KUALA LUMPUR: CTOS Digital Bhd's cybersecurity incident could cut its financial year 2026 (FY26) core net profit by RM22 million if its Score and CCRIS-related services remain unavailable until end-December, according to a research house.
Kenanga Research said the revised estimate is higher than the RM12 million impact initially guided by CTOS, which assumed services would resume by the third week of October.
The firm cut its FY26 and FY27 core net profit forecasts by 22.6 per cent and 3.5 per cent respectively, while lowering its target price to 48 sen from 83 sen.
It also downgraded its recommendation to "Market Perform" from "Outperform," citing heightened operational, regulatory and reputational risks, weaker earnings visibility and the possibility of customers switching to rival credit bureaus.
CTOS announced on Sept 23 that an unauthorised party had accessed an environment supporting its CCRIS consumer self-check business.
This exposed files containing a limited subset of processed consumer information.
The company said the incident was contained within the affected environment, with its financial institution, corporate, commercial and international businesses operating on separate, unaffected environments.
However, certain credit reporting services, including CTOS Score and CCRIS-related offerings, remain offline pending independent validation of remediation measures.
The outage affects about 35 per cent of the group's weekly revenue, including financial institution and corporate services, commercial offerings and its entire consumer business. International revenue remains unaffected.
CTOS had estimated an RM16 million revenue impact for FY26, equivalent to about five per cent of its projected topline, under its original recovery timeline.
Each additional week of disruption would reduce revenue by RM2.5 million and net profit by RM1.3 million.
Two of four independent reviews have been completed, covering an external scan and forensic review.
Vulnerability assessment and penetration testing, alongside a compromise assessment, are targeted for completion this month.
Services will resume only after the remediation measures have been independently validated.
CTOS will subsequently undertake a 12-month programme covering independent controls testing, compliance and external governance inspection.
Kenanga Research views the incident as a temporary setback rather than a structural impairment of CTOS' business, noting that about 65 per cent of revenue remains unaffected.
It cautioned, however, that a prolonged outage could increase customer attrition and regulatory risks.
While lenders may face switching costs because CTOS services are embedded in their credit processes, the risk of losing business remains.
The revised target price also reflects a higher weighted average cost of capital of 8.1 per cent, from 5.8 per cent, with Kenanga Research house saying it would reassess its valuation as greater clarity emerges.
© New Straits Times Press (M) Bhd