KUALA LUMPUR – Several brokers recently reported cybersecurity incidents within their system components, Bursa Malaysia Bhd said today.
In a statement today, the exchange said the issues were contained and had no impact on its platforms or infrastructure after brokers immediately isolated the compromised components and activated their internal incident response controls.
“The reported incidents were limited to the systems of affected brokers, with no impact on the exchange’s networks, platforms, or infrastructure, and trading and market operations continued to function as usual,” Bursa Malaysia said.
Upon receiving the reports, the exchange activated established cybersecurity response protocols and coordinated closely with the affected brokers to ensure rapid containment and remediation. “The brokers are conducting full forensic investigations and will be submitting their reports through Bursa Malaysia’s supervisory channels. There has been no evidence of unauthorised trading activity or financial loss,” it added.
As a precaution, Bursa Malaysia has directed all brokers and selected vendors to carry out a comprehensive screening of their systems. “As part of industry-wide measures established last year to strengthen cyber resilience and protect the market ecosystem, Bursa Malaysia applies additional risk controls across all brokers to mitigate potential systemic risks,” the statement said.
The measures include enforcing multi-factor authentication across all key interfaces, implementing isolation protocols, enhancing monitoring for early detection and prevention of anomalous activity, and strengthening incident response and escalation processes.
“The exchange is also undertaking a comprehensive review of its IT Security Standards for brokers, with the objective of enhancing overall cybersecurity resilience across the industry. This review includes measures to strengthen brokers’ oversight of their information service vendors and ensure that critical systems are safeguarded against emerging threats,” Bursa Malaysia said.
The enhanced cybersecurity framework is expected to take effect in the fourth quarter of 2026.– March 12, 2026