CTOS hits all-time low following wave of downgrades

CTOS Digital Bhd experienced its lowest point in trading today as major banks downgraded their recommendations and slashed their target prices following a serious cybersecurity breach. The shares plummeted by up to 17% or 8.5 sen, reaching a low of 41.5 sen before closing at 42 sen, which valued the company at RM929 million. Over 21.4 million shares changed hands, surpassing the previous record low of 47.5 sen. The stock has lost about 40% of its value this year, trading at 62% below its July 2021 IPO price of RM1.10.

CTOS disclosed the cybersecurity incident on September 23, revealing unauthorized access to a system supporting its consumer business. Bank Negara Malaysia subsequently suspended the Central Credit Reference Information System (CCRIS), disrupting credit and loan data collection and related services like CTOS Score. CTOS estimates the breach will reduce FY2026's net profit by RM12 million and revenue by RM16 million, assuming some services remain offline until early October.

Recent downgrades by Hong Leong Investment Bank, Kenanga Investment Bank, and CIMB Securities, coupled with slashed target prices, highlight the significant impact of the cybersecurity incident on CTOS's earnings. HLIB downgraded its recommendation to "hold" from "buy" and cut FY2026-2028 earnings forecasts by 18%, 15%, and 14% respectively. The bank warned that restoring services does not guarantee immediate recovery, as rebuilding customer confidence may take longer.

Kenanga Investment Bank downgraded its call to "market perform" and lowered its target price to 48 sen from 83 sen, citing heightened operational, regulatory, and reputational risks, as well as the possibility of customers switching to rival credit bureaus. CIMB Securities warned of longer-term implications for customer retention, cybersecurity costs, slower transaction volume recovery, potential customer migration to alternative providers, and higher cybersecurity spending.

CTOS' largest shareholder, private equity firm Creador, holds a 20.87% stake, followed by the Employees Provident Fund at 20.68%, Aberdeen Group plc at 14.89%, and Retirement Fund (Incorporated) at 9.04%.