Malaysia Cyberattack Response: Lessons

When a cyberattack hits, speed of response decides how much damage the business takes. In late October 2026, Rakuten Trade, a Malaysian online broker, kept online Bursa Malaysia trading switched off for more than a week. This Malaysia cyberattack response story holds useful lessons for every finance firm.

What happened at Rakuten Trade

According to The Edge Malaysia, the broker took a precautionary step after it detected a cybersecurity attempt. The report does not say what type of attack it was. Online buying and selling of Bursa stocks stopped on its website and mobile app.

Customers could still send manual sell orders through customer service. US and Hong Kong stock trading, deposits, withdrawals and account access stayed available. The CEO said the firm had found no evidence of data loss so far.

A client notice dated 28 October said the broker was in the final stages of checks. As of 30 October there was still no confirmed restart date, and the report showed no public statement from the regulator or Bursa.

Malaysia cyberattack response: three lessons

Lesson 1: Plan for a degraded mode

Switching off a service can be the right call when you are unsure how far an attacker has reached. But it hurts customers and revenue. The firm kept a manual sell route open, which shows why a fallback plan helps. Decide in advance which services can run in a limited way, and who can approve that.

Lesson 2: Prove it is safe before you restart

The broker described verification, testing and security validation before going live again. That is sensible, because restoring too early can let an attacker back in. Testing your controls before an incident also helps. Breach and attack simulation safely replays real attacker techniques against your defences, so you can find gaps early.

Lesson 3: Watch your systems day and night

Attacks do not follow office hours. If nobody reviews alerts overnight, a small warning can grow into a long outage. Round-the-clock monitoring helps you spot trouble sooner and contain it faster. Good records of who did what also make the later investigation much easier.

Guidance worth following

NIST published the final version of SP 800-61 Revision 3 in 2025. It treats incident response as part of wider cybersecurity risk management, not a one-off emergency task. In Malaysia, the Securities Commission's Guidelines on Technology Risk Management for capital market entities took effect on 19 August 2024. Firms in this sector should read the full text for what applies to them.

How Primary Guard helps

Primary Guard's managed SOC offers 24/7 monitoring, with AI reviewing each alert and human analysts making the final containment decision. Our endpoint security operations service helps contain threats on laptops and servers. If ransomware is a concern, see our ransomware recovery page.

Not sure how ready your team is for a serious incident? Primary Guard offers a free security assessment. Request your free assessment to start the conversation.

Frequently asked questions

What should a small finance firm do in the first hour of a suspected cyberattack?

Isolate the affected systems, keep the logs, alert your incident contacts and inform senior management. Do not wipe or reinstall machines yet, because that can destroy evidence. Then follow your written incident plan.

How can a business keep serving customers while systems are offline?

Agree a manual fallback in advance, such as phone orders or paper forms, and test it. Prepare short customer notices too, so staff can share facts quickly instead of guessing.

How is a managed SOC different from an in-house IT team?

An in-house IT team handles many jobs, from help desk to projects. A managed SOC is focused on security alerts and has analysts reviewing them day and night.

Key takeaway

A cyber incident is a business problem, not only an IT problem. Plan a fallback, test before you restart, and keep someone watching around the clock. Firms that prepare early recover faster and keep customer trust.

Sources

The Edge Malaysia, Rakuten Trade's Bursa trading has been down for over a week following cyberattack, with no restart date (30 October 2026) | NIST, SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management (2025) | Securities Commission Malaysia, SC's Guidelines on Technology Risk Management Take Effect Today (19 August 2024).

This article is based on public news reports up to 30 October 2026 and is general information, not legal or professional advice. Primary Guard is not involved in the incident described.