Bank Rakyat Website Briefly Defaced In Suspected Cyberattack By Threat Actor “Marlanwg”

Bank Rakyat is facing fresh cybersecurity concerns after portions of its public-facing website were briefly defaced by an external threat actor using the name "Marlanwg." The attacker claimed to have gained access to the bank's internal infrastructure and said a sample of data had been obtained to demonstrate the extent of the compromise. At the same time, Bank Rakyat informed customers that its corporate website was temporarily unavailable and directed them towards several alternative digital channels. At this stage, however, the attacker's claims regarding internal network access and data theft remain unverified publicly.

Bank Rakyat Confirms Its Corporate Website Is Temporarily Unavailable

Bank Rakyat issued a notice informing customers that its corporate website was currently unavailable. The bank apologised for the disruption and advised customers to continue using its other digital platforms while the website service was affected. The announcement did not provide a technical explanation for the outage or directly confirm whether the website disruption was connected to the reported defacement. For customers, the immediate message was simply to avoid relying on the corporate website until normal availability was restored.

Bank Rakyat recommended that customers use the following services instead:

These platforms provide alternative ways for customers and businesses to continue accessing selected Bank Rakyat services without relying on the main corporate website.

Public Pages Were Briefly Defaced

The suspected cyber incident became visible after sections of Bank Rakyat's official web portal were altered by the threat actor. The changes reportedly affected public-facing informational pages, including pages containing details about personal financing products. Instead of the expected content, visitors were shown a message left by the attacker claiming responsibility for the compromise. The defaced pages were reportedly restored relatively quickly, with the affected website returning to its normal appearance less than an hour after reports began circulating.

The Attacker Identified Itself As "Marlanwg"

The individual or group behind the defacement used the handle Marlanwg. In the message displayed on the compromised pages, the attacker claimed to have conducted what it described as a security assessment and alleged that access had been obtained to Bank Rakyat's internal infrastructure. The message also claimed that a sample of data had been retrieved as evidence of the intrusion. None of these claims should currently be treated as independently confirmed simply because they appeared on the compromised website.

The Defacement Message Claimed Internal Access

According to the attacker's message, the incident supposedly went further than modifying a public webpage. Marlanwg claimed to have successfully accessed internal infrastructure and retrieved a sample of information to prove the extent of the compromise. If accurate, that would represent a significantly more serious security incident than ordinary website defacement because it could suggest access beyond the public web server. However, Bank Rakyat has not publicly confirmed that its internal network or customer information was compromised.

A Website Defacement Does Not Automatically Mean The Bank Was Fully Breached

It is important to distinguish between a compromised website and a compromise of the bank's internal banking systems. Attackers can sometimes modify public pages through vulnerable web applications, stolen administrative credentials or compromised content-management systems without gaining access to deeper financial infrastructure. The visible defacement proves that an unauthorised party appears to have modified website content, but it does not by itself confirm access to customer accounts, transaction systems or internal databases. Those questions require forensic investigation rather than relying on the attacker's own statement.

The Threat Actor Requested Contact Through Session

The attacker reportedly instructed Bank Rakyat's security team to contact it through Session, an encrypted messaging application designed with privacy and metadata minimisation in mind. The message suggested that communication should take place to discuss data deletion and remediation terms. This behaviour resembles tactics sometimes used by extortion-oriented threat actors who attempt to establish private negotiations after claiming to have stolen information. However, no public evidence currently establishes whether Marlanwg actually possesses Bank Rakyat data or whether the communication request was simply intended to create pressure.

Claims Of Data Theft Remain Unconfirmed

The most serious allegation in the incident is that a sample of data was supposedly retrieved from Bank Rakyat systems. At the moment, there is no confirmed public information identifying what type of data may have been involved, how much information was allegedly accessed or whether anything was actually exfiltrated from the bank. There is also no confirmed customer list, leaked database or verified sample demonstrating that the attacker's claims are genuine. Until Bank Rakyat provides additional information, the possibility of data theft should therefore be treated as a claim rather than an established fact.

What Is Currently Known And What Remains Unclear

The early stage of the incident means several important details remain unresolved. Separating confirmed observations from attacker claims helps avoid unnecessary speculation.

For customers, the most important point is that the visible website compromise does not automatically establish that banking systems or account information were accessed.

