Malaysia Cybercrime Losses Reach RM238 Million As Recorded Cases More Than Double
DOSM data shows reported cases rose 109.9% from 2024, but the figures cover defined statistical categories and should not be treated as a measure of every scam or security incident.
Malaysia recorded 1,486 cybercrime cases in 2025, more than double the previous year's figure, while associated losses rose to RM238 million, according to official statistics released on Oct. 16.
The figures appear in the Department of Statistics Malaysia's Crime Statistics, Malaysia, 2026 release. They describe offences recorded in 2025, compared with 2024; they are not a running total for 2026.
Cybercrime cases increased from 708 to 1,486, a rise of 109.9%. Losses climbed from RM33 million to RM238 million. The monetary damage therefore grew much faster than the case count, showing why incident numbers alone provide an incomplete picture of the financial impact.
Different Measures Tell Different Stories
DOSM's release uses the International Classification of Crime for Statistical Purposes. It lists cybercrime separately from fraud categories, including face-to-face fraud, which rose from 37,240 cases to 69,001. Readers should preserve those category labels when comparing the figures.
It would be misleading to describe the cybercrime line as every scam, every suspicious message or every security incident experienced in Malaysia. The publication reports defined categories from administrative sources. Nor does a recorded case automatically represent one victim or one compromised device.
The broader release shows a mixed pattern rather than a uniform rise across offences. Domestic violence and robbery cases declined, while homicide, sexual assault and theft of personal property increased. A fall in one category does not cancel an increase in another, and an overall judgement requires attention to the type and severity of harm.
Financial Harm Beyond A Case Count
BusinessToday, reporting on the release, highlighted the RM205 million increase in cybercrime losses. It also drew attention to the increase in face-to-face fraud, a reminder that financially motivated crime is not confined to attacks on computer systems.
The two categories should not be combined into a new total without checking the underlying definitions and coverage. Fraud can describe deception directed at people, while a technical incident can involve unauthorised access or interference with systems. Similar words in everyday conversation can conceal different statistical measures.
For businesses, a loss figure also raises a different question from the number of alerts generated by security software. Financial impact, service disruption and the exposure of information are distinct outcomes. Counting one does not measure all of them.
Testing Is One Part Of Prevention
The US National Institute of Standards and Technology's guide to technical security testing sets out a process that includes planning assessments, examining systems, analysing findings and developing measures to address weaknesses. It distinguishes testing techniques and their limitations rather than treating a single scan as a complete security programme.
That framework helps explain why the response to cybercrime cannot be reduced to installing a tool. Finding a weakness, assigning responsibility for fixing it and checking the result are separate tasks. Measures addressing systems also need to sit alongside controls for transactions and the people authorised to approve them.
The latest Malaysian release establishes a sharper record of reported harm in 2025. Its strongest conclusion is specific: recorded cybercrime cases and their associated losses both increased, with losses rising particularly quickly. It does not, by itself, identify the cause of that increase or prove how much crime went unreported.