Short answer

Lembaga Tabung Haji (TH) halted its systems and services across all channels on 8 October 2026 after a cyberattack. TH says depositors' savings are safe, has lodged a police report and notified NACSA and the Personal Data Protection Department. Most services were back by 12 October, and TH has not said whether personal data was taken.

If you think your details were included, start with our checklist on what to do after a data breach.

Key facts

Key facts about the Lembaga Tabung Haji incident
OrganizationLembaga Tabung Haji
Incident typeData breach
StatusConfirmed by the organization
SectorSavings and pilgrimage fund
CountryMalaysia
Detected2026-10-08
Disclosed2026-10-08
People or records affectedNot stated. Tabung Haji has not said whether any depositor data was taken.

What data was exposed

  • No data theft confirmed. Tabung Haji said it shut systems to protect savings and personal information.

What happened

Lembaga Tabung Haji, the Malaysian fund that holds savings for the Hajj pilgrimage, was hit by a cyberattack on Thursday 8 October 2026. The organisation shut down its systems and services across all channels to protect depositors’ savings and personal information, according to Kosmo. TH called the attack “a criminal act against TH and the country”.

Timeline

  • 8 October: attack on key systems and services. TH halts all channels.
  • 11 October: branches in Kedah, Terengganu and Kelantan reopen.
  • 12 October: branches in other states reopen. Services through TH’s partner banks are active again, per RTM.

What TH has said about your money and data

TH says depositors’ savings are safe. It lodged a police report and told NACSA and the Personal Data Protection Department. According to CNBC Indonesia, its internal team is working with external experts and national cybersecurity authorities. Kosmo and RTM report that depositors who notice unusual transactions or account activity should tell TH immediately.

TH has not said what kind of attack it was, whether data was copied, or how many depositors are involved. We have not found a claim of responsibility by any group. That matters: with no confirmed data theft, the main short-term danger is scammers using the news, not leaked records.

Scam risk while systems recover

Outages create openings. Many Malaysians could not reset THiJARI passwords for days, and a message offering a “reset link” would have looked reasonable. Our guides on phishing messages and urgent payment scams show how these messages are built. A caller who says your account is under investigation and asks you to move funds is running a classic government impersonation script. For general steps, see what to do after a data breach.

What is still unknown

The attack method, whether any personal data left TH’s systems, and the exact state of the three THiJARI functions that were still unavailable on 12 October. We will update this page when TH or NACSA publishes more. Browse other cases on our breaches page.

Scams to watch for after this breach

Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.

  • Fake calls, SMS or WhatsApp messages pretending to be Tabung Haji and asking you to 'verify' your account, reset your THiJARI password or confirm your Hajj registration.
  • Phishing links to fake THiJARI login pages, timed to the period when real password resets were unavailable.
  • Fake 'compensation' or 'savings protection' offers that ask for your TAC code or bank login.
  • Mule account scams, where a caller says your account was used in crime and tells you to transfer money to a 'safe account'.

What to do if you are affected

  1. 01Check your TH account and any linked bank account for transactions you do not recognise. Report anything unusual to the TH Contact Centre on 03-6207 1919.
  2. 02Do not share your TAC, password or PIN with anyone claiming to be from TH. TH will not ask for them. Hang up and call 03-6207 1919 yourself.
  3. 03Reach THiJARI only by typing the address or using the official app. Do not click links in SMS or WhatsApp messages about your account.
  4. 04If you were tricked into paying or sharing banking details, call the National Scam Response Centre on 997 as fast as you can and contact your bank. Check phone numbers and bank accounts on the police Semak Mule portal before paying.
  5. 05Report data privacy concerns to the Personal Data Protection Department (JPDP), and cybercrime to the Royal Malaysia Police.

Frequently asked questions

Is my Tabung Haji money safe?

Tabung Haji says depositors' savings are safe. It has not reported any loss of funds. If you see a transaction you do not recognise, report it to the TH Contact Centre on 03-6207 1919.

Was my personal data stolen in the Tabung Haji attack?

Unknown. The reports we reviewed do not say that data was taken. TH said it shut systems to protect personal information and has notified JPDP, the regulator for personal data.

Is THiJARI working again?

As of 12 October, TH said most THiJARI functions were back, but password reset, new user registration and online account opening still needed more recovery work. We could not find a later update.

Who did TH report the attack to?

TH lodged a police report and notified the National Cyber Security Agency (NACSA) and the Personal Data Protection Department (JPDP).

How do I avoid Tabung Haji scam messages?

Do not tap links in messages about your account. Never give a TAC or password. If a caller pressures you to move money, call 997, the National Scam Response Centre.

Sources

  1. Tabung Haji diserang siber, sistem kembali pulih (Tabung Haji hit by cyberattack, systems recovered), Kosmo Online, 2026-10-12
  2. Tabung Haji pulih sistem utama selepas serangan siber (Tabung Haji restores main systems after cyberattack), RTM Berita, 2026-10-12
  3. Tabungan Haji Jadi Sasaran Hacker, Bagaimana Dana Nasabah? (Haj savings targeted by hackers, what about depositors' funds?), CNBC Indonesia, 2026-10-12

This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.