Tabung Haji Systems Resume After Oct 8 Cyberattack; Depositors’ Savings Confirmed Safe

Lembaga Tabung Haji (TH) says its main systems and services are back online after a cyberattack on 8 October forced a temporary shutdown across all channels. In a statement on 12 October, the pilgrimage fund confirmed that depositors’ savings remain safe following security checks, tighter controls and recovery work with external specialists and national cybersecurity agencies.

Branches and partner banking restored

TH said branches in Kedah, Terengganu and Kelantan reopened on 11 October, with other states operating as usual on 12 October. Services offered through strategic banking partners have also been reactivated. The agency stressed that close monitoring will continue so restored systems stay stable.

On 8 October, TH suspended systems and services to protect savings and personal data after the attack disrupted operations. It described the incident as a criminal act against TH and the nation, lodged a police report, and notified the National Cyber Security Agency (NACSA) and the Department of Personal Data Protection (JPDP).

"TH assures that depositors’ savings are safe. Close monitoring and security enhancements will continue to ensure that the reactivated systems and services operate safely and smoothly," the statement said.

THiJARI mostly back — with three gaps

All THiJARI platform functions have resumed except password resets, new user registration and online account opening. TH said those three areas still need more restoration work and will be updated through official channels. Depositors who spot unusual transactions, or who need help, were asked to call the TH Contact Centre at 03-6207 1919.

• Key TH systems and branch services restored after security checks
• Partner banking channels reactivated
• Police report filed; NACSA and JPDP notified
• THiJARI password reset, new registration and online account opening still offline

TH thanked depositors for their patience during the restoration window and apologised for the disruption, saying the temporary shutdown was necessary to protect savings. That framing matters: the fund chose availability loss over running compromised systems, which is the textbook incident-response trade-off even when customers feel the pain.

What this means for Malaysian readers

For the millions who save with TH, the headline is reassurance: the fund says money is intact and core services are returning. Still treat the incomplete THiJARI features as a live reminder to use only official apps and hotlines, and to report odd activity quickly. For Malaysian businesses and public agencies, the episode is a practical cybersecurity lesson — even large, regulated institutions can face multi-day disruption. Budget 2027’s talk of stronger cyber readiness and post-quantum work lands differently when a national savings institution has just spent days in recovery mode. SMEs that hold customer data should treat backup, incident playbooks and multi-factor access as day-to-day hygiene, not optional extras.

Source: Malay Mail — Tabung Haji systems resume after cyberattack, depositors’ savings confirmed safe