Lembaga Tabung Haji (TH) has resumed its key systems and services after a Tabung Haji cyberattack on Oct 8 led to a temporary suspension, and the agency says depositors’ savings are safe. In a statement issued today, TH said the reactivation followed comprehensive security checks, the strengthening of controls and system recovery measures.
The agency also said it worked with national cybersecurity authorities to address the threat and reinforce system security, so that the reactivated services can operate safely. TH has lodged a police report and continues to monitor its systems closely.
Tabung Haji Cyberattack Led to Suspension Across All Channels
On Oct 8, TH temporarily suspended system and service operations across all channels. The agency said the suspension was meant to protect depositors’ savings and personal information after the attack caused service disruptions.
TH described the Tabung Haji cyberattack as a criminal act against TH and the nation, intended to disrupt its services. After the incident, its internal team worked with external experts and national cybersecurity authorities to investigate the event, address the threat and restore the systems.
Branches Reopen After Cyberattack
According to the statement, TH branches in Kedah, Terengganu and Kelantan resumed operations yesterday. Branches in other states opened as usual today. Services provided through strategic banking partners have also been reactivated.
The statement said the reactivation followed those checks and recovery measures. It added: “TH assures that depositors’ savings are safe. Close monitoring and security enhancements will continue to ensure that the reactivated systems and services operate safely and smoothly.”
THiJARI Platform Functions Still Pending Restoration
TH also announced that all functions of the THiJARI platform have resumed operations, with three exceptions. Password resets, new user registration and online account opening remain unavailable.
The agency said these three functions still require further restoration work before they can be reactivated. Updates will be communicated through TH’s official channels from time to time.
TH lodged a police report over the incident and notified the mNational Cyber Security Agency (NACSA) and the Department of Personal Data Protection (JPDP). It has collaborated with cybersecurity authorities to address the threat and reinforce system security, which it said ensures the safety of the reactivated services.
Guidance for Depositors After the Tabung Haji Cyberattack
TH urged depositors who detect unusual transactions, or who need assistance or have inquiries, to contact the TH Contact Centre (THCC) immediately at 03-6207 1919. The agency said it continues to monitor its systems closely and will keep strengthening security.
TH also thanked depositors for their patience, cooperation and support during the restoration period. “We once again apologise and deeply regret the incident; however, these measures were necessary to safeguard depositors’ savings,” the statement said.
Timeline at a Glance
- Oct 8: TH suspends system and service operations across all channels after the cyberattack.
- After the incident: TH’s internal team, external experts and national cybersecurity authorities investigate and restore the systems, a police report is lodged, and NACSA and JPDP are notified.
- Yesterday: Branches in Kedah, Terengganu and Kelantan resume operations.
- Today: Branches in other states open as usual.
- Also confirmed: services through strategic banking partners have been reactivated.
- Still pending: THiJARI password resets, new user registration and online account opening.
What Is Confirmed So Far
Based on the statement, three points are confirmed. Depositors’ savings are safe, key systems and services have resumed, and three THiJARI functions are still being restored.
TH said it will continue close monitoring and security enhancements, and it will share further updates through its official channels. Depositors with concerns can reach the THCC at 03-6207 1919.
