(Updated)

CTOS Digital sees stock pullback as market reacts to suspension of CCRIS access to credit reporting agencies

CTOS Digital sees stock pullback as market reacts to suspension of CCRIS access to credit reporting agencies
-A +A

KUALA LUMPUR (Oct 4): Shares of CTOS Digital Bhd fell as much as 6.25% to touch an intraday low of RM1.80 on Monday as investors reacted to Bank Negara Malaysia's (BNM) move to temporarily suspend its Central Credit Reference Information System (CCRIS) services to credit reporting agencies last Friday amid alleged data leak of several governmental bodies. It was among the most active stocks on Bursa Malaysia.

The counter pared some losses to close at RM1.87, still down five sen or 2.6%, with 84.49 million shares changing hands. Its market capitalisation stood at RM4.11 billion. The stock price has risen 70% from its initial public offering price (IPO) of RM1.10 on July 19.

In a note to clients on Monday, RHB Research analyst Liew Wai Hoong said under its worst case scenario, CTOS could lose RM14 million in revenue and record RM10 million loss per month assuming that the BNM assessments will take a quarter to finish, all lenders stop using CTOS’ services during the fourth quarter of 2021 and all costs are fixed.

However, he deemed this situation to be highly unlikely given the level of disruptions to the financial system, especially for non-bank lenders. “This would likely result in tightening in lending, especially to the B40 (bottom 40% income) group, which goes against BNM’s agenda,” he said.

Liew believed the share price pullback is an overreaction and advised investors to buy on weakness as there is no evidence of CTOS being guilty of data leak and its structural growth thesis remaining intact.

“The biggest downside risk, in our view, is the event where CTOS’ database has indeed been compromised. At this juncture, it appears that the alleged leak did not originate from CTOS but we do not rule out the remote possibility of any compromise revealed by the assessment. In this unlikely event, we could see a serious valuation derating,” said Liew, who is maintaining a "buy" call on CTOS with a target price (TP) of RM2.36.

KAF research analyst Nabil Zainoodin, however, has downgraded his rating on CTOS to "sell" from "hold" with an unchanged TP of RM1.45.

“While the financial impact of the suspension is still uncertain as it will depend on the duration of the suspension, we believe this incident may affect customers’ confidence to subscribe to CTOS’ services,” he said, adding that a data breach would negatively impact its reputation and result in a possible lawsuit.

He also said CTOS' valuations seem stretched considering the higher risk of data breach and the recent run-up in its share price.

“Its share price jumped more than 30% post-IPO, implying a forward enterprise value-to-earnings before interest, taxes, depreciation and amortisation (EV/EBITDA) multiple of 45.5 times, higher than the industry’s average of 24 times. As such, we think the current valuation has more than reflected the company’s fundamentals,” he added.

On Friday, CTOS announced that its wholly-owned subsidiary CTOS Data Systems Sdn Bhd had received a letter/directive from BNM regarding the temporary suspension of access effective Oct 1.

Later on the same day, BNM told theedgemarkets.com that it has been “made aware of a credible threat involving credit reporting agencies in Malaysia”, without elaborating.

"The safety of financial consumer’s data is of utmost importance to BNM. As a pre-emptive measure, BNM has temporarily suspended the access of all credit reporting agencies to the CCRIS database effective immediately. 

“Access will be restored once the credit rating agencies' secure access is assured,“ the central bank said.

Apart from CTOS, Experian Information Services (Malaysia) Sdn Bhd (Experian Malaysia) also said it had temporarily paused its CCRIS related services and reports after BNM on Sept 30 communicated the temporary suspension of access to CCRIS for all credit reporting agencies including Experian Malaysia.

On its part, Experian Malaysia noted that the company has since conducted an in-depth security investigation and has found no evidence of any compromise in its systems, servers or facilities. 

“We have submitted our findings to BNM and are actively supporting BNM in their ongoing investigation and additional assessments, as required to resume these services as soon as possible for our customers," it said in a statement on Sunday.

Read also:
Bank Negara temporarily suspends credit reporting agencies' access to CCRIS services

CTOS offers free dark web monitoring to all Malaysians for one month

Joyce Goh & Lam Jian Wyn