BFIN A Cyberattack, a Near-Quadrupled Cost of Credit, and a Cure Rate Still Nowhere in Sight

A Cyberattack, a Near-Quadrupled Cost of Credit, and a Cure Rate Still Nowhere in Sight

Q1 2023 ended a four-quarter record-booking streak with a small 0.6% dip and a Cost of Credit that tripled year-over-year - a genuine deterioration the company explained candidly, without being asked. H1 2023 takes both threads further, and in the second quarter alone, further than anywhere else in this backlog. Cost of Credit rose to 4.0% for H1 2023 from 0.9% a year earlier - and hit 4.8% in Q2 2023 alone, worse than Q1's already-record 3.0%. NPF (gross) nearly doubled to 1.94% from 1.08% a year ago, and NPF coverage nearly halved to 2.3x from 4.6x. New bookings, which had merely dipped 0.6% quarter-over-quarter in Q1, fell 37.0% quarter-over-quarter in Q2 - Rp3,983 billion against Q1's Rp6,317 billion.

The company's own explanation moved with it. Q1's presentation cited "capacity adjustment due to new methodology and strong bookings growth." This quarter's adds a third phrase: "operational disruption." That's a reference to something real - on 21 May 2023, BFI disclosed to Indonesia's Financial Services Authority (OJK) and the stock exchange (IDX) that it had suffered a cyberattack, forcing a temporary shutdown of several core systems and disrupting consumer service for a period during the quarter. The company said at the time there was no indication of a customer data leak. What's notable for this post is narrower: the audited-adjacent consolidated financial statements for this quarter never mention the incident by name anywhere in their notes - not in the risk-management section's cyber-risk language (which reads as generic, forward-looking control description, not disclosure of an actual event), not as a subsequent or current-period item, nowhere. The investor presentation cites "operational disruption" three times to explain this quarter's weakest numbers in the backlog; the financial statements the numbers actually come from don't name what happened at all. See Beyond the Usual below.

None of this happens in isolation from the threads this backlog has tracked for over a year. The cure rate and second-restructuring share stay undisclosed for a fifth consecutive filing - now longer missing than it was ever present. The 927,732,000-share treasury disposal mandate remains at exactly zero shares moved, a fourth straight quarter-end at the identical balance - though this quarter's notes attach, for the first time, an explicit transfer deadline. And debt-to-equity climbed again, to 1.7x from 1.4x at FY2022, the third straight quarterly rise this backlog has tracked (1.4x → 1.5x → 1.7x) - even as the stock kept re-rating upward through what is, by every credit-quality measure the company reports, its weakest quarter on record.

The Prescription

A single "operational disruption" phrase, repeated three times in a deck, is not the same thing as disclosing what actually happened and what it cost. BFI should put a real, quantified account of the 21 May cyberattack into its financial statements' notes - what systems were affected, for how long, what it's estimated to have cost in lost bookings and elevated write-offs, and what remediation was undertaken - the same place it discloses every other operational and capital risk. Right now a reader has to go outside the company's own filed financial statements (to press coverage and the separate IDX/OJK disclosure) to understand why this quarter's credit numbers are the worst in the backlog. That's backwards: the document that reports the damage should be the one that explains it.

What the company should stop doing: using an unquantified "operational disruption" as a soft landing for numbers that would otherwise demand harder scrutiny. The phrase does real work in this quarter's presentation - it recasts a genuine, multi-metric deterioration (Cost of Credit, NPF, coverage, bookings) as a one-off external shock rather than a trend to interrogate. Whether it's mostly the former or partly the latter is exactly the question the missing cure rate and second-restructuring share (see Update on Loan Restructuring below) would help answer - which is why FY2022's post and Q1 2023's post both already asked for it, and why the case for publishing it is stronger with every quarter it stays missing.

Key Financial Metrics

Six months ended 30 June 2023 vs. six months ended 30 June 2022

FX: Rp15,064 = USD 1 (29 June 2023 close, the closest trading day to period-end). Both periods below are converted at this same rate for comparability, following the convention used throughout this backlog - it is not a historical rate for the 2022 column.

