KUALA LUMPUR - A cyberattack may temporarily delete, alter or encrypt a bank’s operational data, but it is virtually impossible for such an intrusion to permanently erase customer loan records, according to experts.
Universiti Tun Hussein Onn Malaysia (UTHM) Centre for Cybersecurity and Data Intelligence (CCDI) senior researcher Prof Dr Zubaile Abdullah said modern banking systems were designed with multiple layers of security, including strict access controls, transaction audit trails, backup systems and multi-tiered data recovery mechanisms.
"Loan records may be stored across multiple systems. Even if hackers manage to delete a record from a bank’s primary database, it does not mean the customer’s debt simply disappears.
"The bank can still turn to backup records, transaction histories, loan agreements and other financial documents to piece together the missing information,” he told Bernama.
However, Zubaile, who is also a professor at UTHM’s Faculty of Computer Science and Information Technology, said the recovery process would depend on the extent of the damage, whether the backup data remained intact and how effectively the bank’s disaster recovery plan worked.
"I have seen comments on social media from netizens hoping hackers would attack banking systems and wipe out their debts. While they may be joking, the consequences of such attacks can be very serious,” he said.
He warned that a breach affecting the integrity of financial data could disrupt not only loan records but also account balances, payment transactions and essential banking services.
Meanwhile, Universiti Teknologi MARA (UiTM) psychological warfare expert and security analyst Dr Noor Nirwandy Mat Noordin said the chances of hackers successfully erasing bank data were extremely low, as such information was difficult to access and delete.
He said Malaysia’s banking sector was subject to strict information technology (IT) risk management controls, while financial institutions also fell under the National Critical Information Infrastructure (NCII).
"It is extremely difficult to wipe out banking data because it is protected by multiple layers of security, including encryption software and end-to-end encryption,” he said.
Noor Nirwandy said that apart from technological safeguards, Malaysia also had a strong legal framework, including the Personal Data Protection Act 2010, along with continuous monitoring by enforcement agencies to help keep financial information secure.
However, he warned that the financial sector could not afford to be complacent, as cyber threats were constantly evolving and becoming more sophisticated, with attackers looking for new weaknesses to exploit.
Noor Nirwandy said cybercriminals typically used malware and ransomware to lock or manipulate data for financial gain, rather than to erase borrowers’ debt records.
"Cybercriminals use hacking tools, including certain types of malware, to lock or damage data and demand payment from organisations seeking to regain access.
"A cyberattack on a bank will not wipe out customers’ debts. Instead, it can disrupt the financial system and put the bank’s ability to handle cyber threats to the test,” he said.
He added that although Malaysia’s cybersecurity threat level was considered moderate and adequate security measures were in place, cyberattacks could still occur. - BERNAMA