The Website Was Restored Quickly

Reports indicated that the affected web pages returned to normal relatively soon after the defacement became public. Rapid restoration suggests Bank Rakyat's technical teams were able to regain control over the affected website components or temporarily isolate the problem. Restoring the visual appearance, however, is only the beginning of incident response. Security teams still need to determine how the attacker gained access, whether persistence was established and whether any other systems were touched before the website was restored.

The Corporate Website May Remain Offline During Investigation

Even if the visible defacement has disappeared, temporarily keeping the corporate website unavailable can be a sensible defensive measure. Taking a system offline gives security teams time to review logs, patch vulnerable software, rotate credentials and inspect the environment without allowing additional public interaction. It can also prevent attackers from immediately exploiting the same weakness again while the investigation is still underway. Customers should therefore not assume that continued website unavailability means the attack is still actively progressing.

Banking Services May Be Separate From The Public Website

Bank Rakyat's recommendation that customers continue using iRakyat, BRICK, QR2E and i-bizRAKYAT suggests that those services remain available independently from the corporate website. Modern banks generally separate public informational websites from core transactional banking infrastructure, although the exact architecture naturally differs between institutions. This separation can help contain incidents when one public-facing service is compromised. At present, there is no public confirmation that these alternative digital banking services have been affected by the same incident.

Customers Should Use Official Apps And Platforms Directly

Until Bank Rakyat provides further clarification, customers should access banking services only through official applications or previously trusted bookmarks. It is safer to open iRakyat or another Bank Rakyat service directly rather than following links shared through unsolicited email, SMS, WhatsApp or social media messages. Cybercriminals frequently exploit confusion surrounding genuine security incidents by sending fake warnings that imitate the affected organisation. A real cyberattack can therefore create opportunities for completely unrelated phishing campaigns.

Phishing May Become The More Immediate Customer Risk

Whenever a high-profile financial institution experiences a cyber incident, criminals often take advantage of the publicity surrounding it. Customers may receive messages claiming that their accounts need to be verified, passwords must be reset or transactions need urgent confirmation because of the breach. These messages may have nothing to do with the original attacker and can simply be opportunistic scams. Bank Rakyat customers should be suspicious of any unexpected request asking for passwords, TAC codes, OTPs, PIN numbers or banking credentials.

Do Not Enter Sensitive Details Into Unexpected Links

Customers should avoid entering usernames, passwords or banking information into websites opened from unsolicited messages. A phishing page can look almost identical to the legitimate Bank Rakyat interface while secretly capturing everything entered into it. The safest approach is to manually open the bank's official app or type the known address directly rather than trusting a link provided by someone else. Bank employees should never need customers to reveal passwords or one-time authentication codes through messages.

The Incident Comes Against A Sensitive Cybersecurity Background

The reported defacement arrives while Malaysian financial institutions continue facing significant cybersecurity scrutiny. Banks are attractive targets because they hold valuable customer information and operate systems directly connected to financial transactions. Even incidents affecting only a corporate website can attract considerable attention because customers naturally associate the bank's public website with the security of the institution as a whole. This places additional pressure on Bank Rakyat to clarify the scope of the incident once its forensic investigation progresses.

Bank Rakyat Has Previously Faced Regulatory Action

Bank Rakyat has previously been subject to regulatory action involving cybersecurity and technology risk. Bank Negara Malaysia imposed an RM1 million administrative monetary penalty on the institution under its Risk Management in Technology framework following a separate earlier cybersecurity matter. That previous enforcement action is unrelated to the current suspected incident, but it naturally increases public attention when a new security problem emerges. It also reinforces the importance of demonstrating that lessons from previous incidents have been incorporated into current controls.

The Earlier Incident Should Not Be Confused With This One

Previous cybersecurity enforcement against Bank Rakyat should not automatically be treated as evidence that the same technical weakness caused the latest website defacement. Different incidents can involve completely different systems, attackers and vulnerabilities. Unless investigators establish a connection, the current event should be assessed independently. Cybersecurity reporting becomes misleading when unrelated incidents are combined simply because they involve the same organisation.

