CTOS down is not a rumour and it is not temporary in the way most outages are. CTOS Digital Bhd disclosed a cybersecurity incident on 23 September 2026, and in a Bursa Malaysia filing on 13 October 2026 it said CTOS Score and CCRIS-related reports remain unavailable, that Bank Negara Malaysia had suspended the Central Credit Reference Information System that feeds them, and that the disruption will cut its 2026 profit by RM12 million and revenue by RM16 million. The company’s own assumption is that some services stay offline into the third week of October.
For a Malaysian SME the share price is not the story. The operational question is narrower: if your bank financing application, your tenant vetting or your supplier credit check depends on a CCRIS-based report, that check may not be runnable this week. This article separates what is confirmed, what is only an estimate, and what you can actually do about a credit check that cannot be run.
Last updated: 16 October 2026. This article reports CTOS Digital’s own Bursa Malaysia filing, Bank Negara Malaysia’s suspension of CCRIS access as reported by named outlets, and the published analyst assessments. Where a figure is a broker’s assumption rather than company guidance, we say so.
CTOS down: which services are affected, and for how long
The service interruption is specific, not total. CTOS said the affected services are CTOS Score and the CCRIS-related reports, while businesses not dependent on that data continue to operate normally. Analysts put the revenue exposure at roughly a third of the group. We have listed what is affected alongside what it means for a business, because the status line alone does not tell you whether your own check is blocked.
| What is affected | Status | Where that leaves an SME |
|---|---|---|
| CTOS Score | Unavailable | A scored credit assessment cannot be produced from CTOS during the outage |
| CCRIS-related reports via CTOS | Unavailable | The report layer most lenders read is the one that is missing, not the borrower’s underlying record |
| Bank Negara’s suspension of CCRIS access | In force | The regulator suspended the database that supplies the above, which is why this is not fixed by CTOS alone |
| Other CTOS businesses | Operating normally | Non-CCRIS products and international operations are unaffected |
Service status per CTOS Digital’s Bursa Malaysia filing of 13 October 2026 and Bank Negara Malaysia’s suspension as reported by The Edge Malaysia on 15 October 2026. Source: The Edge Malaysia, CTOS Digital resumes descent to new all-time low with more analyst downgrades, 15 October 2026, theedgemalaysia.com.
The money: what CTOS says the outage costs, and what brokers think it costs
CTOS published its own estimate on 13 October: RM12 million off 2026 profit after tax and minority interests, and RM16 million off revenue. The company said the numbers are preliminary and may change. Against its own last full year, the profit hit is about 11.5% of the RM104.4 million it earned in FY2025, and the revenue hit about 4.9% of RM326.06 million.
| Measure | CTOS guidance (13 Oct 2026) | Broker assumption (Kenanga, 14 Oct 2026) |
|---|---|---|
| Assumed outage window | Services unavailable into the third week of October, with a 30-day recovery | Services offline until end-December 2026, about 10 weeks beyond management’s base case |
| FY2026 profit impact | RM12 million | RM22 million, plus a RM3 million recovery drag into the first quarter of 2027 |
| FY2026 revenue impact | RM16 million | Not restated separately in the note |
| Cost of each extra week | RM1.3 million profit, RM2.5 million revenue | Same per-week figure carried forward |
Company guidance from CTOS Digital’s filing of 13 October 2026; the broker case is Kenanga Research’s, published 14 October 2026, which assumes a materially longer outage. Source: The Edge Malaysia, CTOS cyber incident raises risks, weakens near-term earnings visibility — Kenanga, 14 October 2026, and The Edge Malaysia, 13 October 2026, theedgemalaysia.com/node/821728.
Two things follow from the gap between those columns. First, the cost of the outage is roughly linear in time, so the difference between management’s window and Kenanga’s is about RM10 million of profit. Second, CTOS said two of four independent reviews were still pending at the time of the note, which is why the restoration date should be read as a target and not a schedule. We keep both columns rather than picking one, because the honest answer for your planning is that nobody publishing this has a confirmed end date.
