Serangan Siber Merentas Dunia: Insiden Malaysia dan Risiko Vendor

Serangan siber tidak perlu bermula di Malaysia untuk memberi kesan kepada rakyat Malaysia. Syarikat di banyak negara berkongsi pembekal teknologi, sistem tempahan, storan awan dan perkhidmatan pembayaran. Jika satu penyedia mengalami insiden, maklumat pelanggan daripada beberapa negara mungkin berada dalam skop siasatan yang sama. Ini tidak semestinya satu kumpulan menyerang seluruh dunia serentak; selalunya beberapa insiden berasingan merebak kesannya melalui hubungan digital yang dikongsi.

Pada 31 Oktober 2026, Malaysia Airlines mengumumkan insiden keselamatan siber yang melibatkan Amadeus, penyedia teknologi tempahan pihak ketiga. Maklumat pelanggan yang diproses melalui Amadeus antara Ogos 2023 hingga September 2026 mungkin terjejas. Malaysia Airlines menyatakan sistem IT miliknya sendiri tidak dikompromi dan, setakat kenyataan itu, tiada bukti maklumat kewangan diakses. Jadi fakta yang diketahui ialah data tertentu mungkin terlibat melalui penyedia luar. Kenyataan itu tidak mengatakan semua penumpang terjejas atau wang pelanggan telah dicuri.

Kenapa pembekal luar menjadi sasaran penting? Vendor yang mengurus tempahan atau akaun pelanggan mungkin mempunyai akses kepada data bagi pihak beberapa organisasi. Penyerang boleh cuba mencuri akaun pekerja, mengeksploitasi kelemahan perisian, atau memperdaya staf supaya menyerahkan akses. Jika sistem vendor digunakan merentas negara, satu pencerobohan berpotensi menyentuh lebih daripada satu pasaran. Namun, Malaysia Airlines belum menerangkan punca teknikal insiden ini, jadi kita tidak patut meneka bagaimana penyerang masuk.

Corak ancaman memang bersifat antarabangsa. Microsoft Digital Defense Report 2026 menyenaraikan agensi dan perkhidmatan kerajaan sebagai sektor global paling banyak terkesan dalam data pemerhatiannya, diikuti teknologi maklumat serta penyelidikan dan akademia. Laporan itu juga menyatakan bahawa banyak pencerobohan bermula melalui manusia atau kelayakan akaun yang sah—contohnya kata laluan dicuri atau pengguna diperdaya—bukan semata-mata melalui kelemahan teknikal yang rumit. Angka laporan keselamatan mewakili apa yang dapat diperhatikan oleh penyedia dan penyelidik, bukan kiraan lengkap setiap serangan di dunia.

Di Malaysia, CyberSecurity Malaysia menerima dan mengendalikan 2,715 laporan insiden pada suku kedua 2026, berbanding 2,188 pada suku pertama. Laporan data breach meningkat daripada 124 kepada 175, iaitu 41.13 peratus. Penipuan ialah kategori terbesar; kebanyakannya melibatkan phishing. Angka ini merujuk kes yang dilaporkan dan dikendalikan oleh Cyber999, bukannya semua serangan yang benar-benar berlaku di negara ini.

Apa kesannya kepada orang biasa? Jika butiran hubungan atau tempahan terdedah, penipu mungkin cuba menggunakan maklumat yang nampak meyakinkan untuk menghantar mesej tentang pembatalan penerbangan, bayaran balik atau pengesahan tempahan. Itu risiko susulan yang perlu diberi perhatian, bukan bukti bahawa mesej palsu sudah dihantar dalam kes ini. Malaysia Airlines sendiri menasihatkan pelanggan supaya berjaga-jaga terhadap komunikasi tidak diminta yang meminta maklumat peribadi atau kewangan.

Jika kau menerima mesej seperti itu, jangan tekan pautan dalam mesej dan jangan berikan kata laluan, nombor kad atau kod OTP. Buka aplikasi rasmi atau taip sendiri alamat laman syarikat penerbangan untuk menyemak tempahan. Jika sudah memasukkan kata laluan yang turut digunakan di tempat lain, tukar kata laluan itu melalui laman rasmi dan aktifkan pengesahan berbilang faktor atau passkey. Jika maklumat bank atau kad sudah diberikan, hubungi bank melalui nombor rasmi dengan segera.

Bagi organisasi, insiden seperti ini menunjukkan kenapa akses vendor perlu dihadkan kepada data yang benar-benar diperlukan, akaun vendor perlu menggunakan MFA, dan log akses perlu disemak. Apabila berlaku insiden, organisasi patut meminta vendor menjelaskan data apa yang mungkin terlibat, tempoh pendedahan, tindakan membendung akses dan langkah pemulihan. Sandaran yang diuji dan pelan tindak balas insiden juga membantu mengehadkan gangguan.

