My social media or email account was hacked. What can I do legally?

You cannot log in. Your password has been changed, your recovery email replaced, and friends are messaging to ask why you are asking them for money. Or offensive posts have appeared on your account. A hacked account is not only a technical problem. It is also a crime, and it can expose you to claims if nothing is done.

The offences

The Computer Crimes Act 1997 creates these offences:

• Unauthorised access (s.3): causing a computer to perform a function with intent to secure access to a program or data, knowing the access is unauthorised. Penalty: a fine of up to RM50,000, imprisonment of up to five years, or both (s.3(3)).
• Unauthorised access with intent to commit a further offence (s.4): where the access is to commit or facilitate an offence involving fraud or dishonesty or which causes injury. Penalty: a fine of up to RM150,000, imprisonment of up to ten years, or both (s.4(3)).
• Unauthorised modification (s.5): doing an act known to cause unauthorised modification of the contents of a computer, such as changing passwords, deleting data or posting content. Penalty: a fine of up to RM100,000, imprisonment of up to seven years, or both, with higher penalties where the act is done with intent to cause injury (s.5(4)).

Parliament has been considering new cybercrime legislation intended to replace the 1997 Act. Until any new law comes into force, the Computer Crimes Act 1997 continues to apply, so check the current position when you act.

Have a question about your own situation? Ask on WhatsApp

What should I do first?

1. Try to recover the account using the platform's official recovery process. Change passwords on all linked accounts and enable two-factor authentication.
2. Warn your contacts through another channel not to send money or click links.
3. Preserve evidence: screenshots of messages, posts, login alerts, emails about password or recovery changes, with dates and times.
4. Make a police report, attaching the evidence.
5. If money was taken or sent, call the NSRC on 997 and the bank immediately.

Posts or messages sent in your name

If the hacker posted defamatory or offensive material in your name, report it to the platform, ask for removal and, once you have access again, delete it and post a short notice that your account was compromised. Keep a record of when you regained control. This helps if anyone later blames you for the content.

Civil steps

• Identifying the person: where the hacker is unknown, a court may order a platform or service provider to disclose information that identifies him.
• Claim for loss: you may sue the person for loss caused, such as money taken or business lost.
• Defamation: if posts damaged your reputation, the person who published them may be liable in defamation.
• Personal data: the Personal Data Protection Act 2010 regulates how organisations handle personal data. If an organisation's failure led to the breach, you may complain to the Personal Data Protection Commissioner.

Example

A business owner's email is hacked and the hacker sends invoices with new bank details to customers. One customer pays. The owner warns all customers, reports to the police and NSRC, and later sues the person who received the money once he is identified.

Common mistakes

• Paying a ransom to get the account back.
• Not warning contacts quickly.
• Not keeping the login alerts and recovery emails.
• Using a third-party "account recovery" service that asks for passwords.

When to speak to a lawyer

Speak to a lawyer if the hack has caused financial loss, damaging posts in your name, or if you need to identify the person responsible. See our civil litigation page; you can also contact us.

Frequently asked questions

I know who hacked my account. Should I confront him?

Report to the police and keep the evidence. Do not access his accounts in return, as that can also be an offence.

Can I be blamed for scam messages sent from my account?

If you act promptly and can show your account was compromised, it is easier to show you were not responsible. Keep a record of the steps you took.

Is accessing my partner's phone without permission an offence?

Accessing a computer or data without authority can be an offence under the Computer Crimes Act 1997, even within a relationship.

Sources & fact check

Legal points in this article were checked against the primary sources below. The law can change; this is general information, not legal advice.

1. Computer Crimes Act 1997 (Act 563), AGC Laws of Malaysia
2. Royal Malaysia Police (PDRM): how to make a police report, including road accident reports under section 52 of the Road Transport Act 1987
3. Government of Malaysia portal, NSRC 997 Hotline (National Scam Response Centre)
4. Department of Personal Data Protection: Personal Data Protection Act 2010 (Act 709) and Amendment Act 2024 (Act A1727)

Fact-checked on 18 Oct 2026