The Malaysian Anti-Corruption Commission detects and foils between 80,000 and 90,000 cyberattack attempts every day. That figure, given by the commission’s own records and information management director, is the most useful number an SME will see this month, and not because a small company faces anything like that volume. It is useful because it recalibrates what “normal” looks like, and because zero trust Malaysia advice aimed at a government agency translates into four controls that a 40-person company can actually implement.
The director, Zuhairie Abu Bakar, said the volume shows how valuable the information is. His second point is the one most businesses skip: the risk is not only that someone gets in, but that what they take does damage after they have left.
Last updated: 19 October 2026. Figures and quotations are taken from reports published by The Star and The Vibes on 11, 12 and 13 October 2026, which carry the commission’s statements and the assessments of two named cybersecurity specialists.
Zero Trust Malaysia: what MACC blocks, and what it says the risk is
The commission’s Records and Information Management Division runs layered defences: multi-factor authentication, firewalls, real-time monitoring, encryption, and security testing of applications before they are approved for use. Zuhairie said the threats go beyond attacks to include unauthorised access attempts and data theft.
Read that as an SME and the analogy is uncomfortable but exact. Your equivalent of an investigation file is a client’s confidential data, a payroll record, a signed contract or a customer list. A leak of any of them harms a third party who trusted you, not just your company, and the harm does not stop when the intrusion is contained.
Why “inside the network” is the wrong test
Datuk Dr Amirudin Abdul Wahab, a former chief executive of CyberSecurity Malaysia, told The Star that firewalls, encryption and multi-factor authentication are essential but insufficient, because sophisticated attacks now target identities, devices, applications, privileged accounts, supply chains and human behaviour. His recommendation is the zero-trust principle in one sentence.
For an SME this is not an architecture project. It is a set of decisions about who can reach what, and for how long. The practical version: an accounts clerk does not need the whole shared drive to issue an invoice, and a contractor’s laptop should not be able to reach the finance folder merely because it is joined to the office network.
| What the agency does | What it costs an SME | The version you can run this month |
|---|---|---|
| Multi-factor authentication on its systems | Nothing to low | Turn on MFA for email, cloud storage and accounting. Email is the account everything else resets through |
| Privileged access control | Low | Name the two people with admin rights. Everyone else works in a standard account. Review it quarterly |
| Real-time monitoring and a security operations centre | High | Start with alerts you will actually read: new admin login, new device, mass file download |
| Secure offline backups | Medium | One copy that is not reachable from a logged-in desktop. Ransomware encrypts connected drives |
| Network segmentation and data loss prevention | Medium | Separate the guest Wi-Fi from the finance systems, and restrict who can export the customer list |
Measures and recommendations as reported on 12 and 13 October 2026, mapped to SME-scale equivalents. Source: The Star, MACC under cyber siege and Be on high alert for cyberattacks, 12 and 13 October 2026, thestar.com.my.
An Ethernet switch and patched cables in a server rack. The recommendation from the specialists is not more perimeter, but less automatic trust in whatever is already inside it. Photo: Wikimedia Commons, CC BY-SA 3.0. Illustrative only. Source: Wikimedia Commons, commons.wikimedia.org.
The four controls an SME should copy, in order
- Multi-factor on email first. It is the account that resets everything else. If a staff member reuses a password, this is the single change that breaks the chain.
- Two administrators, named, and nobody else. Write the two names down. Time-limit any temporary elevation and record who asked for it.
- One backup nobody can reach from a desktop. Offline, or a copy in an account that no user can delete. Test a restore once; an untested backup is a belief.
- Know what leaves. A list of the five data sets you would least want to lose, and who may export each one. That is your data loss prevention policy, written in an afternoon.
- Assume the attack is automated. Fong Choong Fook, a cybersecurity consultant quoted by The Star, said many attacks are now generated by AI and that continuous attack should be expected. That argues for controls that do not depend on somebody watching.
The report of the commission’s statement, captured 19 October 2026, showing the headline and the publication date. Source: The Vibes, MACC warns data leaks could expose witnesses, derail corruption probes, 11 October 2026, thevibes.com.
What we could and could not confirm
Confirmed, from named outlets carrying the commission’s own statements: the 80,000 to 90,000 daily figure and that it comes from the Records and Information Management Division; the list of measures the division says it runs; the two specialists’ assessments and their quotations; and the commission’s position that leaked information can endanger witnesses and compromise investigations.
Not confirmed, and not guessed at: what counts as one “attack attempt” in that figure, whether the number has risen, and whether any attempt has succeeded. The reports describe detection and blocking, not incidents. We also have no evidence that any Malaysian SME has faced a comparable volume, and nothing in this article should be read as saying so. The lessons here are about principles, not scale.
Frequently asked questions
How many cyberattacks does MACC block each day?
An average of between 80,000 and 90,000 attempted attacks a day, according to Zuhairie Abu Bakar, director of the commission’s Records and Information Management Division, as reported on 11 and 12 October 2026.
What is zero trust in plain terms?
Not trusting a user, device or connection because it happens to be inside your network. Access is decided per request, on identity and need, rather than on location. For an SME the practical version is standard accounts for most staff, named administrators, and time-limited elevation.
Where should a small company start?
Multi-factor authentication on email, then naming the two people with administrator rights, then one backup that cannot be reached from a logged-in desktop. None of those requires a security team, and together they break the most common paths used in real incidents.
Is this only a government problem?
No, but the lesson is about principle rather than volume. A small company will not see 90,000 attempts a day; it will see the one that works. The controls that matter are the ones that still work when nobody is watching.
Does this mean my data has to stay in Malaysia?
That is a separate question about personal data protection and cross-border transfer, and nothing in these reports addresses it. Do not read a cybersecurity story as a data residency ruling.
Sources
- The Star, MACC under cyber siege, 12 October 2026 (the 80,000 to 90,000 daily figure; Zuhairie Abu Bakar’s quotations; the division’s measures) — thestar.com.my
- The Star, Be on high alert for cyberattacks, 13 October 2026 (Datuk Dr Amirudin Abdul Wahab’s assessment and quotations; Fong Choong Fook on AI-generated attacks; the zero-trust recommendations) — thestar.com.my
- The Vibes, MACC warns data leaks could expose witnesses, derail corruption probes, 11 October 2026 (independent confirmation of the daily figure and the leak warning) — thevibes.com
- Wikimedia Commons, CERN Server 03, CC BY-SA 3.0 (cover photograph) and Network cables and switch, CC BY-SA 3.0 (body photograph) — commons.wikimedia.org
- Own capture, 19 October 2026: The Vibes report, cropped to the headline and publication date. Read-only. Note: The Star’s page carries a persistent navigation overlay that defeated automated capture, so The Vibes is used as the evidence figure instead.
BD Media is the editorial desk of Big Domain. This article reports statements made by the Malaysian Anti-Corruption Commission and by two named cybersecurity specialists, as published by The Star and The Vibes in October 2026. It is not security advice for any specific system.
