The cybersecurity challenges Malaysia faces have become a national problem rather than a collection of company IT headaches. Reported incidents are rising, fraud makes up most of them, a cyberattack with a ransom demand has hit the operator of the country’s main airports, and since August 2024 a dedicated law has put the most critical systems under direct regulation. This article looks at that national picture: what the numbers show, what the Cyber Security Act 2024 requires, and where the gaps remain.

What the numbers show

The clearest public count comes from Cyber999, the incident response centre run by CyberSecurity Malaysia. It received 5,735 incident reports in the first nine months of 2025, up from 4,659 in the same period of 2024, Digital Ministry secretary-general Fabian Bigar said in December 2025, as reported by the New Straits Times.

Fraud dominates those reports. In the third quarter of 2025, phishing and online fraud made up about 75 per cent of the incidents Cyber999 recorded, according to Cyber999 figures cited by cybersecurity firm Fortinet Malaysia. The same Star report carried Fortinet’s own estimate that scam-related losses reached about RM2.7 billion in 2025, a vendor estimate rather than an official tally.

These are only the cases that get reported, and the pattern is not new. A 2023 Borneo Post piece on CyberSecurity Malaysia’s work described the myriad of cyber risks already facing the country, from hacker groups targeting government websites to attacks on private companies, and the agency’s role in helping those affected.

When attacks reach national systems

The incident that brought the issue home came in March 2025. Prime Minister Anwar Ibrahim said a cyberattack had seriously affected Malaysia Airports Holdings Berhad (MAHB) and that the attackers had demanded US$10 million, a demand he said he refused without waiting five seconds, FMT reported.

The episode showed two things. Critical infrastructure in Malaysia is a target for criminals seeking large payouts. And the government’s stated position is that it will not pay ransoms, which places the weight on prevention and recovery rather than negotiation.

The Cyber Security Act 2024

Malaysia’s main legal answer is the Cyber Security Act 2024 (Act 854), which came into effect on 26 August 2024, together with regulations that mandate regular risk assessments and audits. It is administered by the National Cyber Security Agency (NACSA), and it does three main things.

• It designates national critical information infrastructure (NCII). The Act covers 11 sectors, among them government, banking and finance, energy, transport, water, health services, and information and communications.
• It imposes duties on NCII entities. They must carry out regular risk assessments and audits and report cyber incidents to the National Cyber Coordination and Command Centre (NC4) system.
• It licenses cyber security service providers. Firms that sell certain security services must hold a licence, which brings a previously open market under supervision.

The reporting rule has teeth. Under the Act itself, an NCII entity must notify NACSA’s chief executive and its sector lead whenever an incident has or might have occurred, and a breach can bring a fine of up to RM500,000, imprisonment of up to 10 years, or both. If the entity is a company and is convicted, its directors and other officers can be deemed guilty too.

The deadline is short. NACSA’s guidance, as The Star reported in October 2024, requires an initial report to the NC4 system within six hours of discovering an incident or even a potential threat. A Halim Hong & Quek note on the regulations adds that the first alert goes out immediately and a fuller report follows within 14 days.

Most small businesses are not NCII entities themselves. Many, though, supply banks, hospitals, utilities or government agencies that are, and those customers have every reason to ask their suppliers harder security questions in contracts and vendor checks.

Personal data: a second set of duties

The Cyber Security Act sits alongside the Malaysian Personal Data Protection Act, which governs how businesses handle customers’ and employees’ personal data. Its 2024 amendments added a duty to report personal data breaches, and by June 2025 the amended Act was fully in force, according to a guide by law firm Halim Hong & Quek.

Under that regime, a breach must be notified to the Personal Data Protection Commissioner as soon as practicable and no later than 72 hours after it occurs, the same guide explains. In practice that means a company hit by an attack may face two clocks at once if it is also an NCII entity: six hours to NACSA and 72 hours to the Commissioner.

The gaps a law cannot close

Laws set duties; they do not stop an employee clicking a convincing link. With phishing and fraud making up most reported incidents, the national weak point is human as much as technical. That is the case for treating a trained workforce as one of the most effective defences against cyber threats.

Two other gaps show up whenever a breach becomes public. The first is data that was readable once stolen; encrypting sensitive data means a stolen file is far less useful to whoever took it. The second is the scramble after discovery. With six-hour and 72-hour reporting clocks in Malaysian law, an organisation that does not have a plan in place for responding to cyber incidents will spend those hours working out who to call instead of containing the damage.

Skills are the third gap. Each NCII entity needs people who can run its risk assessments and meet the reporting clock, and the licensed providers they hire draw on the same pool of specialists. For a smaller firm, that usually means buying expertise from outside rather than hiring it.

What the national picture means for your business

Even if your company falls outside the Cyber Security Act, the national rules shape the environment you work in:

• Check whether you sit in an NCII supply chain. If your customers include banks, hospitals, utilities, telcos or government agencies, expect security questionnaires, audit rights and incident-reporting clauses in your contracts.
• Buy security services from licensed providers. If you hire an outside firm for security services, ask whether the service it is selling falls under the Act’s licensing regime and whether the firm holds the licence.
• Know your reporting routes before you need them. Personal data breaches go to the Personal Data Protection Commissioner, and incidents can be reported to CyberSecurity Malaysia’s Cyber999 centre. Write the contacts into your incident plan.
• Get legal advice on your own duties. Whether a specific obligation applies to you depends on your sector and the data you hold, which is a question for a lawyer, not a blog.

For the practical controls a smaller company can put in place, from passwords to backups, our guide to small business cybersecurity best practices for Malaysian SMEs covers the checklist this article deliberately leaves out.