Malaysian credit reporting agency CTOS Digital says all credit reporting services disrupted by a cybersecurity breach have now been restored and are operating as intended. The company announced the restoration on Monday, 2 November, in a filing with the stock exchange.

The restored services include CTOS Score and reports linked to the Central Credit Reference Information System (CCRIS), the reference system used by lenders to check borrowers' credit records. CTOS said remediation measures and enhanced security controls had been independently validated before services were brought back online, and that all affected environments had been secured after security assessments.

Incident dates back to September

CTOS first disclosed the incident on 23 September, saying unauthorised access had occurred in an environment supporting its consumer business and that files holding a limited amount of consumer information had been accessed. The company did not identify the personal data involved. On 13 October it estimated the breach would cut full-year 2026 profit after tax and minority interests by RM12 million and revenue by RM16 million, based on services remaining unavailable until the third week of October.

The incident weighed heavily on the company's shares, which fell to a record low of 36 sen on 19 October before recovering to 43 sen at the midday break on 2 November. CTOS said it would keep monitoring and strengthening its cybersecurity controls. The 2 November announcement did not disclose a root cause for the original intrusion, and the company has not said whether any regulatory action followed.

Sources: KLSE Screener; Business Today Malaysia.