Recent years have witnessed the surge of interest of security issues in cyber-physical systems. In this paper, we consider malicious cyber attacks in a remote state estimation scenario using time division multiple access communication protocol. A gateway collects the local measurement innovation of each sensor every time instant, while only transmits data packets to a remote estimator during specific time slots. It is assumed that a residue-based detection algorithm is used at the remote side to detect data anomalies. We propose a novel packet-reordering attack strategy where the attacker is able to change the order of the transmitted data packets, without being detected, by compromising the gateway. Furthermore, the evolution of the remote estimation error covariance is derived and the degradation of system performance under the proposed attack is analyzed. Finally, we obtain a sufficient condition for the attack policy to be optimal using the terminal estimation error covariance as a performance metric. Simulations are provided to illustrate the theoretical results.