Bank Negara Imposes RM1 Million Fine on Bank Rakyat for Cybersecurity and Data Protection Breaches

Bank Negara Malaysia (BNM) has imposed an administrative monetary penalty (AMP) of RM1 million on Bank Kerjasama Rakyat Malaysia Bhd (Bank Rakyat) for serious breaches related to cybersecurity and customer information protection. The penalty, which was paid by the bank on January 26, 2026, stems from a cybersecurity incident that occurred earlier this year, highlighting the regulator’s zero-tolerance stance on data security failures within the financial sector.

This enforcement action underscores the increasing scrutiny faced by financial institutions as they navigate a landscape of escalating cyber threats. For Bank Rakyat, one of Malaysia’s largest cooperative banks with a vast retail customer base, the fine serves as a costly reminder of the critical importance of maintaining impenetrable digital defenses.

The Incident: A Breach of Trust and Security

According to BNM, the penalty was issued following a cybersecurity incident in which an external threat actor gained unauthorized access to Bank Rakyat’s information technology (IT) infrastructure. While the central bank did not disclose the specific volume of data compromised or the exact nature of the intrusion, the fact that an external actor successfully breached the system indicates a significant lapse in perimeter defense.

The central bank’s investigation revealed that the breach was not merely an isolated technical glitch but the result of systemic failures in the bank’s security posture. Specifically, BNM found that Bank Rakyat had failed to comply with two critical policy documents that form the backbone of Malaysia’s financial cybersecurity framework:

1. Risk Management in Technology Policy Document (RMiT PD): This policy mandates that financial institutions implement robust cybersecurity standards, including regular vulnerability assessments, penetration testing, and real-time monitoring. BNM found that Bank Rakyat’s controls were inadequate to detect or prevent the intrusion.

2. Management of Customer Information and Permitted Disclosures Policy Document (MCIPD PD): This policy requires banks to safeguard sensitive customer data through encryption, access controls, and strict governance. The investigation revealed that the bank lacked adequate controls to protect this information once the initial breach occurred.

"These breaches were attributed to inadequate cybersecurity controls and incident response,” BNM stated in its official announcement. The central bank emphasized that financial institutions are expected to maintain high levels of vigilance and invest in state-of-the-art security measures to prevent such intrusions, noting that the failure to do so constitutes a breach of regulatory trust.

Aggravating and Mitigating Factors

In determining the size of the penalty, BNM considered a range of aggravating and mitigating factors, ensuring that the punishment fit the severity of the non-compliance while acknowledging efforts made post-incident.

Aggravating Factors:

• Severity of the Breach: The unauthorized access to IT infrastructure posed a significant risk to customer data integrity and financial stability.

• Lack of Reasonable Care: BNM noted that Bank Rakyat had failed to exercise "reasonable care" in ensuring compliance with the RMiT and MCIPD requirements, suggesting that the lapses were preventable with proper governance.

Mitigating Factors:

• Remedial Actions: BNM acknowledged that Bank Rakyat has since taken significant steps to strengthen its cybersecurity framework. These include upgrading its information and communication technology (ICT) controls, allocating additional resources to security governance, and enhancing its incident response protocols.

• Cooperation: The bank’s cooperation during the investigation and its commitment to preventing recurrence likely played a role in capping the penalty at RM1 million, rather than imposing more severe supervisory actions such as license restrictions or higher fines.

A Warning to the Financial Sector

The enforcement action serves as a stark reminder to all financial institutions (FIs) in Malaysia regarding their obligations under the RMiT and MCIPD frameworks. As digital banking becomes the norm, the attack surface for cybercriminals expands, making robust cybersecurity not just a technical requirement but a core business imperative.

BNM reiterated that it requires all FIs to strictly adhere to these policies to maintain the integrity and stability of the national financial system.

"BNM will not hesitate to take appropriate supervisory and enforcement actions should any FI fail to meet legal and/or regulatory requirements," the central bank warned. "The enforcement action taken against Bank Rakyat is in line with the approach and processes outlined in BNM’s published Enforcement Approach."

This statement signals that BNM is moving beyond advisory roles to active enforcement, particularly in areas where consumer data is at risk. With the rise of sophisticated phishing attacks, ransomware, and state-sponsored cyber threats, the regulator expects banks to stay ahead of the curve rather than react after a breach occurs.

Implications for Consumers and the Industry

For consumers, this incident underscores the importance of monitoring their financial accounts for unusual activity. While Bank Rakyat has assured stakeholders that remedial measures are in place, customers are advised to remain vigilant, update their passwords regularly, and enable multi-factor authentication wherever possible.

For the industry, the fine highlights the growing cost of non-compliance. Beyond the monetary penalty, banks face reputational damage, loss of customer trust, and potential legal liabilities from affected clients. In an era where data is often referred to as the "new oil," protecting it is paramount.

Bank Rakyat has not issued a separate public statement detailing the specific extent of the data compromised, but the payment of the fine marks the closure of this particular regulatory chapter. The bank is now expected to continue its efforts to rebuild trust through enhanced transparency and demonstrable improvements in its security infrastructure. As Malaysia pushes toward a more digital economy, the lesson from Bank Rakyat is clear: cybersecurity is not optional; it is foundational.