OTHERS CTOS DIGITAL BERHAD — UPDATE ON CYBERSECURITY INCIDENT

Others Ctos Digital Berhad - Update On Cybersecurity Incident Ctos Digital Berhad Type Announcement Subject OTHERS Description CTOS DIGITAL BERHAD — UPDATE ON CYBERSECURITY INCIDENT The Board of Directors of CTOS Digital Berhad ("Company") refers to the Company's announcement dated 23 September 2026 in relation to the cybersecurity incident impacting a specific environment supporting its consumer business. Some of the credit reporting services ("Services"), including CTOS Score and CCRIS-related reports, remains temporarily unavailable. Other services continue to operate. The Company has implemented remediation and security measures and is undertaking independent reviews to validate the effectiveness of these measures targeted for completion in October 2026. The Company is working towards resuming the impacted services as soon as possible, subject to the satisfactory completion of remediation and independent validation. The below estimated financial impact assume that certain Services remain unavailable until the third week of October 2026. These estimates are preliminary and takes into account the expected duration of the service interruption, together with the costs associated wi