Janata, Bengal Commercial Bank Websites Offline Amid Cyberattack Fears

⚠ The websites of Janata Bank and Bengal Commercial Bank have been shut down amid fears of cyberattacks, leaving customers unable to obtain information or use other services through the banks' online platforms. When the two websites were accessed at around 12:30pm on Sunday, notices stated that maintenance work was under way and that the sites would be back online soon, with apologies for the inconvenience — but repeated attempts to access them later remained unsuccessful. Attempts to reach Janata Bank's acting managing director, Fayaz Alam, for comment were also unsuccessful.

🗓 The development sits at the tail of a week in which concerns about possible cyberattacks on banks and other financial institutions grew steadily. Bangladesh Bank's official website was taken offline last Thursday as a precaution and was restored at 8:00am on Sunday after three days, with the central bank's spokesperson, Arif Hossain Khan, confirming the site had been checked for possible vulnerabilities before reopening. The websites of Agrani Bank, IFIC Bank, Standard Islami Bank and SBAC Bank had also been taken offline during the period but are now operational again. Throughout, internet banking and mobile banking transactions continued as normal, causing no disruption to customers' payments.

🌐 The trigger remains the same global event: a large proportion of the world's websites — including those running government services, banking platforms, e-commerce and news outlets in Bangladesh — rely on the PHP programming language, and the recent discovery of two serious security vulnerabilities in PHP has raised cybersecurity concerns worldwide, prompting emergency shutdowns from Europe to Asia as organisations rushed to patch before attackers could exploit the flaws.

🏦 The sector's quiet triage

🔍 Read together, the week's closures and reopenings sketch the banking sector's first mass triage exercise of this kind. At least six institutions — the central bank, two state-owned commercial banks (Janata and Agrani), IFIC, Standard Islami, SBAC and Bengal Commercial Bank — took their public websites offline during the same window, while transaction systems across the industry kept running. That pattern tells banks' IT departments the correct lesson: portals were judged expendable for days, payment rails were not, and the sector could tell the difference under pressure.

📢 The communication strategy, however, exposed a gap. Notices blaming maintenance work — while patching was under way behind the scenes — left customers to infer the real cause from news reports, and the silence from bank leadership contrasted with the central bank's comparatively clear public messaging. For a banking sector rebuilding public trust after years of governance troubles, cyber incidents handled with visible candour are an opportunity rather than a liability: customers forgive maintenance, but they remember being kept in the dark about threats to their money.

🛡 The episode also underlines how heterogeneous the sector's web estate is. Some banks restored their sites within a day; others are still dark days after the global alert peaked — a spread that reflects differing content-management stacks, hosting arrangements and in-house patching capability. Every bank that was slow to restore now has a business case for the unglamorous investments that made its faster peers faster: version inventories, staging environments, vendor support contracts and rehearsed recovery procedures.

🔭 The expectation among security professionals is that sites like Janata's and Bengal Commercial's will return once their own checks complete — the same sequence the central bank followed. The more important question is what the sector institutionalises after the scare: routine vulnerability scanning of public-facing systems, coordinated disclosure through the central bank and BGD e-GOV CIRT, and customer communication templates that say what is actually happening. The PHP flaw will be patched and forgotten within weeks; the habits this week forced into existence are worth keeping for years.

💰 The regulatory aftermath is worth anticipating. Bangladesh Bank has spent years pushing banks toward core-banking modernisation, data-centre standards and IT governance; a week in which six banks simultaneously chose to turn their public faces off rather than risk exposure gives supervisors both evidence and urgency. Expect quiet follow-up: IT audit requirements tightened, reporting timelines for security incidents shortened, and pressure on the laggard institutions whose restoration pace revealed thin technical staffing. Regulation after incidents tends to be retrospective, but the industry would be wise to pre-empt it by documenting this week's lessons voluntarily.

📋 Customers, meanwhile, experienced the episode as a reminder of practical hygiene. Bank websites are the gateway to phishing: the more familiar users become with sites being legitimately down, the easier it is for criminals to send official-looking restoration emails that harvest credentials. Security researchers have long observed that fake maintenance notices and spoofed login pages flourish in exactly these windows. Banks that were quick to restore were also, in effect, quick to close that phishing window — one more reason the restoration clock, not just the patch clock, is a security metric worth publishing.