By Marja Azlima Omar
Senior Lecturer, International Relations Programme, Faculty of Social Sciences and Humanities, Universiti Malaysia Sabah
Background
Bank Rakyat’s corporate website became inaccessible temporarily on the 6th of November 2026. Following that, the bank announced that the disruption was due to a technical issue at a third-party service provider.
Bank Rakyat also insisted that its banking systems, customer data and deposits were unaffected and uncompromised. The customers of the bank were later advised to continue using channels including the iRakyat app.
Not long after the incident, the Communications Minister Fahmi Fadzil described the incident as a website defacement which means there is an unauthorised change to what visitors see on a webpage.
He also complimented the bank for taking immediate action to block access to the affected server and redirected users to its own iRakyat site. Neither public communication form the minister, nor Bank Rakyat revealed the culprit behind the operation or the locus of the cyber-attacks.
The incident, however, invertedly highlighted one profound distinction between the corporate website and the systems that handle deposits and payments. A change to a public webpage can lead to a criminal investigation even if transactions are not disrupted and there is no consumers’ data breach or leak.
At the same juncture, an incident that involves third supplier raises concerning doubts on the bank’s oversight and ability to maintain accessible services. And, at this point, the international legal question becomes particularly practical in the event where a provider abroad keeps the pertinent records needed to identify the accountable party.
Cybersecurity Attack: The Jurisdiction of Malaysian Criminal Law
Malaysia’s Computer Crimes Act 1997 (Act 563) contains provisions that are related to the recent incidents namely the entry into a computer system and alteration of its contents.
Specifically, section 3 applies where a person intentionally seeks access to a program or data, knows the access is unauthorised and causes a computer to perform a function for that purpose.
In addition, section 5 applies where a person knowingly does something that will cause an unauthorised modification, albeit the fact that the change can be temporary. In a defacement case, the investigators would require evidence of how the pages were deliberately altered, which accounts or systems were employed to do so, and also whether the person responsible had permission to carry out such modifications.
Interestingly, section 9 of the same Act has extraterritorial jurisdiction whereby it can cover conducts abroad, regardless of the person’s nationality, if the relevant computer, program or data was in Malaysia at the material time or met the Act’s connection test involving a computer in Malaysia.
Under Effects Doctrine of international law, this falls under Objective Territorial Principle. In practice, section 9 of the Malaysian Computer Crimes Act 1997 and Objective Territorial principle could allow a Malaysian prosecution even if the person responsible was identified to be or domiciled abroad.
Having established that, obtaining a server log held in another country is a separate legal matter and has to be dealt with separately Mutual Legal Assistance Treaties (MLATs). In other words, the authority to apply Malaysian criminal law does not in itself authorised the Malaysian investigators to conduct a compulsory search abroad, beyond Malaysia’s territoriality.
Banking Institutions and their IT Providers
According to the list issued by Bank Negara Malaysia, Bank Rakyat as a prescribed development financial institution, a category covered by its Risk Management in Technology (RMiT) policy updated on 25th September 2026.
Under paragraphs 10.46 to 10.48, institutions must oversee providers of critical technology functions, assess provider risks throughout the engagement and establish service-level agreements. This means the financial institution must remain accountable for managing the risks that arise from its use of IT providers.
In the recent incident, important practical questions include who can isolate the affected system, whether the bank can obtain the provider’s records immediately and which customer services can be kept functioning during the recovery period. Singularly, the reported outage is inadequate to establish a regulatory breach.
There are two other reporting regimes that can become relevant to the issue in hand depending on the findings of the investigators. The first regime relates to the fact that
banking and finance is a national critical information infrastructure sector under the Cyber Security Act 2024 (Act 854).
Section 23 of the Act requires a designated entity (National Critical Information Infrastructure – NCII) to notify the National Cyber Security Agency’s chief executive and the sector lead if it discovers that an incident has or might have affected national critical information infrastructure it owns or operates.
The 2024 regulations require immediate electronic notification and submission of specified initial particulars within six hours of the incident coming to the entity’s knowledge.
The second regime concerns the personal data protection law that has a different trigger under section 12B, Personal Data Protection Act 2010. Where a personal data breach meets the Commissioner’s notification criteria, the controller must notify the Commissioner as soon as practicable and within the applicable 72-hour period.
The Commissioner’s guidance also requires notification of affected individuals where the breach causes or is likely to cause significant harm. In the case of Bank Rakyat incident, the bank reported that customer data was unaffected. In other words, a temporary loss of access to a website alone does not establish that personal data was compromised.