Public-Facing Websites Are Common Attack Targets

Corporate websites are among the most visible parts of an organisation's infrastructure and therefore frequent targets for attackers. They may contain content-management systems, web frameworks, plugins and administrative interfaces that require continuous maintenance. A single unpatched component or compromised administrator account can sometimes provide enough access to modify public content. Because the website is publicly accessible, attackers can also probe it continuously from anywhere on the internet.

Defacement Is Often About Visibility

Some attackers compromise websites primarily because they want public recognition rather than financial gain. A visible message placed on a well-known organisation's homepage immediately attracts attention and gives the attacker an audience. Other groups use defacement as proof that they have obtained broader access and then attempt to pressure the victim into negotiations. Determining which motive applies requires more evidence than the defacement itself provides.

The Internal Infrastructure Claim Is The Most Important Question

From a cybersecurity perspective, the biggest question is whether Marlanwg's claim of internal access is genuine. If the attack was limited to public website content, the incident may remain largely a web application compromise. If the attacker reached internal infrastructure, the potential impact could become much more serious and might involve sensitive systems or data. Bank Rakyat's investigation will therefore need to establish whether the website was the final target or merely the first visible sign of a deeper compromise.

Security Teams Will Need To Trace The Initial Entry Point

Incident responders will likely begin by determining exactly how the attacker gained control of the affected webpages. Possible causes could include vulnerable software, compromised credentials, exposed management interfaces or weaknesses within a third-party component. Logs from web servers, authentication systems, firewalls and endpoint security tools can help reconstruct the timeline. Identifying the initial entry point is essential because restoring the website without removing the underlying weakness could allow the attacker to return.

Credential Rotation May Be Necessary

If there is any indication that administrator credentials were stolen or exposed, Bank Rakyat would need to rotate affected passwords and other authentication secrets. Security teams may also review privileged accounts to identify unusual logins or newly created users. Multi-factor authentication should be enforced wherever supported, particularly for administrative portals and remote access services. Password changes alone may not be sufficient if the attacker also obtained active session tokens or other authentication material.

Web Servers Should Be Checked For Persistence

Attackers who compromise websites sometimes install web shells or other tools that allow them to regain access later. These backdoors can remain hidden even after the visible defacement has been removed. Security teams therefore need to compare files against known-good versions, inspect unusual scripts and review recently modified content. A compromised server may ultimately need to be rebuilt from a trusted image rather than simply cleaned in place.

Internal Networks Need To Be Reviewed As Well

Because Marlanwg claimed access beyond the website, investigators cannot safely assume the incident stopped at the web server. Network logs should be reviewed for unusual connections from the affected environment towards internal systems. Authentication activity, lateral movement attempts and access to sensitive repositories would all be relevant indicators. The objective is to determine whether the attacker managed to move beyond the initial compromised service before detection.

Data Exfiltration Must Be Investigated Separately

Even if suspicious internal access is discovered, investigators still need to determine whether information actually left the environment. Data exfiltration can occur through web connections, cloud services, encrypted tunnels or other channels that may not initially appear unusual. Large transfers, unusual destinations or activity outside normal business hours could provide useful clues. Until forensic analysis establishes evidence of data leaving the network, claims of stolen customer information remain uncertain.

Financial Institutions Need Strong Network Segmentation

Banks operate multiple categories of systems with very different risk levels. Public websites, employee workstations, customer databases and core transaction infrastructure should not all exist within one unrestricted network. Strong segmentation limits how far an attacker can move if one component is compromised. Even when a public website falls to an attacker, properly isolated banking systems should remain much harder to reach.

Third-Party Systems Should Also Be Reviewed

Modern banking websites frequently depend on external hosting providers, content-delivery networks, security services and development partners. If any third party has administrative access to the affected website, those relationships may need to be reviewed as part of the investigation. Compromised supplier credentials can sometimes provide attackers with an easier path than directly attacking the bank itself. Third-party access should therefore follow the same least-privilege principles applied to internal accounts.

Monitoring Becomes Critical After A Public Defacement

A visible compromise can attract additional attackers once they realise an organisation may be vulnerable. Bank Rakyat's security teams may therefore face increased scanning, phishing and intrusion attempts in the days following the incident. Enhanced monitoring can help identify whether other threat actors are attempting to exploit the publicity. Restoring the original website should not result in security monitoring immediately returning to normal levels.

