CTOS Estimates RM12 Million Profit Hit as Cyber Breach Keeps Credit Services Offline

October restoration assumption puts RM16 million in revenue at risk

CTOS Digital Bhd expects the cybersecurity incident disclosed on September 23, 2026, to reduce its annual profit after tax and minority interests by RM12 million and revenue by RM16 million. The estimates, announced in an October 13 stock exchange filing, assume affected credit reporting services remain unavailable until the third week of October.

The Malaysian credit reporting company said CTOS Score and reports related to the Central Credit Reference Information System (CCRIS) were still temporarily unavailable. Every additional week of disruption beyond the assumed period could reduce profit by another RM1.3 million and revenue by RM2.5 million.

The update changes the financial picture presented when CTOS first disclosed the incident. Its initial assessment did not anticipate a material financial impact based on the information then available. The company now expects disruption and recovery costs to affect both the third and fourth quarters of the financial year ending December 31, 2026.

Other CTOS services continue operating. Restoration of the affected services depends on satisfactory completion of remediation and independent validation, rather than the calendar alone. October is the target for completing independent reviews, not an unconditional promise that services will resume on a particular date.

How the financial impact is divided

CTOS estimates a RM5 million reduction in profit after tax and minority interests for the third quarter ended September 30, alongside a RM3 million revenue reduction. For the fourth quarter, the estimated reductions are RM7 million in profit and RM13 million in revenue.

Profit after tax and minority interests, often shortened to PATAMI, measures the earnings attributable to the company's shareholders after tax and the share belonging to other owners of subsidiaries. It is distinct from revenue, which measures income generated before expenses are deducted.

The fourth quarter accounts for 81.25% of the expected revenue impact, calculated from RM13 million out of RM16 million, and about 58.3% of the profit impact, based on RM7 million out of RM12 million. The third quarter profit impact exceeds its revenue impact, showing that the estimates cannot be read simply as lost sales.

CTOS said its calculations include the expected duration of service interruption and costs associated with remediation and restoration. It has not disclosed a separate breakdown of those costs. The RM12 million estimate is a reduction in expected earnings, not a forecast that the company will report an annual loss.

What another week of disruption would mean

The weekly estimates give investors a measure of how sensitive the financial outcome is to restoration timing. A further week of disruption would take the estimated annual revenue impact from RM16 million to RM18.5 million and the profit impact from RM12 million to RM13.3 million, assuming all other elements remain unchanged.

Two additional weeks would bring those figures to RM21 million in revenue and RM14.6 million in profit. These are calculations using CTOS's stated weekly amounts, not additional company forecasts. The underlying estimates may change as the investigation and recovery work progress.

CTOS, the credit reporting company responsible for the affected services, explained the basis and uncertainty of its estimates in its stock exchange statement:

These estimates are preliminary and takes into account the expected duration of the service interruption, together with the costs associated with remediation and restoration efforts. The estimates remain subject to review as further information becomes available,

The statement leaves two distinct uncertainties: how long the affected services will remain unavailable and whether further information will change the estimated costs. Completing the reviews in October would address a recovery milestone, but would not by itself establish the final financial impact.

What CTOS disclosed about the data access

CTOS said its cybersecurity monitoring systems detected unauthorised access to a specific environment supporting its consumer business. Certain files containing a limited subset of consumer information were accessed. The company activated its response protocols and said it contained the affected environment.

An independent incident response team was engaged to conduct a forensic investigation. CTOS also said it notified the relevant authorities. Its September assessment was that the incident was confined to the identified environment and that other environments were not affected.

The company has not specified what personal information was involved or how many consumers were affected. That limits the ability to assess the consequences for individuals. Access to data files has been disclosed, but the announcements described here do not establish whether that information was copied, published or misused.

The distinction between containment and restoration matters. Containing unauthorised access addresses the immediate security incident; returning services to operation requires completing remedial work and checking its effectiveness. CTOS's later financial update shows that an incident described as contained can still produce an extended service interruption.

Independent checks govern the return of services

CTOS said it has implemented remediation and security measures, with independent reviews under way to validate their effectiveness. Those reviews are targeted for completion in October 2026. The company continues to work with relevant authorities and independent specialists.

In its statement, CTOS described the conditions governing restoration:

The company is working towards resuming the impacted services as soon as possible, subject to the satisfactory completion of remediation and independent validation,

The company has not announced an exact restoration date. The third week of October is the assumption used for its financial estimates, while satisfactory remediation and independent validation are the conditions for restarting affected services. Those two points should not be treated as interchangeable.

CTOS Score and CCRIS related reports are the services specifically identified as unavailable. CCRIS stands for Central Credit Reference Information System. The disclosure concerns CTOS reports connected with that system; it does not establish that CCRIS itself suffered a breach or stopped operating.

From September disclosure to October cost estimate

The announcements span the end of one reporting quarter and the beginning of another. The September 23 disclosure came a week before the third quarter ended, while the October 13 update quantified an expected impact extending into the fourth quarter.