Obtaining Evidence from Foreign Jurisdiction
In the event where the affected website is operated by a Malaysian supplier, but a cloud subcontractor abroad is the only party that holds the record of a privileged login used to alter the page; the investigators might ask the bank and its supplier to preserve the records that are within their control.
For records held overseas, the cooperation of the foreign provider or authorities are vital, depending on the domestic law and the type of information sought. A preservation request helps prevent records from being deleted while a request for disclosure is prepared.
Under section 8 of Malaysia’s Mutual Assistance in Criminal Matters Act 2002, the Attorney General has the authority to request from a foreign authority to obtain relevant evidence or material, subject to the statutory conditions.
The ASEAN Treaty on Mutual Legal Assistance in Criminal Matters 2004 provides a regional route for requests between parties, including for records and other evidence.
Under the treaty, a request needs to identify the investigation, describe the material sought and explain why it matters. For a website incident, that means identifying the
service, the relevant account or system and the time window with enough precision for the requested authority to locate the material.
The requested country generally executes the request under its own law. Whether the same conduct is an offence in either or both countries is a matter of conflict of law and can affect whether it grants assistance. Should the material need to be presented in court, investigators will also need a reliable record of how it was collected and handled.
The Purview of the United Nation Convention against Cybercrime 2024
The provisions under the UN Convention against Cybercrime 2024 would give its member states common procedures for obtaining electronic evidence. Article 42 addresses expedited preservation of stored electronic data, while Article 44 addresses requests to access and obtain such data.
Malaysia signed the convention on 25 October 2025 and as of 8 November 2026, the UN depositary listed Malaysia as a signatory without a deposited ratification. However, the convention has yet to enter into force and for that reason; the legal route for current ongoing investigation depends on the arrangements readily available with the country concerned.
State Responsibility for Cyber Operations
While identifying the person who operated an account is a criminal-investigation question, attributing conduct to a state is a distinct legal inquiry. Under the International Law Commission’s Articles on State Responsibility (2001), conduct can be attributed to a state when carried out by its organs or, in certain circumstances, by a private person or group acting on its instructions or under its direction or control in carrying out the operation.
International responsibility also requires a breach of an international obligation. An overseas server or IP address may help investigators trace activity, but it cannot by itself establish that a foreign government directed it. The public accounts of the Bank Rakyat incident provide no basis for such a finding and therefore does not establish any viable legal claim for adjudication under international law.
The United Nation Charter is another relevant legal instrument in discussing state responsibility for cyber operations although the term ‘cyber operation’ may not specifically spell out. This is because the UN Charter sets a separate threshold for force and self-defence.
Article 2(4) prohibits the threat or use of force in international relations as specified in the Charter, while Article 51 recognises the right of self-defence if an armed attack occurs. If Malaysia were to follow the United Kingdom’s published position on cyber operation and international law, a cyber operation may qualify as an armed attack if its scale and effects are comparable to those of an attack carried out by conventional means.
In other words, a cyber-attack may become eligible for self-defence if conditions are met. A disruption causing deaths or physical destruction could raise that question. However, the effects publicly reported at Bank Rakyat, a temporary disruption to its corporate website while banking operations continued, fell well below that threshold and thus insufficient to satisfy the required conditions.
Conclusion: The Implication for Malaysians Banks
After the Bank Rakyat’s incident, Prime Minister Anwar Ibrahim had called for closer scrutiny of cybersecurity across public assets, financial institutions and government-linked companies. For the banking sector, the immediate aftermath of Bank Rakyat incident is a review with specific focus.
The banks have to be legally equipped with authority and better leverage in managing pertinent information. In essence, the banks need to know who can isolate a supplier’s system, which customer services can be kept running and which entity holds the records needed for an investigation.
In situations where those records are located overseas, effective recovery and effective prosecution may run on different timetables and time-frame. A site can be restored within hours while investigators are still working to preserve evidence that could establish the parties responsible.
This is where domestic and international law intersect. Malaysian criminal law defines the offence and the circumstances in which Malaysia has the jurisdiction to prosecute. Conversely, the banking rules assign responsibility for managing suppliers and maintaining services.
Meanwhile, international cooperation under the overarching international law regimes operates extra-jurisdictionally to secure evidence, i.e. when the legal process of obtaining evidence is a matter of another country’s domestic legislation.
All in all, the entire legal intersection of domestic and international law hinges on three crucial steps; firstly, is to isolate the affected system, secondly is to pinpoint the entity in control and thirdly is to secure cross-border records required to enforce accountability