Which parts of the business are exposed
The consumer segment carries the whole of the loss, and the financial institutions segment carries most of the rest. Kenanga put the outage at about 35% of group weekly revenue, broken down as roughly 55% of financial institutions and corporate segment revenue, 10% of commercial revenue, and all consumer revenue, with international revenue unaffected.
That distribution explains why the knock-on reaches SMEs at all. The commercial line, where most SME-facing credit assessment sits, is the least exposed at about 10%. The segment doing the checking for a bank financing application is the one that is most exposed. We set the two figures out together because the summary headline, that a third of revenue is affected, is the least useful number in the note for a business reader.
The market reaction, in numbers
Worth knowing because it sets the recovery expectations your lender is working with, not because it moves your application.
| Date | Close | Detail |
|---|---|---|
| 13 October 2026 | 47.5 sen | A record low at the time, down 0.5 sen or 1.04%. Market capitalisation RM1.05 billion. Down 40.08% year to date |
| 15 October 2026 | 42 sen | A fresh record low, down 16% or 8 sen. More than 21 million shares traded. Market capitalisation RM923 million. Down about 45% year to date |
Closing prices as reported on the dates shown. Source: The Edge Malaysia, 13 and 15 October 2026, and The Star, CTOS recovery hinges on service restoration, 15 October 2026, thestar.com.my.
On 15 October, Hong Leong Investment Bank and CIMB Securities both cut their recommendation to hold from buy and sharply lowered their target prices, joining Kenanga Investment Bank, which had downgraded a day earlier. There are now five hold calls, four buys and no sells among the analysts tracked by Bloomberg, with the average 12-month target price down to 67 sen. RHB kept its buy call with a target of RM1.06, down from RM1.10, and BIMB kept buy while cutting its target to 55 sen from 91 sen. Kenanga’s target is 48 sen, down from 83 sen.
What an SME does about a credit check that cannot be run
The distinction to hold on to: CCRIS is Bank Negara’s own register, and CTOS is a private agency that repackages it. The suspension is on the agency’s access to the register, not on your own record, and it is not a blacklist. Work through this in order.
- Get your own report from the source, not the agency. Bank Negara provides a consumer’s own CCRIS report free through its eCCRIS portal. That is the regulator’s own channel and it is separate from any commercial bureau, so it is the one path that does not depend on the suspended access.
- Ask the lender in writing what it will accept this week. The question to put to your bank is not “is my application rejected” but “what will you accept in place of the report while the access is suspended”. A bank’s own CCRIS access is a separate route from an agency report, and the answer will differ by institution.
- Do not read a delay as a decline. An unavailable report is a missing input, not a negative finding. Applications can be held rather than assessed.
- For a counterparty or tenant check, ask what source the other side will accept. If your process specified a CTOS report, that specification is the thing that has to change, and the counterparty has to agree to the substitute.
- Correct your record now, while nothing is waiting on it. An error in a CCRIS entry is fixed by the financial institution that reported it, not by Bank Negara and not by the agency. Updates reach the register by the 10th of the following month, so a correction started now lands before a deadline you have not set yet.
- Date every assumption. The restoration window is a target. Put the date you were told, and who told you, into your own file.
What we could and could not confirm
Confirmed, from named sources: the incident was disclosed on 23 September 2026 and involved unauthorised access in an environment supporting CTOS’s consumer business; CTOS Score and CCRIS-related reports are unavailable; Bank Negara Malaysia suspended CCRIS, disrupting those services; the RM12 million profit and RM16 million revenue estimates and the per-week figures are CTOS’s own, stated as preliminary; the closing prices and the downgrades on 13, 14 and 15 October.
Not confirmed, and this is the material gap: whether the 2026 suspension applies only to CTOS’s access or to every registered credit reporting agency. The 2021 suspension covered all agencies. No source we read states the scope of the 2026 one, so we are not going to imply that other bureaus are unaffected, and we are not going to advise you to route around this to a named alternative. Ask your lender which sources it can currently accept. We could also not confirm what personal data was accessed in the September breach, whether the third-week-of-October target holds, or whether Kenanga’s end-December assumption proves closer.