• September 23, 2026: CTOS disclosed unauthorised access to an environment supporting its consumer business, said limited consumer information had been accessed and announced an independent forensic investigation.
• September 30, 2026: The third quarter ended. CTOS subsequently estimated a RM3 million revenue impact and RM5 million profit impact for that quarter.
• October 13, 2026: CTOS announced estimated annual reductions of RM16 million in revenue and RM12 million in profit.
• Third week of October 2026: The assumed endpoint for service unavailability used in the financial estimates.
• October 2026: Target completion period for independent reviews validating remediation and security measures.
• December 31, 2026: End of the financial year covered by the estimates.

The revised assessment does not establish that the initial statement was knowingly inaccurate. It does show that the company's understanding of the financial consequences changed as the interruption continued and recovery requirements became clearer.

Earlier earnings provide scale, with a discrepancy

The estimated profit reduction is equivalent to about 11.5% of the RM104.4 million FY2025 net profit cited in reporting on the October update. The RM16 million revenue impact equals about 4.9% of FY2025 revenue of RM326.06 million.

Reports differ on the previous year's profit figure. The January 29, 2026, account of CTOS's annual results put FY2025 net profit at RM104.85 million, rather than RM104.4 million. Using RM104.85 million would make the estimated RM12 million impact about 11.4%. No explanation for the difference is given, so the figures should not be silently treated as identical.

Additional results reporting puts FY2025 net profit at RM104.86 million, while another January 29 account gives RM104.6 million. Neither explains the difference between RM104.4 million and RM104.85 million. The January 29 FY2025 results document is not included in the available material, so these reported figures do not resolve the discrepancy.

The January results account said annual profit fell from RM106.27 million because of increased operating expenses, while revenue rose from RM304.85 million to RM326.06 million. Fourth quarter profit increased from RM32.39 million to RM44.56 million, and revenue rose from RM76.81 million to RM87.98 million.

Additional reporting attributes the annual profit decline to a 7.3% fall in Malaysia operations profit to RM96.99 million, mainly because of higher operating expenses, with higher tax expenses also weighing on group profit. International segment profit rose 48.1% to RM6.87 million; that segment comprises alternative-data credit-score businesses in Indonesia and the Philippines. Annual earnings per share remained at 4.6 sen.

The additional accounts put fourth quarter net profit at RM44.57 million and revenue at RM87.98 million. The quarter included a RM17.9 million gain on disposal of an associate investment: CTOS sold its entire 26% stake in Experian Information Services (Malaysia) for RM80 million, and the business ceased to be an associate on December 18, 2025. That one-off gain provides further context for the final quarter's profit increase, but the available reports do not establish why the annual net profit figures differ.

Before the September incident, CTOS reported first half FY2026 profit growth of 15.63%, to RM41.16 million from RM35.6 million. Revenue increased 8.63%, to RM168.46 million from RM155.07 million, supported by domestic and international operations. The estimated RM12 million annual profit impact is more than twice the RM5.56 million profit increase recorded in that first half, although that comparison is not a forecast of annual earnings.

Shares hit a record low despite positive ratings

CTOS shares fell to an intraday low of 45.5 sen on October 13 before closing at a record low of 47.5 sen. The closing decline was half a sen, or 1.04%, leaving the company valued at about RM1.05 billion.

More than RM300 million in market capitalisation had been erased over the preceding three weeks, and the stock was down 40.08% since the start of the year. That market value decline is separate from the estimated earnings impact: it reflects the changing value investors place on the business, not an equivalent cash expense for CTOS.

Analyst recommendations remained broadly positive, with seven buy ratings and two hold calls. The consensus target price for the next 12 months was 89 sen, about 87.4% above the 47.5 sen closing price. A target price is an estimate, not a guaranteed outcome, and no timing is given for when those recommendations were last revised.

Creador, through Jade Vine Sdn Bhd, was the largest shareholder with 20.87%, followed closely by the Employees Provident Fund at 20.68%. Aberdeen Group plc held 14.89%, and Kumpulan Wang Persaraan (Diperbadankan), known as KWAP, held 9.04%. Together, those disclosed stakes total 65.48%.

Growth plans now face a recovery test

At its January results announcement, CTOS expressed cautious optimism about growth in 2026. It outlined plans for partnerships and selective acquisitions across Malaysia and ASEAN, investment in artificial intelligence and advanced analytics, and improvements to technology infrastructure and security.

The incident creates a more immediate operational priority: restoring unavailable consumer services after independent checks. The financial estimates put a measurable cost on delays, while the undisclosed categories and number of affected consumer records leave the data consequences unresolved.

The next stated milestone is completion of the independent reviews in October. CTOS has committed to announcing material developments, but has not provided a final restoration date, a complete recovery cost breakdown or a final assessment of the financial impact.

Key Points

• CTOS estimates FY2026 revenue will be reduced by RM16 million and profit by RM12 million.
• The estimates assume affected services remain unavailable until the third week of October.
• Each additional week could reduce revenue by RM2.5 million and profit by RM1.3 million.
• CTOS Score and CCRIS related reports remain unavailable; other services continue operating.
• Restoration depends on satisfactory remediation and independent validation, with reviews targeted for completion in October.
• The company has not specified the personal data involved or the number of affected consumers.
• Shares closed at a record low of 47.5 sen on October 13, while analyst ratings remained broadly positive.