The CTOS data incident: what loan agents should know

What CTOS has said

On Wednesday 23 September 2026, CTOS Digital Bhd filed an announcement with Bursa Malaysia. It said it had detected unauthorised access to an environment supporting its consumer business. The Edge, reporting the filing, said CTOS's cybersecurity system 'recently detected' it. Certain data files holding a limited subset of processed consumer information were accessed. Fintech News Malaysia and The Star reported the same announcement that day.

CTOS also said that it has:

• activated the necessary protocols and contained the affected environment;
• appointed an independent incident response team to run a forensic investigation;
• notified 'the relevant authorities', without naming them;
• started reviewing and strengthening its cybersecurity controls.

CTOS said its other systems and operations are unaffected. It also said part of its credit reporting services were 'temporarily unavailable' while remediation is completed. Later facts are in the dated update further down this page.

What is not known

The announcement left several things out. In the coverage we have read, these are not known:

• How many consumers. CTOS has not said how many people are involved.
• What kind of information. 'Processed consumer information' is all the announcement says. It does not say which kinds of information were in the files.
• The cause. Nothing has been said about how the access happened.
• When it began. The coverage we have read does not say when the access started.
• Who was behind it. This has not been said either.
• Which authorities were told. CTOS did not name them.
• Whether Bank Negara has restricted CCRIS access this time. Some later news reports say it did, but they give no date or source. See the update below.

The coverage we have read also gave no guidance for consumers. That means nobody outside CTOS can tell a customer today whether their details were in those files. Please do not tell a customer that they were, and do not tell them that they were not.

When this page says 'not known', it means we looked and CTOS has not said. We change the page when that changes.

What is unavailable, and what is not

Here is what we can say about each part, as of 23 October 2026.

If the difference between CCRIS and a CTOS report is hazy, CTOS, CCRIS and Experian: what each report is sets it out.

What it means for an agency and its customers

The incident was in CTOS's environment, and CTOS says it has contained it. For an agency, four things follow from what CTOS has said.

• New CTOS reports may be hard to get. While CTOS Score and CCRIS-related reports are unavailable, you may not be able to order them. Bank Negara's eCCRIS at eccris.bnm.gov.my lets a customer download their own CCRIS report, and Bank Negara describes it as free. We have not seen a notice that eCCRIS is affected, but check that it is working before you rely on it. The report can only be given to the person it is about, so the customer does this and sends you the PDF.
• Banks decide for themselves. Whether a bank accepts a given report is the bank's choice, and we cannot tell you what any bank will do. If a file is waiting on a CTOS report, ask the bank what it will take.
• Customers will ask if they are affected. The honest answer is that CTOS has not said how many people or what information is involved, so nobody can tell them yet. Say that, and do not guess.
• Your own files are your own job. The incident was not in your office, but it is a good prompt to look at where reports end up. Keeping credit reports and IC copies safe has a routine, and the PDPA amendment guide covers what to do if one of your own files goes astray.

What to do this week

1. 1

   Find your CTOS reports

   List every place a CTOS PDF might be: email, WhatsApp chats and groups, phones, laptops, downloads folders, shared drives and printouts. You cannot protect what you have not found.

2. 2

   Decide who can see them

   Limit access to the people working on that customer's application. Remove anyone who does not need it, and check that former staff no longer have access.

3. 3

   Delete what you do not need

   Keep a report only while the application it was collected for needs it. Delete the rest, including copies in chat history and downloads folders.

4. 4

   Tell customers what is known

   Say what CTOS has said: unauthorised access was detected, a limited subset of processed consumer information was involved, and CTOS has not said who is affected. Keep it short and do not guess.

5. 5

   Warn them about scam messages

   Calls, SMS and WhatsApp messages that quote real credit details can sound very convincing. Tell customers to be careful with any unexpected message about their credit, their loans or a 'CTOS problem'. They should hang up and call the bank or company on a number they already trust. They should never share an OTP, the one-time code sent by SMS or an app, with anyone, including someone who says they are from a bank, CTOS or the police.

Write down the date you did this and what you changed. If a customer or a bank asks later, you will have an answer.

What happened in October 2021

A gap in bureau reports has happened before. In October 2021, Bank Negara Malaysia temporarily suspended credit reporting agencies' access to CCRIS as a pre-emptive measure, after a credible threat. Bank Negara confirmed this by email, as Malay Mail reported on 2 October 2021.

During that time consumers could still get their own CCRIS report from eCCRIS. CTOS's access to CCRIS was restored in November 2021, as The Star reported on 18 November 2021.

The two episodes may not be the same. In 2021 Bank Negara said it had suspended the bureaus' access. In 2026, CTOS's own statements, as reported, say its services are unavailable while remediation and independent validation are completed, and do not mention Bank Negara. Some later news reports (The Edge on 15 and 20 October, Free Malaysia Today on 15 October) say Bank Negara suspended CCRIS, but they give no date or source, and we have not found a Bank Negara statement. Whether Bank Negara has restricted CCRIS access this time is not known. We mention 2021 only to show that a gap has happened before, that customers could still use eCCRIS, and that CTOS's access came back. It does not tell us how long the 2026 gap will last. That is not known.