PETALING JAYA: CTOS Digital Bhd hit a new all-time low today after major research houses downgraded the credit reporting agency following a major cybersecurity incident.
Its shares tumbled as much as 17% or 8.5 sen to 41.5 sen before closing half a sen higher at 42 sen, valuing the group at RM929 million. A total of 21.4 million shares were traded.
This broke its previous record low of 47.5 sen set earlier this week. The stock has lost about 40% of its value year to date and is trading 62% below its July 2021 IPO price of RM1.10.
CTOS first disclosed the cybersecurity incident on Sept 23, saying unauthorised access had occurred in an environment supporting its consumer business.
Bank Negara Malaysia (BNM) subsequently suspended its Central Credit Reference Information System (CCRIS) which collects credit and loan data, disrupting some of its credit reporting services, including CTOS Score and related products.
CTOS said on Tuesday that the cybersecurity breach is expected to reduce FY2026’s net profit by RM12 million and revenue by RM16 million. The estimates assume some services remain unavailable until the third week of October.
Hong Leong Investment Bank (HLIB), Kenanga Investment Bank and CIMB Securities have downgraded their recommendations in recent days and slashed their target prices. They also warned of material impact to CTOS' earnings from the suspension of services.
In a note today, HLIB said the cybersecurity incident is set to “inflict a meaningful earnings drag” on CTOS.
It downgraded its call on the stock from “buy” to “hold”, with a lower target price (TP) of 50 sen. It also cut its FY2026-2028 earnings forecasts by 18%, 15%, and 14% respectively.
The bank said restoration of its services “doesn’t mean immediate normalisation”, warning CTOS faces an even longer road ahead to rebuild client confidence.
“In our view, restoring the system may be quicker than restoring customer confidence,” it stressed.
Kenanga has downgraded its call on CTOS to “market perform” from “outperform”, and lowered its TP to 48 sen from 83 sen.
It cited heightened operational, regulatory and reputational risks, weaker earnings visibility, and the possibility of customers switching to rival credit bureaus.
It also said the cybersecurity incident could cut CTOS' FY2026 core net profit by RM22 million if its Score and CCRIS-related services remain unavailable until end-December.
CIMB Securities said the prolonged service disruption has potential longer-term implications for customer retention and cybersecurity costs on top of weaker earnings visibility.
It added slower transaction volume recovery, potential customer migration to alternative providers and higher cybersecurity spending could weigh on company earnings next year.
CTOS' largest shareholder with a 20.87% stake is private equity firm Creador, through Jade Vine Sdn Bhd, followed by the Employees Provident Fund (20.68%), Aberdeen Group plc (14.89%) and Retirement Fund (Incorporated) (KWAP) (9.04%).