The official data from CyberSecurity Malaysia’s Cyber999 Incident Response Centre shows that cyber incidents in Malaysia remained persistent throughout 2025, with fraud continuing to account for the largest share of reported incidents.
In Q3 2025, Cyber999 recorded 2,020 cybersecurity incidents. In Q4 2025, the figure was 1,881, representing a 7% decrease from the previous quarter. Despite the decline, CyberSecurity Malaysia noted that cyber threats remained persistent and continued to evolve in terms of tactics, techniques, sophistication, and targets.
In Q3 2025, fraud accounted for 75% of reported incidents, followed by intrusion at 9% and data breach at 7%. In Q4, fraud remained the largest category, with 1,471 fraud incidents, followed by 171 data breach incidents and 101 intrusion incidents.
As of September 2025, Cyber999 had recorded 5,735 cyber incident reports, compared with 4,659 cases during the same period in 2024 — an increase of 1,076 cases, or approximately 23% year-on-year.
Separately, police recorded 67,735 online fraud cases involving approximately RM2.7 billion in losses from January to November 2025. Telecommunications fraud alone accounted for approximately RM715.7 million of those losses.
Source: CyberSecurity Malaysia / MyCERT Cyber Incident Quarterly Summary Reports; Royal Malaysia Police / Digital Ministry statements.
Why SMEs Are in the Crosshairs
Simply Data’s Malaysia Cybersecurity Threat Report 2025 recorded 428.7 million unique IOC lookups and found that Valid Accounts and Brute Force were the two most commonly observed techniques in its dataset, accounting for 18.71% and 15.17% respectively.
For SMEs, this highlights the importance of protecting accounts, credentials, systems, and employee access. Phishing can be used to steal login credentials, while compromised accounts can give attackers access to business systems, customer information, and financial records.
Strong passwords, multi-factor authentication, regular software updates, employee awareness, and appropriate security controls can all help reduce exposure to these risks.
What the PDPA Amendment Means for Malaysian Businesses in 2026
Malaysia’s Personal Data Protection (Amendment) Act 2024 introduced significant changes to the country’s personal data protection framework, including requirements relating to personal data breach notification.
For qualifying personal data breaches, data controllers are required to notify the Personal Data Protection Commissioner as soon as practicable and within the prescribed 72-hour period after becoming aware of the breach. The amended framework also increased certain penalties under the PDPA.
Businesses should therefore ensure that they have appropriate data protection practices, breach response procedures, and internal processes in place.
Source: Personal Data Protection (Amendment) Act 2024 and Personal Data Protection Commissioner guidance.
What Protection Looks Like in Practice
Multi-factor authentication can help protect accounts even when passwords are compromised. Email security can help identify and block phishing attempts, while regular software updates help address known vulnerabilities.
A documented incident response plan can also help businesses respond more quickly when an incident occurs — from identifying the problem to containing the damage and determining the appropriate next steps.
Cybersecurity does not always require an enterprise-level budget. It requires the right security controls, good practices, and consistent implementation.
Emspaced IT Solutions provides practical IT and cybersecurity support for Malaysian SMEs, including network assessments, email security, endpoint protection, website security, and ongoing support.
Talk to our team or visit emspaced.com to find out more.
