Digital Ministry and CyberSecurity Malaysia Probe Prasarana Cyber Incident

Prasarana Cyber Incident Under Investigation in Malaysia

The Digital Ministry and CyberSecurity Malaysia have launched a joint investigation into a cyber incident affecting Prasarana Malaysia Berhad, the government-linked company responsible for operating the country's major public transport systems including LRT, MRT, monorail, and Rapid bus services.

The probe is focused on determining the full extent of the data impact from the incident. Prasarana operates critical infrastructure that serves millions of daily commuters across Kuala Lumpur and other Malaysian cities, making the security of its systems a matter of national interest.

Why Critical Infrastructure Cybersecurity Matters for Malaysia

Attacks targeting transport operators and other critical infrastructure providers have increased globally in recent years. Malaysia's Cyber Security Act 2024, which came into force in 2024, specifically designates public transport as a National Critical Information Infrastructure (NCII) sector, subjecting operators like Prasarana to mandatory cybersecurity standards and incident reporting requirements.

Under the Act, NCII entities must comply with cybersecurity risk assessments, implement minimum security standards, and report incidents to the relevant sector lead. The Digital Ministry's involvement in the Prasarana probe signals that these regulatory mechanisms are being activated.

What Businesses Should Learn from This Incident

• Incident response readiness — Every organisation should have a tested incident response plan. The speed of detection and containment directly determines the scope of damage.
• Supply chain visibility — Large operators like Prasarana depend on dozens of technology vendors. A breach in any connected system can cascade through the network.
• Regulatory compliance is not optional — The Cyber Security Act 2024 carries enforcement powers. Organisations in NCII sectors face mandatory reporting obligations and potential penalties for non-compliance.
• Data impact assessment — When a breach occurs, understanding what data was accessed or exfiltrated is the first priority for both regulatory reporting and stakeholder communication.

Malaysia's Growing Cybersecurity Regulatory Framework

This incident comes as Malaysia continues to strengthen its cybersecurity posture. The National Cyber Security Agency (NACSA) coordinates cross-sector response, while CyberSecurity Malaysia's MyCERT handles technical incident response. The government has signalled plans to establish a dedicated central cybersecurity agency to further consolidate these efforts.

For businesses operating in Malaysia, the Prasarana incident is a reminder that cyber incidents affecting critical infrastructure attract immediate government attention and scrutiny. Organisations should review their own security controls, ensure compliance with applicable regulations, and establish clear communication channels with MyCERT for incident reporting.

Frequently Asked Questions

What happened in the Prasarana cyber incident?

The Digital Ministry and CyberSecurity Malaysia are investigating a cyber incident at Prasarana Malaysia Berhad, focusing on the impact to data and systems. Full details of the breach have not been publicly disclosed.

Is Prasarana considered critical infrastructure in Malaysia?

Yes. Public transport operators fall under the National Critical Information Infrastructure (NCII) classification in Malaysia's Cyber Security Act 2024, subjecting them to mandatory cybersecurity standards.

How should Malaysian businesses report cyber incidents?

Businesses should report incidents to MyCERT (Malaysia Computer Emergency Response Team) at www.mycert.org.my. NCII entities have mandatory reporting obligations under the Cyber Security Act 2024.