A cyber breach at one of the Health Ministry’s facilities on Thursday (Nov 12) was limited to a file storage and sharing platform and did not disrupt healthcare services or the ministry’s main operational systems, the ministry said.
In a statement on Saturday (Nov 14), the ministry said someone had gained unauthorised access to the supporting platform at the facility, which it did not name. A preliminary investigation by its Computer Security Incident Response Team found that the incident did not involve the encryption of its main databases.
Public access to the platform was blocked immediately to contain the incident, the ministry said. It has also tightened security at the facility by resetting user passwords, auditing its servers and enforcing multi-factor authentication.
All of the ministry’s main systems, as well as health services and patient treatment, are running as usual, it said, adding that the public could keep their appointments and continue their treatment at ministry facilities without worry.
The ministry said it was working closely with the National Cyber Security Agency (NACSA), in line with the Cyber Security Act 2024, and would keep monitoring its systems.
It also warned that downloading, keeping or spreading official government documents obtained unlawfully is a serious offence that can lead to legal action. The statement did not say whether any files were taken from the platform.
The breach comes as the government steps up its cyber defences. NACSA raised the national cybersecurity threat level to medium on Nov 4, and Prime Minister Datuk Seri Anwar Ibrahim said on Saturday that Malaysia faces thousands of attempted cyberattacks every month, adding that the government had discussed strengthening the armed forces’ cybersecurity unit.
It is not the first cyber scare at the ministry this year. In June, it temporarily took its official website offline after a cybersecurity incident and said patient data was safe.
The ministry, which runs the country’s public hospitals and clinics, said it remained committed to keeping its information technology systems secure and the public’s health data confidential.