BFIN The Cyberattack Finally Got a Name - Everywhere Except the Audited Numbers

A V-Shaped Quarter Buried Inside an Annual Decline

FY2023 confirms what 9M 2023 already showed: net income fell 9.0% year-over-year, to Rp1,643,799M from Rp1,806,679M - the first full-year profit decline since the pandemic, ending nine straight years of growth this backlog has tracked. Read only as an annual number, that looks like a steady, single-direction deterioration. It wasn't. Cost of Credit, which set back-to-back quarterly records of 4.8% in Q2 and 5.4% in Q3, crashed to just 0.8% in Q4 alone - a 457-basis-point swing in a single quarter, the sharpest reversal this backlog has ever isolated. The annual figure of 3.6% for Cost of Credit sits almost exactly between the disastrous middle two quarters and the near-normal bookends, flattening a story that was actually V-shaped.

The same shape shows up at the segment level. Motorcycles' profit had nearly disappeared in Q3 - roughly Rp11 billion for the quarter, down from over Rp170 billion combined across H1. In Q4 alone, isolating the annual report's full-year segment disclosure against 9M 2023's own figures, Motorcycles' profit before tax rebounded to roughly Rp83 billion - not back to H1's per-quarter run rate, but a real recovery from a quarter that looked close to breakeven. New bookings told a similar story: down 5.0% for the full year (Rp19,081 billion from Rp20,081 billion), but up 11.3% quarter-over-quarter in Q4 alone (Rp4,626 billion from Q3's Rp4,155 billion), a second straight sequential improvement after Q2's cyberattack-driven collapse.

None of this happens against a quiet backdrop. For the first time, BFI's own annual report names the May 2023 cyberattack explicitly - not in the audited financial statements, but in the report's management discussion and analysis, which describes a vulnerability in a commercial software system, unauthorized third-party access, a network disconnection as the first response, engaged third-party forensic experts, and a resulting 30% jump in customer complaints during 2023. That's a genuinely new disclosure. But the financial statements' own risk-management footnote (Note 35) still uses the identical forward-looking, generic cyber-risk language as every prior quarter - penetration testing, access-management renewal, standardized network-device management - with no reference to an actual incident having occurred. See Beyond the Usual below for what that split says about where BFI is, and isn't, willing to put this on the record. The cure rate and second-restructuring share stay undisclosed for a seventh consecutive filing, and the 927,732,000-share treasury mandate is unchanged for a sixth straight quarter-end.

The Prescription

A company that will describe a cyberattack at length in its own management discussion but not in the footnote specifically designed to disclose operational risk isn't hiding the event - it's just decided which document gets to carry the liability of naming it. BFI should extend the same specificity it now uses in the MD&A - what happened, what was affected, what it's estimated to have cost - into Note 35's risk-management disclosure itself. A reader relying solely on the audited statements (the document actually subject to audit opinion and legal scrutiny) still can't connect this backlog's worst-ever credit numbers to a named, regulator-disclosed event; a reader of the glossy annual report narrative can. That's a real gap in disclosure discipline, not a matter of emphasis.

What the company should stop doing: treating the cure rate and second-restructuring share as if they were never part of its disclosure practice, rather than a metric it deliberately dropped eighteen months ago. Four straight prior posts have asked for this, and a full annual report - with more scrutiny, more footnotes, and more room than any interim filing - was the most natural point to bring it back or at least explain the omission. It didn't happen. The restructured pool has now shrunk for nine consecutive periods (from FY2021's 10.2% of managed receivables to FY2023's roughly 0.2%), and whether that reflects genuine cures or aging into the very write-offs behind this year's Cost of Credit swings remains exactly the question the missing disclosure would answer.

Key Financial Metrics

Year ended 31 December 2023 vs. year ended 31 December 2022

FX: Rp15,425 = USD 1 (29 December 2023 close, the closest trading day to period-end). Both periods below are converted at this same rate for comparability, following the convention used throughout this backlog - it is not a historical rate for the 2022 column.