Metric	H1 2023 (IDR)	H1 2023 (USD)	H1 2022 (IDR)	YoY
Total Income ("Net Revenue" equivalent)	Rp3,199,717M	~$212.4M	Rp2,454,935M	✅ +30.3%
Profit Before Tax ("Operating Income" equivalent)	Rp1,049,900M	~$69.7M	Rp1,028,342M	⚠️ +2.1%
Net Income	Rp848,397M	~$56.3M	Rp828,921M	⚠️ +2.3%
Total Cash and Cash Equivalents	Rp2,567,492M	~$170.4M	Rp1,073,255M	✅ +139.2% (vs. FY2022)

Profit before tax remains the closest operating-income equivalent for this lender, as established throughout this backlog. Profit growth (+2.1% PBT, +2.3% net income) is running far behind revenue growth (+30.3%) for the second straight period - the gap is the Cost of Credit deterioration eating into what would otherwise be a strong top-line quarter, not a one-quarter blip. Operating activities used Rp1,108,477M this half and investing activities a further Rp236,611M, both loan-book-driven outflows rather than a sign of weak underlying cash generation - new bond issuance (see Beyond the Usual) is funding origination more than incremental bank borrowing this half, but the underlying mechanics flagged since FY2022 are unchanged: financing disbursements still outrun collections as the book grows.

Basic earnings per share reached Rp56 for H1 2023, up from Rp55 a year earlier (+1.8%), on an unchanged weighted-average share count of 15,039,383,620 - unchanged because no further treasury shares moved this quarter (see Beyond the Usual). Q2 2023 alone contributed roughly Rp22 of that Rp56, down sharply from Q1's own Rp34 - consistent with Q2's weaker quarterly profit. The remaining Rp32/share of the FY2022 dividend (Rp481,260M) was paid on 15 June 2023, completing the Rp60/share full-year 2022 distribution (a 49.9% payout ratio per the investor presentation) that began with December 2022's Rp28/share interim payment.

Balance sheet metric	30 Jun 2023 (IDR)	30 Jun 2023 (USD)	31 Dec 2022 (IDR)	HoH ∆
Total Assets	Rp25,176,796M	~$1,671.3M	Rp21,929,634M	✅ +14.8%
Financing Receivables (gross)	Rp22,006,208M	~$1,460.7M	Rp20,387,689M	✅ +7.9%
Total Liabilities	Rp16,072,457M	~$1,066.9M	Rp13,173,725M	⚠️ +22.0%
Fund Borrowings (net)	Rp9,686,899M	~$643.0M	Rp10,246,908M	✅ -5.5%
Securities Issued (bonds, net)	Rp5,370,683M	~$356.5M	Rp1,581,490M	⚠️ +239.6%
Total Equity	Rp9,104,339M	~$604.4M	Rp8,755,909M	✅ +4.0%

Debt-to-equity^» rose to 1.7x from FY2022's 1.4x (and from Q1 2023's own 1.5x) - the third straight quarterly rise this backlog has now tracked, still well inside the regulatory ceiling of 10x and still described by the company as "healthy." As with the prior two quarters, this figure is nowhere in the investor presentation itself - see Beyond the Usual below. Fund borrowings actually declined 5.5% half-over-half even as total liabilities rose 22.0%, because bonds did the heavy lifting instead: securities issued more than tripled to Rp5,370,683M on the back of two shelf-registration issuances during the quarter (see Beyond the Usual). The related-party PT United Tractors Tbk facility - flagged since Q1 2020 - continued drawing, with its balance rising to Rp416,570M from Rp407,100M at year-end against an unchanged Rp1,250,000M limit.