Frequently asked questions
Is CTOS completely down?
No. CTOS Score and CCRIS-related reports are unavailable. Other CTOS businesses and its international operations continue normally, and analysts put the affected portion at about 35% of group weekly revenue. The practical problem is that the unavailable part is the part most lenders read.
Can I still get my CCRIS report?
Bank Negara provides your own CCRIS report free through its eCCRIS portal, which is the regulator’s own service and separate from any commercial agency. Treat that as the reliable route to your own record while agency access is suspended. Whether a lender will accept it in place of an agency report is the lender’s decision, so ask.
Will my loan application be rejected because of this?
An unavailable report is a missing input rather than a negative one, so the more likely outcome is a delay or a request for an alternative. Ask the bank in writing what it will accept during the suspension, and ask for its answer in writing so the date and the source are on record.
Is this the same as the 2021 CCRIS suspension?
It is the same class of event, and the 2021 one is the useful precedent. RHB Research notes that the 2021 precautionary suspension of CCRIS access, which applied to all credit reporting agencies, lasted six weeks. The 2026 suspension has not been given a published end date.
What caused it?
CTOS disclosed on 23 September 2026 that unauthorised access had occurred in an environment supporting its consumer business, and that some files containing a limited amount of consumer information were accessed. It did not specify what personal data was involved. Two of the four independent reviews it commissioned were still pending as of 14 October.
How much will this cost CTOS in the end?
Unknown, and the two published answers differ. CTOS’s own guidance is RM12 million off 2026 profit and RM16 million off revenue, assuming services return in the third week of October. Kenanga Research assumes the outage runs to end-December and puts the profit impact at RM22 million, with a RM3 million drag into the first quarter of 2027.
Sources
These are the reports we read, with the date each was published and the words quoted from them.
- The Edge Malaysia, CTOS estimates RM12m FY2026 profit hit from cyber breach as stock falls to record low, 13 October 2026 (the Bursa filing detail; the RM12 million and RM16 million estimates; the quarterly split; the per-week figures; the 23 September disclosure; the closing price) — theedgemalaysia.com/node/821728
- The Edge Malaysia, CTOS Digital resumes descent to new all-time low with more analyst downgrades, 15 October 2026 (Bank Negara’s suspension of CCRIS; the 42 sen close; the downgrades; the Hong Leong Investment Bank quotation) — theedgemalaysia.com/node/821937
- The Edge Malaysia, CTOS cyber incident raises risks, weakens near-term earnings visibility — Kenanga, 14 October 2026 (the revenue-exposure breakdown by segment; Kenanga’s end-December assumption; the RM22 million restated impact; the target price) — theedgemalaysia.com/node/821804
- The Star, CTOS recovery hinges on service restoration, 15 October 2026 (RHB’s six-week 2021 precedent; RHB and BIMB target prices; Kenanga’s 65% revenue-unaffected figure) — thestar.com.my
- Wikimedia Commons, Bank Negara Malaysia, Johor Bahru (2025) — img 01, photograph by Chainwit., 16 March 2025, CC BY 4.0 (the cover photograph; not taken at any event in this story) — commons.wikimedia.org
- Wikimedia Commons, Bursa Malaysia.JPG, photograph by Travelpleb, 18 May 2012, CC0 (the Bursa Malaysia photograph in the market-reaction section) — commons.wikimedia.org
- Own capture, 16 October 2026: The Edge Malaysia’s report of the Bursa filing, retrieved over HTTPS and cropped to the headline, byline and date. Read-only; nothing on any third-party service was changed.
BD Media is the editorial desk of Big Domain. This article reports a company’s own Bursa Malaysia filing, a regulator’s suspension as reported by named outlets, and published broker assessments. It is not investment, legal or financial advice, and a broker’s target price is not a valuation. Confirm your own position with your lender and with Bank Negara’s own services before acting on it.