Metric	FY2023 (IDR)	FY2023 (USD)	FY2022 (IDR)	YoY
Total Income ("Net Revenue" equivalent)	Rp6,353,113M	~$412.0M	Rp5,383,010M	✅ +18.0%
Profit Before Tax ("Operating Income" equivalent)	Rp2,025,252M	~$131.3M	Rp2,238,681M	⚠️ -9.5%
Net Income	Rp1,643,799M	~$106.6M	Rp1,806,679M	⚠️ -9.0%
Total Cash and Cash Equivalents	Rp1,739,659M	~$112.8M	Rp1,073,255M	✅ +62.1%

Profit before tax remains the closest operating-income equivalent for this lender, as established throughout this backlog. This is the second straight period where both profit before tax and net income fell year-over-year, confirming 9M 2023's break in the growth streak held through year-end rather than reversing in the final quarter. Operating activities swung to a net inflow of Rp276,677M (from FY2022's Rp3,521,594M outflow) - new-booking growth this year (a modest 5.3% YoY for 9M, and down 5.0% YoY for the full year once Q4's slower pace is included) needed far less cash to fund than FY2022's much faster origination pace. Total cash rose 62.1% year-over-year to Rp1,739,659M, but that's still below 9M 2023's own Rp2,056,836M - Q4 alone drew the balance down, consistent with the interim dividend paid in December (see below) and continued bond amortization.

Basic earnings per share fell to Rp109 for FY2023 from Rp121 a year earlier (-9.9%), on an unchanged weighted-average share count. Q4 2023 alone contributed roughly Rp31 of that Rp109 (FY2023's Rp109 less 9M23's Rp78) - the second-strongest quarterly print of the year, behind only Q1 2023's own Rp34 and well ahead of Q2 and Q3's roughly Rp22 each, consistent with Q4's operational rebound.

Balance sheet metric	31 Dec 2023 (IDR)	31 Dec 2023 (USD)	31 Dec 2022 (IDR)	YoY ∆
Total Assets	Rp23,991,435M	~$1,555.5M	Rp21,929,634M	✅ +9.4%
Financing Receivables (net)	Rp20,706,393M	~$1,342.5M	Rp19,554,254M	✅ +5.9%
Total Liabilities	Rp14,491,639M	~$939.6M	Rp13,173,725M	⚠️ +10.0%
Fund Borrowings (net)	Rp8,665,860M	~$561.9M	Rp10,246,908M	✅ -15.4%
Securities Issued (bonds, net)	Rp4,720,775M	~$306.1M	Rp1,581,490M	⚠️ +198.5%
Total Equity	Rp9,499,796M	~$616.0M	Rp8,755,909M	✅ +8.5%

Debt-to-equity^» eased further to 1.41x, from 9M 2023's 1.46x - a fifth straight quarter where the metric has moved (1.4x at FY2022 → 1.5x at Q1 → 1.7x at H1 → 1.46x at 9M → now 1.41x), continuing the de-lever flagged last quarter. This again matches almost exactly the company's own OJK-mandated Gearing Ratio of 1.41x - up from FY2022's 1.35x year-over-year (the annual bond issuance program added more debt than equity grew), but down from 9M's 1.46x, as Q4's slower borrowing pace and retained-earnings growth outpaced new debt within the quarter. Bonds outstanding kept growing (Rp4,720,775M, +198.5% YoY) as new Shelf III/IV/V tranches issued through the year outpaced maturities, while bank borrowings fell 15.4% as the mix shifted toward capital-markets funding. The related-party PT United Tractors Tbk facility - flagged since Q1 2020 - was renewed on 26 June 2023 with a new maturity of 19 December 2026, still against an unchanged Rp1,250,000M limit; its drawn balance rose to Rp432,257M from FY2022's Rp407,100M.

