Freezers set to 50°C, tax portals offline: what the global cyberattacks mean for Malaysia

In the past few weeks, attackers have switched off a country's tax portal, exposed a national population register and turned supermarket freezers into ovens. On 3 November the Prime Minister told Parliament that Malaysia could be a target too. The next day, NACSA raised the national cyber threat level from Low to Medium. The message is the one the Prime Minister gave: don't panic, but get ready.

What has happened overseas

• Supermarket refrigeration. Grocery chains in Belgium, Luxembourg, Sweden, Ireland and Estonia reported that attackers had changed fridge and freezer settings to 50°C, forcing some stores to throw away food. It followed an attack on more than 700 supermarkets in France the month before.
• Belgium's tax services. A cyberattack on the Federal Public Service Finance took the MyMinfin tax portal and other online services offline, and the filing deadline had to be moved.
• Denmark's population register. A breach of the central CPR register exposed personal data on about 8.8 million people.
• Japan's police. Data on about 125,000 police officers was reported as potentially exposed.
• Households told to prepare. At least 33 countries, including Japan, Canada, Germany, Sweden and the United Kingdom, now advise households to keep three to ten days of essential supplies, citing conflict, extreme weather and disruption to critical services.

Commentators have described the wave as the work of organised, state-backed groups rather than lone hackers. Whoever is behind it, the targets are telling: everyday systems that nobody thinks of as "IT", and public services that whole populations depend on.

What Malaysia has announced

Speaking in the Dewan Rakyat on 3 November, Prime Minister Datuk Seri Anwar Ibrahim said Malaysia could be targeted because of its growing digital infrastructure and data centres, and its stance on international issues including Palestine. He asked Malaysians to stay alert, to report any digital intrusion or disruption immediately, and not to panic: "Panic would weaken our strength."

On 4 November the National Security Council announced that NACSA had raised the National Cyber Security Threat Level from Low to Medium as a precaution. National Critical Information Infrastructure (NCII) entities must now put nine preparedness measures in place, including 24-hour monitoring, patching, multi-factor authentication and updated service continuity plans, and NCII sector leads report weekly to NACSA.

The measures are mandatory for NCII entities, but every organisation should treat them as this month's to-do list. Attackers do not check whether you are on the NCII list before they scan you.

Six things to do this week

1. Find what is exposed to the internet. The freezer attacks worked because refrigeration controllers could be reached online. List every remote-access, building-management, CCTV, HVAC and OT interface you have, take them off the public internet or put them behind a VPN, and change default passwords.
2. Turn on MFA everywhere it matters. Email, VPN, remote desktop, cloud consoles and every administrator account.
3. Patch the front door first. Firewalls, VPN gateways, mail servers and anything else facing the internet, then the rest.
4. Watch around the clock. Several of the supermarket attacks happened overnight. If nobody sees an alert until Monday morning, the damage is already done. Make sure someone, in-house or a managed SOC, is watching 24/7.
5. Check for leaked passwords. Search breach and dark-web sources for your domains and reset any credentials you find. Leaked logins remain one of the easiest ways in.
6. Rehearse the bad day. Test that backups can be restored, update your continuity plan, and agree who decides, who calls whom and how you report to NACSA. NCII entities have incident notification duties under the Cyber Security Act 2024.

How we can help

AI MSP 365 is licensed by NACSA to provide managed SOC monitoring and penetration testing services. We can help you act on the list above quickly:

• A free Exposure Snapshot from DigitalXposure shows what attackers can already see: exposed services, weak points on your perimeter and leaked credentials.
• Managed Fusion XDR gives you 24/7 monitoring and response from our analysts in Malaysia, across endpoints, servers, network and IoT/OT.
• Penetration testing and compromise assessment confirm whether your defences hold, and whether someone is already inside.

Watch the TV news report on these attacks and the Prime Minister's message: YouTube.

Sources

• The Star: Keep calm and stay alert, says Anwar (4 Nov 2026)
• The Star: Nacsa raises level of cyber security threat to medium (4 Nov 2026)
• AP: Freezers at supermarkets in several European countries hit by apparent cyberattacks (2 Nov 2026)
• Euronews: Belgium's finance and tax agency hit by cyberattack (28 Oct 2026)
• Help Net Security: Data breach at Denmark's population register exposes 8.8 million people (6 Oct 2026)
• Nippon.com / Jiji: Data on 125,000 police officers in Japan potentially exposed (21 Oct 2026)
• The Vibes: Thirty-three countries urge households to stockpile essential supplies