PETALING JAYA: CTOS Digital Bhd
faces a bumpy earnings recovery from the cybersecurity incident reported on Sept 23.
The company made preliminary estimates in a stock exchange filing on Oct 13 of an RM12mil impact to profit after tax and minority interest (Patami) and RM16mil in revenue for the financial year ending Dec 31, 2026 (FY26).
It also shared that further delay to resuming services could impact Patami by an additional RM1.3mil per week.
Analysts have turned cautious on the stock, with CIMB Researrch downgrading to a “hold” from an “add” call and a lower target price of 55 sen.
“We view the prolonged service disruption negatively, given the weaker earnings visibility and potential longer-term implications for customer retention and cybersecurity costs,” it said.
It noted that while the company has not received indications of contract cancellations, slower transaction volume recovery, potential customer migration to alternative providers and higher cybersecurity spending could weigh on FY27 earnings.
With the target price downgrade, the research house has cut its FY26 to FY28 earnings-per-share forecasts by 16% to 17% based on a reduced 15 times 2027 price-to-earnings multiple reflecting heightened operational risks and reduced earnings visibility.
The company shared in an analysts’ briefing on Oct 14 that approximately 35% of revenue was affected during the disruption, comprising the entirety of consumer revenue, 55% of financial institution (FI) and corporate revenue and 10% of commercial revenue.
Hong Leong Investment Bank Research, which downgraded the stock to a “hold” call from “buy” with a target price of 50 sen from 89 sen, has adopted a more cautious stance on the potential earnings drag although the current share price has largely priced in these headwinds and negative sentiment.
It has lowered revenue growth assumptions, resulting in 18%/15%/14% cuts to FY26 to FY28 earnings forecasts, respectively.
“While c.65% of revenue remains unaffected and key FI/corporate contracts remain intact, we believe the incident has introduced a structural uncertainty that extends beyond the immediate service outage,” it said.
It pointed out that FY27 cost visibility remains murky as the RM4mil other costs embedded in FY26 largely capture near-term remediation, independent validation and related measures, but do not fully encompass the subsequent 12-month cybersecurity programme.
“Management is still assessing the incremental capital expenditure/operating expenditure required, including stronger cyber controls, risk management in technology compliance, data security/governance and additional resources,” it said.
“Hence, while the immediate incident-related impact has become clearer, the earnings drag may not end in FY26.
“Capital allocation could also turn more conservative near term, with cybersecurity investment taking precedence over further share buybacks despite RM51mil already deployed up to Sept 2026,” it added.
“Customer confidence, post-restoration transaction recovery, higher recurring cybersecurity costs and potential multi-bureau adoption could weigh on the pace of earnings normalisation into FY27,” the research house said, seeing limited room to dismiss the incident as a one-off disruption while restoring the system may be quicker than restoring customer confidence.