Key Operational Metrics

• New financing originations: Rp19,081 billion for FY2023 (excluding Pinjam Modal channeling), down 5.0% YoY from FY2022's Rp20,081 billion - the first annual decline in this backlog after four consecutive record years. But Q4 2023 alone was Rp4,626 billion, up 11.3% quarter-over-quarter from Q3's Rp4,155 billion - a second straight sequential increase, extending Q3's own recovery from Q2's cyberattack-depressed trough.
• Managed receivables (including off-balance-sheet joint financing, per the deck): Rp22,012 billion, up 7.4% YoY - the company's own presentation frames this as "positive receivables growth after 2 quarters of contraction."
• Non-Performing Financing (NPF) (company's own disclosed figure^», gross basis): 1.36% at FY2023, down 65 basis points quarter-over-quarter from 9M's 2.02%, though still up 36bps year-over-year from FY2022's 1.00%. NPF coverage improved to 2.6x, up from 9M's 2.2x, though still down from FY2022's 4.1x. The quarter-over-quarter improvement is the sharpest this backlog has recorded since the pandemic-recovery quarters of 2021.
• Cost of Credit (CoC): 3.6% for FY2023, up from 0.8% a year earlier, but this annual figure obscures the real story - 0.8% for Q4 2023 alone, a 457-basis-point improvement from Q3's record 5.4%. The presentation frames this explicitly as continued recovery "from operational disruption," the same phrase used to describe the cyberattack's effects since Q2 - only now describing the metric's return toward pre-incident levels rather than its deterioration.
• Net Interest Spread: 12.6% for FY2023, down from 13.6% a year earlier; Q4 2023 alone ticked up slightly to 12.3% from Q3's 12.0%, the first sequential improvement in several quarters.
• Cost to Income: 44.8% for FY2023, an improvement from 46.5% a year earlier. Q4 2023 alone worsened sharply to 50.5% from Q3's 43.3%, as operating expenses jumped 17.6% quarter-over-quarter even as Cost of Credit collapsed - a reminder that Q4's overall profit recovery came despite rising operating costs, not because of falling ones.
• Return on average assets (before tax): 6.8% for FY2023, down from 9.9% a year earlier; Q4 alone rebounded to 7.9% from Q3's 5.3%.
• Return on average equity (after tax): 17.7% for FY2023, down from 21.9% a year earlier; Q4 alone rebounded to 19.5% from Q3's 14.1%.
• Earnings per share: Rp109 basic for FY2023, down from Rp121 a year earlier (see Key Financial Metrics above).

Every quarterly profitability ratio reversed direction in Q4 after compressing steadily since Q1 - ROAA, ROAE, and Net Interest Spread all improved sequentially for the first time in this backlog's run through 2023, even as cost-to-income moved the wrong way on higher opex. The annual figures alone read as a down year across the board; the quarterly cadence inside them reads as a business that bottomed in Q3 and turned in Q4.

Update on Loan Restructuring

• Restructured balance: Rp47,805M as of 31 December 2023, down from 9M 2023's Rp80,598M - a ninth consecutive quarterly contraction, now at roughly 0.2% of total managed receivables (Rp22,012 billion), down from 9M's 0.4%.
• Absolute size: down 85.8% for the year, from Rp336,971M at 31 December 2022 to Rp47,805M at 31 December 2023.
• Cure rate and second-restructuring share: still not disclosed, for a seventh consecutive filing. The last disclosed cure rate remains Q1 2022's 80.7%; the last disclosed second-restructuring share remains Q1 2022's 18.0%. An annual report - the filing with the most room and scrutiny of any in the reporting calendar - was the most natural point to restore or explain the omission. It didn't happen. See The Prescription above and Beyond the Usual below.
• Rescheduling program remains closed since August 2020 - every account still in restructuring is working through relief already granted in 2020, per the same disclosure that has held throughout this backlog.

Three Segments, and Motorcycles' Rebound From Near-Zero

The company reports Cars, Motorcycles, and Others on the same annual basis as every prior quarter in this backlog.

