Equifax in the News – Biggest Cyberhack, 20% Stock Price Drop
Following the news release that Equifax was a victim of the cyber security incident, which leaked some 143 million US consumer personal details, the stock promptly fell 20%, wiping out some $4bln of market capitalization. Data leaked included names, Social Security numbers, dates of birth, addresses, etc.
Equifax’s core databases (Consumer, Commercial, Work Number) were not breached and instead, the source of the hack was a flaw in 3rd party database software called Apache Strut – heavily used enterprise software.
Trying to provide an accurate estimate of the direct and indirect cost of the incident is tricky, however, we feel that one at least ought to try.
The cost will comprise of the following elements: 1. The direct cost to rectify the situation & the associated litigation & settlement expense, net of insurance reimbursement, 2. Indirect and long-term cost to its franchise
1. Direct Cost
Equifax has engaged a leading cyber security firm, put in place a credit monitoring services for affected customers free of charge for 1 year, received numerous legal suitcases, and commissioned a dedicated call center. Based on the cost of prior hacks of Target (70mln records) and Home Depot (53mln records) both resulting in about $300mln of direct cost before insurance reimbursements and, Experian (15mln customers records hacked with direct cost of $20mln), the cost per record hack is between $1.30 – $5.25 and insurance recovery was about 30%. Using conservative $6.00 as cost per hacked record, we arrive at $858mln as gross direct cost with 30% insurance recovery, giving a net figure of $600mln.
2. Indirect Cost
There are many sources of long term damage to Equifax’s franchise.
Core Credit Bureau Services
Equifax is 1 of 3 main credit scoring agencies, an industry which is displaying rational oligopolistic behaviors. The customers are mainly banks and lenders and the company has a limited direct business relationship with the end-consumers. Equifax databases are hard to replicate by a new player, and in our opinion, it would be against the lenders’ self-interest to stop using Equifax due to the resulting concentration of market and pricing power in the hands of the remaining 2 players (Experian and TransUnion) as well as due to the risk of impairment of credit score data quality and accuracy. The cost of credit check is typically a small fraction of the total loan value and therefore ascertaining the likelihood of full loan repayment remains lender’s overriding commercial objective.
The network effect of Equifax databases built over time with customer credit data remains unimpaired by the unfortunate incident, in our opinion. Similarly, the interdependent relationship between Equifax and its customers remains equally valid.
The cost of litigation is likely to be substantial and inherently uncertain. We anticipate various class action suits to follow, however courts won’t look favorably on claims that are unable to prove financial harm or financial losses suffered by the claimants. In that respect, Equifax offering credit monitoring solutions free of charge for affected customers for 1 year is a wise investment and Equifax may consider to extend such services for longer.
Equally hard to estimate is the level of fine that will levied on Equifax by the regulators. It is likely to be substantial, but unlikely to be life-threatening as regulators’ ultimately do not wish to put Equifax at risk as a going concern, which we believe would be against the interests of consumers (by restricting credit flow), lenders and wider financial industry.
Employment Verification Services
Equifax operates employee verification services (23% of revenues), which allows employers to verify position and salary information, and relies on employers willingness to share sensitive employee information. The hack clearly reduces confidence levels in sharing such sensitive information. We believe that employment verification service is meeting a genuine business need and with the appropriate safeguards, the long-term damage is limited.
We would expect regulators legislators to take an interest in the incident, likely adding to headline risk. That said, we do not expect the role the bureaus play with respect to facilitating the expansion of consumer credit to change. Adverse regulatory action may include restrictions on the data that the company collects, which we believe is unlikely and would likely be opposed by both other credit bureaus as well as lenders themselves.
Company’s Reputation and Management Distraction
Equifax image as a dependable provider of financial information and guardian of sensitive records has no doubt suffered greatly. The reputation gained over many years has been lost. We have no doubt that Experian will go to great length to avoid repeating the grave mistake and will strengthen the investment in cyber security and IT infrastructure.
The incident has caused inevitable distraction to management attention and in the short term will take focus away from competing and growing the franchise. We expect the growth to slow in the coming quarters as a result.
Company generates $960mln of operating pre-tax earnings which is sufficient to meet short-term direct cost associated with the hack. Company has $2.5bln of net debt, and may decide to suspend share repurchases and/or dividends to conserve cash. Acquisitions will likely be put on hold pending more certainty of the final cost of the hack.
|Fair Value Estimate||$143|
|Fat Pitch Price||$100|
|52 Wk range||$147.02 - $110.87|
|Market Cap.||USD 14.8bln|
|Dividend Yield (%)||1.4%|
|Adjusted PE Data|
No.2 Credit Bureau Service Globally
Limited Competition with 3 Oligopoly-like Market Participants
143mln Consumer Records Hacked
Economic Competitive Advantages of the Franchise
Core credit bureau franchise enjoys high barriers to entry and is the critical element of lenders’ credit decisions. According to Morning Star Research, credit bureau industry services are only 1.5 basis points of the total household debt and the cost of a credit report is negligible in relation to the value of the loan at risk to the lender. Industry behaves as a rational oligopoly with 3 established players and no price competition. This leads to healthy margins in 40% range. Replicating Equifax database with the long history of accurate information coupled with the high value of the data accuracy and quality would be a challenge for a new entrant.
Limited competition in its core credit bureau business allows Equifax to enjoy healthy margins, but the maturity of its core business restricts potential growth, so the company has been expanding through acquisition into new geographies and new lines.
The regulatory actions could impede Equifax’s ability to monetize its databases as well as impose onerous costs. Similarly, Equifax relies for the bulk of its data on 3rd parties, placing access to key data suppliers as a crucial element of the business model.
Recent business development in workforce solutions and more specifically in employment verification business has been well received. The segment now accounts for 23% of the total revenue and has been growing well as well as earning attractive margins, similar to Bureau franchise. First mover advantage would allow Equifax to build critical data mass and raise the barrier to entry for would-be-competitors.
Equifax management is targeting 11%-14% growth in adjusted earnings per share, much of which is anticipated from organic growth, principally in the US and from exporting the business model to emerging countries (India, Brazil). We model 30% operating margins and 32% tax rate. We don’t include any share buy back accretion and/or future acquisitions. Focusing on organic growth of 6%-8%, and applying 2-stage valuation methodology with initial 5 year period growing net income at 7% followed 5 year period growing at 5% and followed by a terminal growth rate of 4% (in line with overall credit expansion) yields fair value estimate of $148 / share. Assuming $600mln cost of the hack or $5 per share gives fair value estimate of $143 / share.
Applying 30% margin of safety to the fair value estimate results in Fat Pitch price of $100 per share.
- Core Credit Bureau franchise is highly cash generative, with high returns on capital and margin profile and minimum capital investment requirements
- Equifax business model possesses high barriers to entry, strong network effects, limited price competition and operating leverage with potential for higher margins.
- Equifax continues to grow employment verification business as well as export the business model internationally
- Equifax will pay a significant fine, incur a high cost and litigation expense following a massive hack of consumer data
- Ongoing risk to further cyber security incidents and resulting in a higher cost of compliance, cyber security and IT infrastructure investments
- Company is subject to credit cycle and credit demand, which has been historically volatile
- Equifax is facing competition and elevated cost as it tries to export its business model internationally and build-up accurate and large scale database of consumers aboard