SecurityNot yet confirmed elsewhere1 publisher2 min readPublished
Tabung Haji leaves three THiJARI functions offline as services return after Oct 8 attack
Tabung Haji resumed services after its Oct 8 cyberattack, but three THiJARI functions remain offline. Its assurance that depositor savings are safe comes from its own statement, as relayed by The Cyber Express.
The Watch · Security desk
What happened
- TH suspended system and service operations across all channels on Oct 8, saying the pause was meant to protect depositors' savings and personal information.
- TH lodged a police report and notified the National Cyber Security Agency (NACSA) and the Department of Personal Data Protection (JPDP).
- TH said reactivation followed comprehensive security checks, strengthened controls and system recovery measures.
- Branches in Kedah, Terengganu and Kelantan resumed operations yesterday, and branches in the other states opened as usual today.
Why it matters
- constraint A locked-out THiJARI user cannot reset a password online, and a new customer cannot register or open an account online, until TH finishes the remaining work.
- decision Checking for fraud falls partly to depositors. TH asks anyone who detects unusual transactions to call the contact centre at 03-6207 1919 immediately.
- exposure The savings assurance is TH's own word, relayed by one outlet. The report quotes neither NACSA nor JPDP, the two bodies TH says it notified.
On the statement's own terms this is a partial restoration. Branches in Kedah, Terengganu and Kelantan reopened one day ahead of branches in the other states [13]. Services through strategic banking partners are back [4]. The three THiJARI functions still need further restoration work before they can be reactivated, and TH said updates will come through its official channels from time to time [6].
TH calls the attack a criminal act against TH and the nation, intended to disrupt its services [8]. TH said its own team investigated the incident alongside outside experts and the national cybersecurity authorities, dealing with the threat and bringing the systems back [9]. The statement does not say how the attackers got in, whether any data was taken, who was responsible, or when the three functions will return. The report dates the statement only as "today", so the length of the outage cannot be counted in days.
TH said it continues to monitor its systems closely and will keep strengthening security [12]. On the savings question the statement said: "TH assures that depositors' savings are safe. Close monitoring and security enhancements will continue to ensure that the reactivated systems and services operate safely and smoothly." [15]
It also apologised. "We once again apologise and deeply regret the incident; however, these measures were necessary to safeguard depositors' savings," the statement said [10].
What to watch
- A TH update giving a date for password resets, new user registration and online account opening on THiJARI.
- Any disclosure from TH, NACSA or JPDP on how the attackers got in and whether personal data was accessed.
- Any police finding on who was behind the Oct 8 attack.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence35
- Adoption
- Insufficient
- Hype gap+10
- Incentives70
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Lembaga Tabung Haji resumed its key systems and services after a cyberattack on Oct 8 led to a temporary suspension, and says depositors' savings are safe.
- [2]
On Oct 8 TH temporarily suspended system and service operations across all channels, which it said was meant to protect depositors' savings and personal information.
- [3]
TH branches in Kedah, Terengganu and Kelantan resumed operations yesterday; branches in other states opened as usual today.
- [4]
Services provided through strategic banking partners have been reactivated.
- [5]
All functions of the THiJARI platform have resumed with three exceptions: password resets, new user registration and online account opening remain unavailable.
- [6]
The three THiJARI functions still require further restoration work before they can be reactivated; updates will be communicated through TH's official channels from time to time.
- [7]
TH lodged a police report and notified the National Cyber Security Agency (NACSA) and the Department of Personal Data Protection (JPDP).
- [8]
TH described the cyberattack as a criminal act against TH and the nation, intended to disrupt its services.
- [9]
After the incident, TH's internal team worked with external experts and national cybersecurity authorities to investigate the event, address the threat and restore the systems.
- [10]
"We once again apologise and deeply regret the incident; however, these measures were necessary to safeguard depositors' savings,"
- [11]
TH urged depositors who detect unusual transactions, or who need assistance or have inquiries, to contact the TH Contact Centre (THCC) immediately at 03-6207 1919.
- [12]
TH said it continues to monitor its systems closely and will keep strengthening security.
- [13]
Branches in Kedah, Terengganu and Kelantan reopened one day before branches in the other states.
- [14]
TH said the reactivation followed comprehensive security checks, the strengthening of controls and system recovery measures.
ReportedContestedSource: TH statement, as reported by The Cyber Express2 sources— create a free account to open themView cited source - [15]
"TH assures that depositors' savings are safe. Close monitoring and security enhancements will continue to ensure that the reactivated systems and services operate safely and smoothly."
ReportedContestedSource: TH statement, as reported by The Cyber Express2 sources— create a free account to open themView cited source
Sources
1 independent publisher whose own reporting we read for this story.
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.