Key Operational Metrics

• New financing originations: Rp10,300 billion for H1 2023 (excluding Pinjam Modal channeling, the narrower basis used consistently since FY2022), up 20.8% YoY from H1 2022's Rp8,529 billion - a meaningfully slower growth rate than Q1 2023's own 53.9% YoY pace. The quarterly split explains why: Q2 2023 alone was Rp3,983 billion, down 37.0% quarter-over-quarter from Q1's Rp6,317 billion - a second consecutive sequential decline, and a far sharper one than Q1's 0.6% dip, directly coinciding with the May cyberattack's operational disruption (see Beyond the Usual).
• Managed receivables (including off-balance-sheet joint financing, per the deck): Rp22,381 billion, up 33.3% YoY.
• Non-Performing Financing (NPF) (company's own disclosed figure^», gross basis): 1.94% at H1 2023, up 89bps QoQ from Q1 2023's 1.06% and up 86bps YoY from H1 2022's 1.08% - the sharpest deterioration in this ratio anywhere in this backlog, reversing what had been five straight quarters of improvement through Q4 2022. NPF coverage fell to 2.3x, down from 3.8x at Q1 2023 and 4.6x a year earlier - a fourth consecutive quarterly decline in coverage.
• Cost of Credit (CoC): 4.0% for H1 2023, up from 0.9% a year earlier, and 4.8% for Q2 2023 alone - worse than Q1's already-record 3.0% (see Q1's post). The presentation attributes the increase to "capacity adjustment as well as operational disruption," quantifying the quarter's CoC charge at roughly Rp435 billion, "driven largely by operational disruptions in 2Q23."
• Net Interest Spread: 13.2% for H1 2023, down slightly from 13.5% a year earlier; Q2 2023 alone eased further to 12.7% from Q1's 13.6%.
• Cost to Income: 42.8% for H1 2023, an improvement from 45.9% a year earlier, though Q2 2023 alone (43.7%) ticked up from Q1's 42.1%.
• Return on average assets (before tax): 8.7% for H1 2023, down from 12.5% a year earlier.
• Return on average equity (after tax): 18.6% for H1 2023, down from 21.2% a year earlier; Q2 2023 alone fell to 14.8% (annualized) from Q1's 22.4%.
• Earnings per share: Rp56 basic for H1 2023, up from Rp55 a year earlier (see Key Financial Metrics above).

Every ratio above that has a quarterly split moves the same direction: worse in Q2 2023 than in Q1 2023, not just worse year-over-year. That pattern - deterioration concentrated specifically in the quarter containing the disclosed cyberattack, rather than spread evenly across H1 - is the strongest evidence that the incident is a real, material driver of this half's numbers, not just a convenient label. It's also exactly why quantifying it directly, rather than gesturing at it, matters (see The Prescription above).

Update on Loan Restructuring

• Restructured balance: Rp142,677M as of 30 June 2023, roughly 0.6% of total managed receivables - down again from Q1 2023's 1.0%, the seventh consecutive quarterly contraction in the pool.
• Absolute size: down 57.7% in six months, from Rp336,971M at 31 December 2022 to Rp142,677M at 30 June 2023.
• Cure rate and second-restructuring share: still not disclosed, for a fifth consecutive filing. The last disclosed cure rate remains Q1 2022's 80.7%; the last disclosed second-restructuring share remains Q1 2022's 18.0%. This gap has now outlasted the period it was ever filled - see The Prescription above and Beyond the Usual below for why this quarter's credit-quality deterioration makes it harder to read past than ever.
• Rescheduling program remains closed since August 2020 - every account still in restructuring is working through relief already granted in 2020, not new Covid-19 volume, per the same disclosure that has held throughout this backlog.

Three Segments, and the Legacy Businesses' Profit Actually Shrinks

The company reports Cars, Motorcycles, and Others on the same half-year basis as every prior quarter in this backlog.

Cars - still the largest segment: Rp2,083,859M of income (65.1% of total, up from H1 2022's 61.9%), up 24.1% YoY - but profit before tax fell 1.1% YoY to Rp718,878M from Rp726,541M, with margin (PBT/income) compressing sharply to 34.5% from 43.3%, and net profit down 0.8% to Rp580,907M from Rp585,646M.

