattack fears Publisher: Lianhe Zaobao Publication date: 2026-11-07 URL: https://www.zaobao.com.sg/en/news/sea/service-disruptions-three-malaysian-banks-spark-cyberattack-fears Source nature: media report Verification status: For this reading, Lianhe Zaobao’s English report and related reports from several Malaysian media outlets were reviewed, accessed on 2026-11-07 to 08 Supporting content: details of the November 6 service disruptions at the three banks, BSN interbank withdrawals, Bank Islam app compatibility, Bank Rakyat website issue, and no evidence of a cyberattack or mutual connection
ABAB AI Insight
The three banks experienced different types of service disruptions on the same day (interbank ATM, mobile app compatibility, and website access), involving different system components, so it is difficult to directly point to a single cyberattack. Bank Rakyat explicitly attributed the issue to a technical problem with a third-party vendor and stressed that the core banking system and customer funds were not affected; BSN’s issue was related to transaction volume, and PayNet also confirmed that the shared network was abnormal-free. Bank Islam’s case was a compatibility issue between the app and the operating system version, which falls under software updates.
Public concern mainly stems from the close timing, as well as some reports mentioning that Bank Rakyat’s website may have been tampered with. However, as of now, neither official sources nor media outlets have confirmed that the three incidents are linked or constitute an attack on core systems. Malaysian Communications Minister Fahmi Fadzil said that attack attempts by non-state actors had been detected, but they did not lead to data theft or disruption of online banking operations.
The observable changes are: whether each bank further discloses recovery times or technical details in subsequent announcements, and whether regulators issue a unified explanation regarding the same-day disruptions. The observation indicators are the actual recovery status of the three banks’ websites, apps, and interbank withdrawal functions, as well as any formal confirmation of customer fund anomalies or data leaks.
ABAB News · Laws of cognition
Multiple banks experiencing service disruptions on the same day does not mean the incidents are related or all caused by a cyberattack.
Blocked access to a website or app does not mean the core banking system, customer data, or deposits have been affected.
A technical problem with a third-party vendor can independently cause a website outage without assuming the overall system was breached.