Customers Should Monitor Their Accounts Normally

There is currently no confirmed evidence that customer banking accounts have been compromised, so customers should not assume their money is at immediate risk. Nevertheless, continuing to monitor account activity is sensible whenever a financial institution is dealing with a cybersecurity investigation. Unexpected transfers or account changes should be reported through official Bank Rakyat channels immediately. Customers should avoid responding to anyone claiming they need to move funds into a "safe account," which is a common scam technique.

Password Reuse Remains A Risk

Customers who use the same password across several websites should consider changing that habit regardless of whether this incident ultimately involves customer credentials. Attackers frequently combine information obtained from unrelated breaches and try those credentials against banking or email accounts. A password manager can make it easier to create a unique password for every important service. Reusing one password across banking, email and social media gives attackers multiple opportunities to compromise the same identity.

Email Security Is Particularly Important

A customer's email account often becomes the gateway to resetting passwords for many other services. Protecting email with a strong unique password and multi-factor authentication is therefore especially important. Even if banking credentials are secure, an attacker controlling the customer's email may be able to intercept security notifications or initiate account recovery processes. Good personal cybersecurity extends beyond the banking application itself.

Bank Rakyat Will Need To Communicate Clearly

Once the initial investigation is complete, customers will need clear information about what actually happened. The most useful update would explain which systems were affected, whether internal infrastructure was compromised, whether customer data was accessed and whether customers need to take any specific action. Clear communication helps prevent rumours from filling the information gap. It also reduces opportunities for scammers who rely on uncertainty to make fake security messages appear believable.

Silence Can Allow Speculation To Grow

During the first hours of an incident, organisations understandably avoid making statements before facts are established. However, prolonged uncertainty can allow attacker claims and social media speculation to become the dominant narrative. Financial institutions in particular need to balance investigative caution with customers' need for reassurance. Even a short update confirming what remains operational and what is still being investigated can help reduce confusion.

The Attacker's Claims Should Not Be Accepted At Face Value

Threat actors have obvious reasons to exaggerate what they have accomplished. Claiming access to internal infrastructure or customer information creates more pressure on the victim and generates greater media attention. Some claims eventually prove accurate, while others turn out to be significantly overstated. Evidence should therefore come from forensic investigation rather than from the attacker's own promotional message.

At The Same Time, Claims Should Not Simply Be Dismissed

The opposite mistake would be assuming the attacker is bluffing without investigation. A threat actor capable of changing public website content has already demonstrated at least some level of unauthorised access. Claims of deeper compromise therefore deserve serious examination even when they remain unverified publicly. Security teams need to investigate both possibilities rather than deciding the outcome based on assumptions.

The Incident Is A Reminder That Cybersecurity Is Continuous

Security controls that were effective yesterday do not automatically remain sufficient tomorrow. New vulnerabilities appear, credentials can be stolen and infrastructure changes over time. Financial institutions need continuous vulnerability management, penetration testing, monitoring and incident-response exercises rather than treating security as a one-time project. Public website defacement may appear relatively minor compared with ransomware or financial theft, but it can reveal weaknesses worth investigating before something more serious occurs.

Final Thoughts

Bank Rakyat is facing a suspected cybersecurity incident after parts of its public website were briefly defaced by a threat actor identifying itself as Marlanwg. The attacker claimed to have accessed internal infrastructure and retrieved a sample of data, while also requesting contact through the encrypted Session messaging platform. Those claims are serious, but they remain unverified publicly and should not yet be treated as proof that customer information or core banking systems were compromised.

Bank Rakyat has separately confirmed that its corporate website is currently unavailable and has directed customers towards iRakyat, BRICK, QR2E and i-bizRAKYAT as alternative digital channels. The visible website content reportedly returned to normal relatively quickly, although the broader investigation may continue behind the scenes.

For customers, there is currently no reason to assume that banking accounts or financial transactions have been compromised. The more immediate risk may be phishing attempts exploiting publicity around the incident, so customers should avoid unexpected links and access Bank Rakyat services only through official applications or known channels.

The crucial question now is whether this was simply a website defacement or evidence of a deeper intrusion. Until Bank Rakyat completes its investigation and provides a fuller statement, the attacker's claims of internal access and stolen data should remain exactly what they are for now: claims that still need to be independently verified.