Kesimpulannya, serangan siber memang merentas negara kerana perkhidmatan digital saling bergantung. Tetapi setiap laporan perlu dibaca dengan teliti: bezakan perkara yang disahkan daripada perkara yang masih disiasat. Dalam kes Malaysia Airlines, maklumat pelanggan tertentu mungkin terjejas melalui Amadeus; setakat pengumuman syarikat, sistem IT Malaysia Airlines sendiri tidak diceroboh dan tiada bukti maklumat kewangan diakses.

Sumber untuk semakan:
Malaysia Airlines — Cybersecurity Incident Involving Third-Party Technology Provider, 31 Oktober 2026
https://www.malaysiaairlines.com/qa/en/mh-media-centre/important-for-you/passengers-to-arrive-early-klia1.html

CyberSecurity Malaysia — Quarter 2 2026 Cyber Incident Summary Report
https://www.cybersecurity.my/portal-main/advisories-details/16acf41b-a6d5-11f1-b812-0050568ccc16

Microsoft — Digital Defense Report 2026
https://www.microsoft.com/en-us/corporate-responsibility/topics/cybersecurity/reports/microsoft-digital-defense-report/

A cyberattack does not have to start in Malaysia to affect people here. Companies in different countries share technology providers, booking systems, cloud storage and payment services. If one provider has an incident, customer information from several countries may fall within the same investigation. That does not necessarily mean one group attacked the whole world at once; often, separate incidents spread their effects through shared digital services.

On 31 October 2026, Malaysia Airlines announced a cybersecurity incident involving Amadeus, a third-party airline reservation technology provider. Certain customer information processed through Amadeus between August 2023 and September 2026 may have been affected. Malaysia Airlines said its own IT systems had not been compromised and that, as of its statement, there was no evidence that financial information had been accessed. The confirmed point is that some data may have been involved through an external provider. The statement does not say that every passenger was affected or that customer money was stolen.

Why are external providers important targets? A vendor that manages bookings or customer accounts may have access to data on behalf of several organisations. Attackers may try to steal an employee’s account, exploit a software weakness, or trick staff into granting access. If a vendor’s system serves customers across borders, one intrusion could affect more than one market. Malaysia Airlines has not explained the technical cause of this incident, so we should not guess how the attackers got in.

The wider threat landscape is international. Microsoft’s Digital Defense Report 2026 lists government agencies and services as the most affected global sector in its observations, followed by information technology and research and academia. The report also says many intrusions begin with people or valid account credentials—for example, stolen passwords or deceived users—rather than only with sophisticated technical flaws. Security reports describe what their providers and researchers can observe; they are not a complete count of every attack worldwide.

In Malaysia, CyberSecurity Malaysia received and handled 2,715 incident reports in the second quarter of 2026, compared with 2,188 in the first quarter. Data-breach reports rose from 124 to 175, an increase of 41.13 per cent. Fraud was the largest category, with phishing making up most of those cases. These figures cover incidents reported to and handled by Cyber999, not every attack that actually occurred in the country.

What could this mean for ordinary people? If contact or booking details were exposed, scammers might use convincing-looking information in messages about a cancelled flight, a refund or a booking confirmation. That is a follow-on risk to watch for, not evidence that fake messages have already been sent in this case. Malaysia Airlines itself advised customers to be alert to unsolicited communications asking for personal or financial information.

If you receive a message like that, do not tap its link or share your password, card number or one-time code. Open the official app or type the airline’s address yourself to check a booking. If you reused the same password elsewhere, change it through the official site and turn on multi-factor authentication or a passkey. If you have already shared bank or card details, contact your bank using its official number immediately.

For organisations, incidents like this show why vendor access should be limited to the data that is genuinely needed, vendor accounts should use MFA, and access logs should be reviewed. During an incident, ask the provider which data may be involved, the exposure period, how access was contained and what recovery steps are underway. Tested backups and an incident-response plan also help limit disruption.

The key point is that cyberattacks cross borders because digital services depend on one another. Each report still needs to be read carefully: separate confirmed facts from matters under investigation. In the Malaysia Airlines case, certain customer information may have been affected through Amadeus; according to the company’s statement, its own IT systems were not compromised and there was no evidence that financial information had been accessed.

Sources:
Malaysia Airlines — Cybersecurity Incident Involving Third-Party Technology Provider, 31 October 2026
https://www.malaysiaairlines.com/qa/en/mh-media-centre/important-for-you/passengers-to-arrive-early-klia1.html

CyberSecurity Malaysia — Quarter 2 2026 Cyber Incident Summary Report
https://www.cybersecurity.my/portal-main/advisories-details/16acf41b-a6d5-11f1-b812-0050568ccc16

Microsoft — Digital Defense Report 2026
https://www.microsoft.com/en-us/corporate-responsibility/topics/cybersecurity/reports/microsoft-digital-defense-report/