Equifax in the News – Biggest Cyberhack, 20% Stock Price Drop

Following the news release that Equifax was a victim of the cyber security incident, which leaked some 143 million US consumer personal details, the stock promptly fell 20%, wiping out some $4bln of market capitalization. Data leaked included names, Social Security numbers, dates of birth, addresses, etc.

Equifax’s core databases (Consumer, Commercial, Work Number) were not breached and instead, the source of the hack was a flaw in 3rd party database software called Apache Strut – heavily used enterprise software.

Trying to provide an accurate estimate of the direct and indirect cost of the incident is tricky, however, we feel that one at least ought to try.

The cost will comprise of the following elements: 1. The direct cost to rectify the situation & the associated litigation & settlement expense, net of insurance reimbursement, 2. Indirect and long-term cost to its franchise

1. Direct Cost

Equifax has engaged a leading cyber security firm, put in place a credit monitoring services for affected customers free of charge for 1 year, received numerous legal suitcases, and commissioned a dedicated call center. Based on the cost of prior hacks of Target (70mln records) and Home Depot (53mln records) both resulting in about $300mln of direct cost before insurance reimbursements and, Experian (15mln customers records hacked with direct cost of $20mln), the cost per record hack is between $1.30 – $5.25 and insurance recovery was about 30%. Using conservative $6.00 as cost per hacked record, we arrive at $858mln as gross direct cost with 30% insurance recovery, giving a net figure of $600mln.

2. Indirect Cost

There are many sources of long term damage to Equifax’s franchise.

Core Credit Bureau Services

Equifax is 1 of 3 main credit scoring agencies, an industry which is displaying rational oligopolistic behaviors. The customers are mainly banks and lenders and the company has a limited direct business relationship with the end-consumers. Equifax databases are hard to replicate by a new player, and in our opinion, it would be against the lenders’ self-interest to stop using Equifax due to the resulting concentration of market and pricing power in the hands of the remaining 2 players (Experian and TransUnion) as well as due to the risk of impairment of credit score data quality and accuracy. The cost of credit check is typically a small fraction of the total loan value and therefore ascertaining the likelihood of full loan repayment remains lender’s overriding commercial objective.

The network effect of Equifax databases built over time with customer credit data remains unimpaired by the unfortunate incident, in our opinion. Similarly, the interdependent relationship between Equifax and its customers remains equally valid.
The cost of litigation is likely to be substantial and inherently uncertain. We anticipate various class action suits to follow, however courts won’t look favorably on claims that are unable to prove financial harm or financial losses suffered by the claimants. In that respect, Equifax offering credit monitoring solutions free of charge for affected customers for 1 year is a wise investment and Equifax may consider to extend such services for longer.

Equally hard to estimate is the level of fine that will levied on Equifax by the regulators. It is likely to be substantial, but unlikely to be life-threatening as regulators’ ultimately do not wish to put Equifax at risk as a going concern, which we believe would be against the interests of consumers (by restricting credit flow), lenders and wider financial industry.

Employment Verification Services

Equifax operates employee verification services (23% of revenues), which allows employers to verify position and salary information, and relies on employers willingness to share sensitive employee information. The hack clearly reduces confidence levels in sharing such sensitive information. We believe that employment verification service is meeting a genuine business need and with the appropriate safeguards, the long-term damage is limited.

Regulatory Action

We would expect regulators legislators to take an interest in the incident, likely adding to headline risk. That said, we do not expect the role the bureaus play with respect to facilitating the expansion of consumer credit to change. Adverse regulatory action may include restrictions on the data that the company collects, which we believe is unlikely and would likely be opposed by both other credit bureaus as well as lenders themselves.

Company’s Reputation and Management Distraction

Equifax image as a dependable provider of financial information and guardian of sensitive records has no doubt suffered greatly. The reputation gained over many years has been lost. We have no doubt that Experian will go to great length to avoid repeating the grave mistake and will strengthen the investment in cyber security and IT infrastructure.

The incident has caused inevitable distraction to management attention and in the short term will take focus away from competing and growing the franchise. We expect the growth to slow in the coming quarters as a result.

Debt levels

Company generates $960mln of operating pre-tax earnings which is sufficient to meet short-term direct cost associated with the hack. Company has $2.5bln of net debt, and may decide to suspend share repurchases and/or dividends to conserve cash. Acquisitions will likely be put on hold pending more certainty of the final cost of the hack.