Motorcycles - Rp682,963M of income (21.3% of total, up from 18.4%), up 39.2% YoY - but profit before tax fell 13.3% YoY to Rp173,000M from Rp199,616M, margin compressing even harder to 25.3% from 40.7%, and net profit down 13.1% to Rp139,797M from Rp160,906M.

Others (heavy equipment/machinery, property, and sharia financing) - Rp432,895M of income (13.5% of total, up from 10.7%), up 51.9% YoY, with profit before tax up 54.6% YoY to Rp158,022M from Rp102,185M and net profit up 55.0% to Rp127,693M from Rp82,369M. Margin held essentially flat at 36.5% from 35.8% - the only segment whose margin didn't compress this half.

This is a genuinely new pattern in this backlog, not a continuation of FY2022's or Q1 2023's read of Others simply out-growing the other two segments. Cars and Motorcycles - the vehicle-financing businesses most exposed to repossession losses - both posted profit declines this half despite double-digit revenue growth, their margins compressing by roughly 9 and 15 percentage points respectively. Others is now the only one of the three segments growing profit at all, and it did so while holding its margin essentially flat. Read alongside the Cost of Credit and NPF deterioration above, this looks like the vehicle book - not Others - absorbing most of this half's asset-quality damage, which is consistent with the presentation's own framing of "loss on repossessed assets" as a driver of the Cost of Credit increase.

Beyond the Usual

The incident cited to explain this quarter's worst numbers doesn't appear in the numbers' own footnotes

BFI disclosed to OJK and IDX on 21 May 2023 that it had suffered a cyberattack, temporarily switching off several core systems and disrupting consumer service during the quarter - a real, regulator-notified operational event, not a rumor. This quarter's investor presentation cites "operational disruption" three times as a driver of Cost of Credit rising to 4.8% in Q2 alone (worse than Q1's already-record 3.0%) and of new bookings falling 37.0% quarter-over-quarter. The consolidated financial statements for the same period - the audited-adjacent document the numbers themselves come from - never name the incident anywhere in their notes. The risk-management section's cyber-risk language describes ongoing controls (penetration testing, access management, system renewal) in the same generic, forward-looking terms it likely used before the attack; there is no note disclosing that an actual cyberattack occurred during the reporting period, what it affected, or what it's estimated to have cost. A reader relying solely on the filed financial statements would have no way to know this quarter's worst-in-backlog credit numbers coincide with a named, regulator-disclosed security incident at all.

The cure rate has now been missing longer than the disclosure gap it created

BFI disclosed a restructuring cure rate and second-restructuring share every quarter from the pandemic's start through Q1 2022, then dropped both starting with the H1 2022 filings. This is the fifth consecutive filing - three interim quarters, one annual report, and now this one - without either figure or any stated reason for the omission. The restructured pool has kept shrinking every period since (10.2% of receivables at FY2021, then 6.9%, 4.5%, 2.9%, 1.6%, 1.0%, and now roughly 0.6%), even as this same half posted the sharpest credit-quality deterioration anywhere in this backlog. Whether the shrinking restructured pool reflects genuine cures or aging into the write-offs and repossessions behind this quarter's Cost of Credit spike remains exactly the question the missing disclosure would answer.

The treasury mandate gained a deadline, but still hasn't moved

The 29 June 2022 EGMS authorized disposing of BFI's entire 1,002,732,000-share treasury stock: 75,000,000 shares for the MESOP^» program (executed 11 October 2022, as already reported), and 927,732,000 shares for sale to Trinugraha Capital or any other party. That larger tranche shows an unchanged treasury balance across four straight quarter-end filings now - 30 September 2022, 31 December 2022, 31 March 2023, and 30 June 2023 all show the identical 927,732,000-share balance. New this quarter: the notes now state explicitly that "the remaining treasury shares of 927,732,000 must be transferred and [the] deadline for fulfilling the obligation... is 5 November 2025" - a specific regulatory compliance date that didn't appear in Q1 2023's equivalent disclosure. The mandate now has a clock attached to it for the first time; it still hasn't moved.

