Is Hacking a Crime in Malaysia? What Victims Can Do

Someone got into your Instagram, your Gmail or your business Facebook Page. They changed the password, messaged your friends, maybe took money. Once the shock passes, the next thought is usually: this has to be illegal, so can I report them, and can I make them pay?

The short answer is yes, hacking is a crime in Malaysia, and the police investigate it. Suing the person is possible in principle, but it is a separate and harder route. For most people the useful moves are a police report, the bank and 997 if money moved, and careful evidence.

This guide explains what the Computer Crimes Act 1997 says, how a criminal report differs from a civil claim, what to save today, and where the law is heading. It is general information for victims, not legal advice. For advice on your own case, speak to a lawyer.

Last checked: 29 September 2026.

#Is Hacking Illegal in Malaysia?

Yes. Section 3 of the Computer Crimes Act 1997 (Act 563) makes it an offence to make a computer perform any function to get into a program or data you know you are not authorised to access. Section 4 covers doing that with intent to commit fraud, dishonesty or injury. MCMC's FAQ on hacked accounts says hacking falls under the Royal Malaysia Police (PDRM) and that you can lodge a report at any police station. If money was lost, call 997 and your bank before anything else.

#What Do Sections 3 and 4 of the Computer Crimes Act Say?

The Act is short. The version we read is the Attorney General's Chambers' online reprint, as at 1 December 2011, which lists no amended sections. These are the parts a hacking victim is most likely to hear about.

Section 7 matters too. It treats abetting or attempting an offence under the Act as the offence itself. Keep that in mind if anyone offers, for money, to break back into your account.

#Police Report or Civil Claim: Which Route Fits?

These are two different systems. A criminal case is the state acting against the offender. A civil claim is you acting against the person who caused you loss, usually for compensation. You can do the first without the second, and most victims do.

The hard part of a civil claim is usually the first step: knowing who to claim against. Attackers hide behind fake names and overseas numbers. MyCERT's social media incidents FAQ says it cannot obtain an account holder's details from platforms such as Facebook, Instagram and TikTok. It explains that a court order or subpoena has to be sent to the platform, which then decides what to disclose.

If you cannot afford a lawyer, the Legal Aid Department (Jabatan Bantuan Guaman) provides legal aid in a list of civil matters set out in the Legal Aid Act 1971, subject to a means test. Ask them whether your situation is one of them.

#Where Should You Report a Hack in Malaysia?

Each channel does a different job. Do them in this order:

1. If money has left your account, or friends paid the attacker, call your bank and the National Scam Response Centre on 997. The government's NSRC 997 page says to call within 24 hours of discovering the scam so accounts and transactions can be blocked.
2. Report the hack to the platform through its official hacked account flow. This is the only route that can give the account back.
3. Lodge a police report at the nearest police station, as MCMC's FAQ advises. Keep the report number.
4. Report the incident to CyberSecurity Malaysia's Cyber999, the national point of contact for computer security incidents. It can analyse what happened and help escalate abuse reports.

Our guide on where to report a hacked account in Malaysia walks through each channel, what it needs from you and what it cannot do.

#What Evidence Should You Save Now?

Evidence disappears fast. Attackers delete messages, platforms rotate login history, and your memory of the timeline fades. Collect this before you change much, but do not delay securing your email or calling your bank.

• Screenshots of the account as it looks now, with the date and time visible, including the profile URL.
• Every security email from the platform, such as notices that your password or email address was changed. Keep them in the inbox; do not delete them.
• The platform's login activity page, if you can still reach it, showing locations and devices.
• Messages the attacker sent from your account. Ask friends who received them to screenshot their side too.
• Anything that identifies the attacker: usernames, phone numbers, links, bank account numbers they gave your contacts.
• Bank statements and transaction references for any money that moved.
• A short written timeline: when you noticed, what changed, who you contacted, and each report or case number.

Cyber999 asks for similar material in an email report: the source and destination of the attack, email headers, log files and the time of the attack. Collecting it once serves the police, Cyber999, the platform and, if it comes to it, a lawyer. The same records help when you have to prove the account is yours.

#Mistakes That Can Hurt Your Case

Anger is normal. These moves feel like action but tend to backfire:

• Paying a "hacker for hire" or "recovery expert" to break back in. It is a common scam, and section 7 of the Act treats abetting an offence as the offence.
• Sharing your password, OTP, backup codes or login links with anyone who says they can help. No police officer, bank, platform or honest service needs them.
• Posting the name and photo of the person you suspect and calling them a hacker. MCMC's own table of online offences lists defamation as a matter for the police and for civil action.
• Deleting the account or wiping your phone before saving evidence.
• Waiting to report money losses while you try to recover the account. The 997 window is about stopping money, and it is short.

Fake helpers often pose as platform staff or "cyber police". Our guide to fake Meta support scams shows the common scripts.

#Is the Computer Crimes Act 1997 Being Replaced?

Yes, in time. The Dewan Rakyat passed the Cybercrimes Bill 2026 on 1 July 2026, and RTM reported that it will repeal Act 563, with PDRM remaining the main investigating agency. Bernama reported that the Dewan Negara passed it without amendment on 20 July 2026.

A passed Bill is not yet law in force. At the time of writing we could not confirm from an official source that the new Act has come into operation, so this article describes the 1997 Act. Check the current position on the Attorney General's Chambers' Laws of Malaysia portal or ask your investigating officer. Either way, the practical steps above do not change: report, save evidence and protect your money first.

#What the Law Cannot Do for You

That is why the platform's own recovery flow runs alongside everything else. If you are still working out what happened, start with our first steps after a hack, written for Malaysian readers.

#When Expert Recovery Help Makes Sense

Most people can follow the steps here alone. Outside help earns its place when the account runs a business, when the official recovery flow keeps rejecting you, or when you need your evidence organised for the platform, the police and a lawyer at once. SocialSafe by AwareXone, our recovery service, looks at the case before anything is agreed and works only through the platform's official processes. We do not give legal advice and we never ask for your password or codes. See how our account security service works, and what we refuse to do, on our Trust Center.

#Frequently Asked Questions