Tabung Haji Cyberattack: Depositors' Savings Safe, Services Restored

Tabung Haji Cyberattack: Depositors' Savings Safe, Services Restored

For a few days this month, one of Malaysia's most trusted savings institutions went dark. Lembaga Tabung Haji (TH) detected suspicious cyber activity on 7 October, suspended services across all channels the next day, and spent the following week bringing its systems back under heavy monitoring. By 12 October, core services were running again. Three THiJARI functions are still not.

If you have a Tabung Haji account — and millions of Malaysians do — here is what actually happened, what is still missing, and what you should check.

The timeline, plainly

• 7 October — TH detects suspicious cyber activity on its systems.
• 8 October — As a precaution, TH suspends system and service operations across all channels to protect depositors' savings and personal information. It says it is working with the National Cyber Security Agency (NACSA) and CyberSecurity Malaysia.
• 11 October — Branches in Kedah, Terengganu and Kelantan reopen.
• 12 October — Branches in all other states reopen as usual; core systems and services resume after security checks and recovery work. TH confirms for the first time that the disruption was caused by a cyberattack, describing it as a criminal act against TH and the country.
• 13–14 October — Online services through strategic partner banks are progressively reconnected. Bank Islam is confirmed back; other partner banks await final confirmation.

TH says it has lodged a police report and notified NACSA and the Personal Data Protection Department (JPDP).

What is back, and what is not

Core services — branches, deposits, withdrawals through partner banks — are operating. But on THiJARI, the official portal and app, three functions remain offline pending further recovery work:

1. Password resets
2. New user registrations
3. Online account openings

That is a meaningful detail. A financial institution that has suspended password resets is telling you something about how the attack touched its identity systems. It is also why depositors who have forgotten their passwords still need to visit a branch.

TH has repeatedly said depositors' savings and personal data remain safe, and it is asking depositors to report any unusual transactions or activity immediately through the TH Contact Centre at 03-6207 1919.

This is not happening in isolation

The Tabung Haji incident lands in the middle of a rough season for Malaysian institutions.

CTOS — the country's largest credit reporting agency — has been carrying its own breach since September; password-reset notices are now reaching account holders, and Bank Negara Malaysia temporarily suspended all credit reporting agencies' access to CCRIS on 1 October. Earlier in the same window, a container terminal in Johor halted operations for hours after a cyber incident. National advisories this month describe sustained, high-volume attacks against internet-facing services across Malaysia's banking, savings and government-linked sectors.

The pattern matters more than any single incident. Malaysia's public and financial institutions are being tested, and the tests are not all the same shape: some attacks try to steal data, some try to disrupt operations, and the loudest may be cover for the quietest.

What depositors should do now

• Do not panic about your savings. TH says funds are safe and there is no indication of lost balances. An operational outage is not the same as money missing — but keep checking your account when services return.
• Reset your password when the function is available — and make it unique. If you have used your THiJARI password anywhere else, change it there too, today. The most dangerous habit in Malaysian breaches is password reuse.
• Watch for phishing while the dust settles. Scammers impersonate institutions during exactly these windows: fake "TH security alerts", fake password-reset links, fake support calls. TH will not ask for your password or OTP over a message. When in doubt, go to the official app or a branch.
• Report anything odd. If you see a transaction you do not recognise, contact TH immediately at 03-6207 1919.

What companies and developers should take from this

Suspension is a valid response — and a costly one. TH chose to shut everything down rather than risk spreading an active threat. That is the conservative call, and it worked in the sense that services came back with controls strengthened. But every day of downtime is a direct cost and a trust cost. The lesson is not "never suspend"; it is "build systems you can segment, so you do not have to choose between all-open and all-closed".

Identity functions are the last to come back, and that is not an accident. Password resets, registrations and account openings are exactly the functions an attacker would abuse to take over accounts. If your recovery plan does not treat identity operations as a special category, it is not a recovery plan.

Report early, in public, with facts. TH reported to police, NACSA and JPDP, and communicated in stages: detection, suspension, partial restoration, restoration. That cadence is what regulators and customers need. The alternative — silence, then a leak — is how trust actually dies.

Assume you are in the target set. The current wave is broad: banks, credit agencies, savings funds, government-linked services. If your organisation runs public-facing services in Malaysia, the relevant question is not whether you will be targeted, but whether your controls hold while you are.

The bottom line

Tabung Haji detected an attack, shut its doors within a day, restored core services within a week, and says the money is safe. That is a decent outcome for a genuinely hard situation. The unfinished parts — three identity functions still offline, partner-bank reconnections pending — are the reminder that recovery in financial systems is measured in weeks, not hours. For depositors, the practical to-do list is short: check your account, fix your password hygiene, and stay suspicious of anyone who contacts you about it.

Sources

• The Star: Tabung Haji suspends services after detecting suspicious cyber activity
• Free Malaysia Today: Tabung Haji services back following cyberattack
• New Straits Times: Tabung Haji resumes services after cyberattack
• Sinar Harian: Perkhidmatan Tabung Haji kembali pulih selepas serangan siber, simpanan pendeposit dijamin selamat
• Sinar Harian: Perkhidmatan dalam talian TH, Bank Islam kembali beroperasi