So it's actually the most people panic-ed for seeing captcha at login screens and then speculate that the website got hacked? And by the way, those who claimed that their account got hacked did not claim it with sufficient evidences but merely just a message saying their account's balance deducted.

The point is, how do we know whether that person who got "hacked" actually did made an online transaction to subscribe Daily Awesome Midget Porn in one of the pornsite and credentials was compromised there? We'll never know.

I booked the hotel online, then the receptionist says need too record down. It is a reputable 4 star hotel with many branches in Malaysia.

Maybe during check out, I will ask for that paper she jotted down.

won't that risk bank run if everyone transfer away?

dah fix ke
this prob

Its normal actually. No way any bank gonna say "yea we fucked up". 😒. The only way thry will acknowledge their mistake is thru court.

This was a good piece of investigative journalism

https://www.lowyat.net/2018/175102/what-cim...you-but-should/

but what's the point anyway?

CIMB can just lie to its customers and nobody will care

Malaysians don't care if their Govt or company or whatever lies to them and takes advantage of them

Malaysians never take action to boycott them or demand justice

Malaysians only care when it's an issue involving the wrong race or religion

I am a bit confused, even if the password is compromised, the hacker would still need TAC right to make online transactions? So basically those that do not use credit/debit cards are safe?

The current updated FAQ from CIMB suggests that special characters were allowed in the past, just not mandatory.
The JS implementation also allows for special characters to be submitted if it was less than 8 characters.

The first article was taking the assumptions of how the old system used to work.
The second article reflects a more accurate situation due to the currently given evidence.

So far we cannot find good evidence that special characters were not allowed during the 8 character era. Everything else points to it being allowed back then.
Regarding the 8 characters thing you mentioned earlier, in the past, the characters were fixed to 8 characters maximum and minimum.
There was never > 8 characters in the past because it does not exist due to the old password policy being fixed at 8 characters.
The JS logic representing the old policy is the one that is saying "less than 8" as a criterion.



All that said, the conclusion is that security was never compromised or hacked due to the new mechanisms for CIMB Clicks as some articles are suggesting in their clickbait headlines

so all back to normal? no fuss no nothing... what happen..hehe