Risks and outcomes
- Business risk- Equifax primarily sells credit history data to banks, various lenders, employers, etc people who use their unique database of consumer buying habits and likelihood of paying loans back. I can’t see any businesses saying they don’t want to use the data so there will likely be no business loss. Banks have been trying to wean themselves off their databases for years with no success. Now Google and Facebook are huge customers, trying to link ephemeral web traffic with real people’s buying habits. The consumer facing business is only 11-12% of revenues according to JP Morgan so hardly worth a near 40% stock price drop. Let’s say they loose half of the consumer business plus spend 3% of earnings providing free credit repair and monitoring services take off 6% of the stock price.
- Key management risk- news agencies widely reported that senior management dumped millions of dollars worth of stock at high prices right before the hack. Equifax said in a statement to CNNMoney that it found out about the security incident on July 29 and immediately took action. But according to filings with the SEC, Equifax Chief Financial Officer John Gamble sold shares worth nearly $950,000 on August 1.Joseph Loughran, Equifax’s president for U.S. information solutions, sold shares worth about $685,000 on August 1 as well. It’s been reported that 30 senators and representatives have asked the SEC to investigate. I agree with the Company’s assertion that there is nothing here but even if the management was forced to resign, the stock would probably rally on the increased possibility of a sale or activist investment. Take 0% off the stock price here.
- Class action lawsuits- Lawyers have been lining up to sue Equifax. They will have no problems building a class action lawsuit. Collecting on it will be an entirely different matter. Lawyers need to foot these bills and they will soon discover that it is virtually impossible to definitely link the victim of an identity hack with the hackers themselves. It’s not like criminals volunteer this information and if you have ever talked to a bank about someone who has hacked your account, they have no interest in pursuing the hacker. They just change your account number and move on. After all they have budgeted theft losses in their projections. I doubt if the lawyers will win many court victories but its a risk and will weigh on the stock price until the Company settles. Equifax clearly states the risks here in their 10K”Any such access, disclosure or other loss of information could subject us to litigation, regulatory fines, penalties or reputation damage, any of which could have a material effect on our cash flows, competitive position, financial condition or results of operations. Our property and business interruption insurance may not be adequate to compensate us for all losses or failures that may occur. Also, our third-party insurance coverage will vary from time to time in both type and amount depending on availability, cost and our decisions with respect to risk retention.”
You can expect that every legally binding contract Equifax signs has language buried in it to mitigate their risks, exposure, and liabilities to such event. Equifax is sure to lawyer up big and I’m sure every document they have already discloses the risk of theft. So in reality there is probably no recourse for victims. It’s just a matter of PR and how much money they feel they need to burn on lawyers. If they don’t, then they management should be fired for incompetence, not insider trading.
Bottom line- it will be very hard to prove damages but it has been very expensive in reputation. What’s reputation loss worth if it’s not accompanies by business loss? Not much IMHO. Ultimately its all about business and cash flow. Headlines are fleeting and the world will move on. We estimate a 5% loss here.
Bottomline- Equifax has been a tremendous winner in the stock market. Directors have been willing to buy the stock at $124. The price has tripled in the last 5 years. Companies like Google and Facebook have a voracious appetite to identify their potential users with buying habits. Digital commerce and advertising are on fire and companies like Equifax are providing the fuel. Our analysis shows a DCF valuation of EFX closer to $95-$112 so EFX has never shown up on our value based screens until now but we have to look askance at what we think but because what matter is what the markets thinks and the market said EFX was worth $140. Is it worth $98? Probably not because this hack is only worth an 11% discount to the market price so if our analysis is correct, EFX should trade up to $124-13o within a year IF the market holds up. We are a buyer and will continue to add to our position if it deteriorates further. Coincidentally this price was derived without the benefit of the excellent JP Morgan research piece that I just read. Their target price is $135. Patient investors will be rewarded! Your comments and feedback are welcome.