14 OCT 2026 — Lembaga Tabung Haji, Malaysia's pilgrims fund, brought its main systems back online on 12 October after shutting down services across all channels for about four days following a cyberattack. It says depositors' savings are safe. It has not said what kind of attack it was, how the attackers got in, or what they reached.
Three functions of its THiJARI online platform were still unavailable at the time of its latest statement: password resets, new user registration and online account opening.
Four days offline
TH says it detected suspicious cyber activity on 7 October. The next day, The Star reported, it announced on X that it was suspending services to depositors as a precaution while it carried out "comprehensive monitoring of all its systems". It said it was working with the National Cyber Security Agency (NACSA) and CyberSecurity Malaysia.
Services returned in stages. Branches in Kedah, Terengganu and Kelantan reopened on Sunday 11 October, and those in other states on Monday, according to TH's restoration statement as carried by Bernama via Malay Mail. Partner-bank services were also switched back on, though Lowyat.NET reported that some users still could not reach TH through banking apps such as Maybank's MAE.
What TH has said so far
In its restoration statement, TH called the incident a criminal act against TH and the nation, intended to disrupt its services. It said it had lodged a police report and notified NACSA and the Department of Personal Data Protection (JPDP). Its own team worked with outside experts and national authorities to investigate, contain the threat and restore systems.
On 8 October, TH said that "depositors' savings and personal data remain safe and secure". The 12 October statement, as reported, confirms that savings are safe and does not repeat the line about personal data. Notifying the data protection regulator does not by itself prove that data was taken. TH has not said why it did so.
Why a pilgrims' fund is a target
TH is not a bank, but its depositors use it much like one, putting money aside for years towards the haj. That makes it a large store of savings and personal records, and a single point of failure for millions of people's plans.
The outage also landed at an awkward moment. In a written reply to Parliament on 8 October, Religious Affairs Minister Zulkifli Hasan said about 80 per cent of the 4.1 million depositors registered for the haj have less than RM15,000 saved, the amount they need by 31 December 2028 to keep their place in the queue, The Star reported. Saving that much in time depends on TH's channels staying open.
What depositors should do now
If you notice an unusual transaction, TH asks you to contact its contact centre immediately; the number is on its official website and social media accounts. Use only those official channels. Incidents like this are often followed by scam calls and messages that borrow the victim organisation's name. With password resets on THiJARI still switched off, treat any message offering to "reset" a THiJARI account as suspect.
The questions still open
TH has given no timeline for restoring the three THiJARI functions. It has not said whether the attack involved ransomware, whether any data left its systems, or whether the police and NACSA have identified who was responsible. For an institution holding the savings of millions, a restored login page answers only part of the question. A fuller account, once the investigation allows, would do more for confidence.
View author profile → · Editorial policy