Bond issuance stepped up materially this half: Shelf Registration Bond Phase IV (Rp1.6 trillion, listed 17 April 2023, coupons of 6.1%-7.15% across 1-3 year tranches) and Phase V (Rp1.1 trillion, listed 16 June 2023, coupons of 6.0%-7.0%) together explain securities issued more than tripling to Rp5,370,683M this half (see Key Financial Metrics above). On the bank-loan side, a new USD 150,000,000 syndicated facility (Standard Chartered Bank, Hong Kong, as agent) was signed 2 May 2023, with USD 300,520 already drawn by quarter-end, while an older USD 100,000,000 syndicated tranche from the same agent, maturing 23 March 2023, was fully repaid to zero.

Three days after the cyberattack disclosure, on 24 May 2023, BFI signed an amended and restated joint-financing facility with PT Bank Jago Tbk that expanded the facility's ceiling roughly 6.7x, from Rp300,000M to Rp2,000,000M, effective through 5 August 2024. Nothing in the filing connects the timing to the cyberattack, and a facility ceiling increase is routine capacity-building rather than a response to an operational incident - but the coincidence of dates on two otherwise-unrelated disclosures in the same note set is worth surfacing on its own.

Target Valuation Range

Market cap ~Rp21,506,319M (~$1,427.7M) at ~11.78x TTM P/E and ~2.36x P/B - BFI's stock kept re-rating upward through what is, by its own reported metrics, the worst credit-quality half in this entire backlog. That divergence, on top of an already-expensive Q1, reads as overvalued relative to the operating trend, not as a market correctly pricing in a temporary shock.

Using 15,039,383,620 shares outstanding net of treasury (unchanged from Q1 2023, since no further treasury shares moved this half - see Beyond the Usual above) and the Rp1,430 closing price:

Market cap buildup	H1 2023
Share price (period-end)	Rp1,430
Shares outstanding	15,039,383,620
Market capitalization	Rp21,506,319M (~$1,427.7M)
Book value (total equity)	Rp9,104,339M

Peer-multiple sanity check	Q1 2023	H1 2023	Change
P/E (TTM)	~10.30x	~11.78x	up - despite TTM earnings falling versus Q1's own trailing base
P/B	~2.13x	~2.36x	up

Market cap is up 8.7% from Q1 2023's ~Rp19,776,790M. TTM P/E uses TTM net income of Rp1,826,155M (FY2022's Rp1,806,679M plus H1 2023's Rp848,397M, less H1 2022's Rp828,921M) - the second straight quarter of multiple expansion Q1 2023 itself flagged as a reversal of the pattern seen throughout 2022. What's different this time is the direction of the earnings input: Q1's expansion came with TTM earnings still growing, even if slowly; this quarter's TTM net income of Rp1,826,155M is actually lower than Q1's own Rp1,919,519M trailing figure - a genuine earnings decline, not just a deceleration, driven by the weak Q2. A stock trading at a higher multiple against a shrinking trailing-earnings base, in the same half its Cost of Credit and NPF both hit backlog-wide records, is a harder combination to justify than Q1's milder version of the same pattern. Stock price is like mood: it can change anytime, and what matters is how the business actually performs - and this half's actual performance, on every credit-quality measure the company itself reports, performed worse than any other period in this backlog.

Stock Price: A New Two-Year High, Reached Inside the Quarter With the Worst Credit Numbers

BFI Finance shares closed at Rp1,430 on 30 June 2023, up 8.7% from Q1 2023's Rp1,315 and a new high for the trailing two-year window. Over that window (July 2021 through June 2023), the stock ranged from Rp890 (June 2021) to Rp1,430 (the quarter-end price itself, June 2023) - a 60.7% peak-to-trough swing, well past the >30-40% threshold applied throughout this backlog. Unlike Q1 2023's rebound, which happened steadily across January-February before settling, this quarter's gain was choppier: the stock rose to Rp1,375 in April, pulled back to Rp1,305 in May - the month of the cyberattack - before recovering to a fresh high of Rp1,430 by quarter-end in June. The stock, in other words, shrugged off the very month its own operational metrics show the sharpest deterioration.

---