CTOS restores CTOS Score and CCRIS-related reports after September cyber incident

Implications for lenders

Lenders that paused or slowed approvals while CTOS Score and CCRIS-related reports were unavailable can resume their usual checks, but may want to re-check applications decided without them during the outage. With 10 registered agencies, keeping a contract with a second bureau can reduce the risk of underwriting stopping in a future incident, and fraud checks on applicants may stay tighter while the accessed consumer data remain a possible tool for impersonation.

Implications

Facts

Restoration: in a filing reported on 2 November, credit reporting agency CTOS Digital said it had fully restored the credit reporting services affected by the cybersecurity incident it disclosed on 23 September, including the CTOS Score and reports related to Bank Negara Malaysia's Central Credit Reference Information System (CCRIS). It said its security measures had been independently validated and that all environments were secure and had completed security assessments. The validator was not named, and the reports give no statement from Bank Negara Malaysia.

Earlier estimate: on 14 October the company estimated that the incident would reduce 2026 revenue by RM16 million (RM3 million in Q3 and RM13 million in Q4 (company estimate, 14 October)) ¹ and profit after tax and minority interests (PATAMI) by RM12 million. ² The estimate assumed the services would stay unavailable until the third week of October; each additional week was put at a further RM2.5 million of revenue ³ and RM1.3 million of PATAMI. ⁴ Reports of the restoration say the financial impact has yet to be updated.

Results: CTOS Digital's net profit for the quarter ended 30 September was RM27.54 million, up from RM24.69 million a year earlier. ⁵

Market structure: the Ministry of Finance renewed the registrations of 10 credit reporting agencies, including CTOS Data Systems and CTOS Basis, under the Credit Reporting Agencies Act 2010 for 15 September 2026 to 14 September 2027. ⁶

Analysis

Time series: the outage ran from the 23 September disclosure to restoration reported on 2 November, longer than the third-week-of-October assumption behind the company's estimate. In 2021, when Bank Negara Malaysia suspended CCRIS access for all credit reporting agencies as a precaution at the turn of September and October, CTOS's access was restored on 17 November after a review by independent cybersecurity experts required by the central bank; Experian's had been restored on 25 October. Both episodes left a large private bureau without CCRIS-related products for more than a month.

Cross-country: in Indonesia the central credit information system SLIK is run by OJK, and in the Philippines central credit data are held by the state-owned Credit Information Corporation; lenders with direct access there are less exposed to one private bureau's outage, although private bureaus also distribute that data in both markets. Malaysia's model combines the BNM-run CCRIS with 10 registered private agencies, which gives lenders alternatives but means a private bureau's CCRIS-derived reports depend on both its own systems and its access to the central register.

Quarterly profit rose despite the incident; the company's estimate placed most of the revenue loss in the fourth quarter (RM3 million in Q3 and RM13 million in Q4 (company estimate, 14 October)); the fourth-quarter results will show the actual cost.

Counterpoints and uncertainties

The company's estimate was preliminary, included remediation costs and assumed an earlier restoration, so the final impact may differ in either direction. The reports do not say whether customers moved to other bureaus during the outage or will return, nor how many people's data were in the accessed files. A restoration announced by the company is not the same as a regulator's assessment; Bank Negara Malaysia has not commented publicly in the reports.