Cars - still the largest segment: Rp4,207,179M of income for FY2023 (66.2% of total, down slightly from FY2022's 67.0%), up 16.7% YoY - but profit before tax fell 9.1% YoY to Rp1,427,621M from Rp1,570,371M, with margin compressing to 33.9% from 43.6%, and net profit down 8.6% to Rp1,158,731M. Isolating Q4 alone (FY less 9M's own Rp3,135,437M of income and Rp1,042,348M of profit before tax): roughly Rp1,071,742M of income and Rp385,273M of profit before tax, a 35.9% margin - a real recovery from Q3's compressed pace, though still below FY2022's 43.6% average.

Motorcycles - Rp1,219,548M of income (19.2% of total, down from 21.0%), up 7.7% YoY - profit before tax fell 43.4% YoY to Rp267,409M from Rp472,423M, margin ending the year at 21.9% versus 41.7% a year earlier, and net profit down 43.1% to Rp217,043M. But isolating Q4 alone: profit before tax rebounded to roughly Rp83,131M - a genuine recovery from Q3's near-vanished Rp11,278M, even if still well below the segment's pre-cyberattack run rate.

Others (heavy equipment/machinery, property, and sharia financing) - Rp926,386M of income (14.6% of total, up from 12.0%), up 43.8% YoY, with profit before tax up 68.6% YoY to Rp330,222M from Rp195,887M and net profit up 69.5% to Rp268,025M. Margin for the full year actually improved to 35.7% from FY2022's 30.4%, recovering from 9M's compressed 32.9% as Q4 alone posted a 43.2% margin (Rp106,075M of profit on Rp245,270M of income) - the strongest of the three segments this quarter, and the only one whose full-year margin beat its own prior year.

The pattern across this backlog's four 2023 posts holds: Cars and Motorcycles both still ended the year with lower profit than FY2022 despite double-digit or high-single-digit revenue growth, while Others is now the only segment growing both revenue and margin. But the story inside Q4 specifically is a recovery, not a further deterioration - all three segments posted their strongest quarterly margins of the second half, consistent with Cost of Credit's collapse from 5.4% to 0.8%.

Beyond the Usual

A company that named its cyberattack in the annual report - just not in the audited notes meant to disclose it

For the first time since BFI disclosed a cyberattack to OJK and IDX on 21 May 2023, its annual report explicitly names and describes the incident - a vulnerability in a commercial software system that allowed unauthorized external access, a network-disconnection response, third-party forensic engagement, a subsequent IT audit, and a 30% year-over-year increase in customer complaints attributed to the disruption. That's a real, substantive disclosure this backlog hasn't seen in two prior quarterly filings. But it appears only in the annual report's unaudited management discussion and analysis section. The audited consolidated financial statements' own Note 35 (Risk Management) - the footnote specifically covering operational and IT risk, the one an auditor has actually opined on - still uses the identical generic, forward-looking language as every prior quarterly filing: IT steering committees, penetration testing, access-management renewal, none of it referencing that an actual attack occurred. A reader relying solely on the audited statements still has no way to connect this backlog's worst-ever credit numbers to a named, regulator-disclosed security event; a reader of the glossy annual report narrative now does. The gap between what a company is willing to say in its marketing-adjacent narrative versus its audited notes is itself worth naming.

The cure rate has now been missing for seven straight filings

BFI disclosed a restructuring cure rate and second-restructuring share every quarter from the pandemic's start through Q1 2022, then dropped both starting with the H1 2022 filings. This annual report is the seventh consecutive filing - five interim quarters and now two annual reports - without either figure or any stated reason for the omission. The restructured pool has kept shrinking every period since (10.2% of receivables at FY2021, then 6.9%, 4.5%, 2.9%, 1.6%, 1.0%, 0.6%, 0.4%, and now roughly 0.2%), even as this backlog just recorded its first full-year profit decline since the pandemic. Whether the shrinking restructured pool reflects genuine cures or aging into the write-offs behind this year's Cost of Credit swings remains exactly the question the missing disclosure would answer.

