Wall Street has the most inane and stupid aphorisms on the planet. “Buy low and sell high.” Such sage advice. Another one is “don’t catch a falling knife.” No? Then how can I buy low?
The truth is that making a decision on whether to purchase shares in a company that has been recently tarnished is one of the toughest investors make. Are you picking up a great company at a discount or merely buying another Valeant on the way down?
The recent troubles of Equifax make for a very good case study in progress on this dilemma. Equifax is in the business of providing information about an individuals’ creditworthiness to lenders, insurance companies, employers and others that use a credit bureau profile as an indicator about an individual. Once upon a time, credit bureaus were regional in the United States because lending was more personal. As lending structurally changed, the credit bureau agencies consolidated into three national players: Experian is the largest, followed by Equifax and then TransUnion. Fair Isaac Corporation, creators of the FICO score, are not a direct competitor – they model data and provide analytics rather than directly providing bureau reports.
In practice, large lenders do not run their operation with a single bureau provider and many use all three, although they do tend to have primary bureau providers that get more of their business than the other two. That fundamental structure and size of the market make it extremely lucrative. Last year, Experian’s operating margins were 26%. Through the years, Experian has also expanded to many other countries around the world including Canada, the U.K., and Australia.
Holding all of that information makes you a prime target for hackers and last week Equifax said it sustained a data breach that affected more than 140 million people. In sheer numbers, this is not the biggest data breach that’s ever occurred. That title probably belongs to Yahoo when a billion accounts were hacked in 2013. But the combination of the type of information stolen – names, addresses, social security numbers – with the volume, probably make this the most consequential data breach ever seen.
As always seems to be the case, the companies crisis management has not clothed it in glory, either. It waited months to disclose the breach and initially asked customers to waive certain legal rights in order to qualify for credit protection assistance. Today it announced that two senior executives are “retiring” from the company.
Congressional inquiries are on the way, as well as class action lawsuits, and suits from state Attorneys General. It still seems somewhat murky what exposure exists for the company in Canada and the U.K. Before the news broke the stock traded at close to $143. Since then it has declined by 35% to $93.
There are really two factors that are important to consider when analyzing Equifax today. First, how likely is this data breach to affect Equifax’s long-term competitive position? Second, what direct costs may Equifax be facing in the near term.
The great thing about having an enormous competitive advantage is that even when you behave in dumb and negligent ways, you are more likely than not to maintain your position. As time passes, I think that will be true for Equifax. Lenders may shift their preferences in the near term, but once the initial risk subsides, the competition between the three bureaus will probably return to the balance that had previously existed. Consumers who rely on credit bureau information usually have short memories as well.
The difficult thing, though, is that it is extremely difficult to calculate exactly what kind of direct costs and penalties that Equifax is on the hook for. A study done for IBM suggests that data breaches can cost a company around $200 per account in professional services for remediation, fines, and fraud costs. Equifax’s breach affected 143 million consumers, but of those only about 200,000 had credit card information stolen. Using that as a proxy would put the liability at $400 million. Generously including costs for the non-credit card related breaches mean that costs could easily come to a $1 billion.
The decline in Equifax’s stock has brought its market capitalization down to $11.6 billion and last year it generated about $600 million in free cash flow – adding the estimated liabilities of $1 billion and you get a multiple of about 21x. Experian, its larger rival, now has a market cap of $18.4 billion and generated about $950 million in free cash flow last year. That works out to a multiple of 19x.
With uncertainty mounting over the precise costs and business hit Equifax will ultimately take, there does not seem to be any possible reason to wade into the stock now. If someone really wanted to play the situation, Experian is clearly the better play. But, the most intelligent action, for now, is nothing. If Experian trades down another 15% – 20% relative to other players in the space, then it might finally start to look interesting.