The treasury mandate's sixth straight quarter at zero

The 29 June 2022 EGMS authorized disposing of BFI's entire 1,002,732,000-share treasury stock: 75,000,000 shares for the MESOP^» program (executed 11 October 2022) and 927,732,000 shares for sale to Trinugraha Capital or any other party. That larger tranche shows an unchanged treasury balance across six straight quarter-end filings now - 30 September 2022 through 31 December 2023 all show the identical 927,732,000-share balance, still against the 5 November 2025 transfer deadline disclosed for the first time in H1 2023. With roughly 22 months elapsed since the original mandate and roughly 22 months remaining before the deadline, the disposal is now exactly at its own halfway point in time, and at 0% in execution.

The Bank Jago joint-financing balance - the facility whose ceiling BFI expanded roughly 6.7x in the days after the cyberattack disclosure, flagged in H1 2023 - grew to Rp494 billion at year-end from 9M 2023's Rp441,478M and FY2022's Rp103 billion, a 379.6% year-over-year increase as the company continues drawing against the enlarged Rp2,000,000 million ceiling (roughly 25% utilized). This financing sits entirely off BFI's own balance sheet - it is disclosed only in the annual report's operational tables, not the consolidated financial statements' own line items.

Despite the year's profit decline, the Board of Directors approved an interim cash dividend of Rp28 per share on 1 December 2023, paid 21 December 2023 - a decision to distribute cash to shareholders in the same month the company's own Q4 numbers were still an open question, before the year's full recovery in Cost of Credit was even reflected in a published filing. The company states no material investments, divestments, mergers, acquisitions, or debt/capital restructurings occurred during 2023, and reports no corporate actions between year-end and the 2024 AGMS.

Target Valuation Range

Market cap ~Rp18,122,457M (~$1,175.0M) at ~11.02x FY2023 P/E and ~1.91x P/B - fairly valued, with a modest re-rating underway. Q4's Cost of Credit collapse and the segment-level rebound give the market a real reason to price in recovery rather than further deterioration, and the stock did move up over the quarter - but TTM earnings are still lower than a year ago, and the cure-rate gap means a full underwriting of the restructured book's health still isn't possible. This isn't yet a re-rating on fundamentals so much as the market correctly pricing in that the worst quarter is behind it.

Using 15,039,383,620 shares outstanding net of treasury (unchanged again this quarter - see Beyond the Usual above) and the Rp1,205 closing price:

Market cap buildup	FY2023
Share price (period-end)	Rp1,205
Shares outstanding	15,039,383,620
Market capitalization	Rp18,122,457M (~$1,175.0M)
Book value (total equity)	Rp9,499,796M

Peer-multiple sanity check	9M 2023	FY2023	Change
P/E (TTM)	~10.29x	~11.02x	up modestly - reversing 9M's compression
P/B	~1.83x	~1.91x	up modestly

Market cap is up 5.2% from 9M 2023's ~Rp17,220,094M. P/E uses FY2023 net income of Rp1,643,799M (TTM now equals the full-year figure) - the stock price rose 5.2% (Rp1,145 → Rp1,205) against TTM net income that fell only 1.75% from 9M's own trailing figure (Rp1,673,102M → Rp1,643,799M), the smallest sequential decline in TTM earnings across the four consecutive quarters this backlog has now tracked falling (Rp1,919,519M at Q1 → Rp1,826,155M at H1 → Rp1,673,102M at 9M → Rp1,643,799M now). The earnings decline is decelerating sharply, consistent with Q4's operational recovery, even though it hasn't yet reversed into growth. Over the trailing two years (January 2022 through December 2023), the stock ranged from Rp1,025 (October 2023, a fresh two-year low struck the month after Q3's worst-ever credit numbers) to Rp1,430 (June 2023's own two-year high) - a swing that stays under this backlog's usual >30-40% threshold for a standalone stock-price section, so it's folded in here: the low and the subsequent rebound to Rp1,205 by year-end track the same Cost-of-Credit V-shape driving the rest of this post.

---