Credit
Kevin D. Liles for The New York Times
Equifax has suffered a new intrusion — into its profitability. Costs relating to the consumer credit reporting agency’s major cyberattack helped knock earnings down 27 percent in the third quarter from a year earlier. Revenue also took a big hit. And the likely biggest expenses — including a long list of unquantified legal exposures — are yet to rain down.
The Atlanta-based company, led by an interim chief executive, Paulino Barros, reported $87.5 million of pretax expenses in the period related to the hack, which allowed attackers to extract information on as many as 145.5 million consumers. Some of the expenses are one-offs, and others won’t be. The company expects up to $75 million in additional expenses this quarter.
That may be only the tip of the iceberg. Equifax is one of a handful of credit-scoring companies that collect people’s data on a huge scale and sell it to lenders, making it almost systemically important. That arguably means the bar for protecting its data is higher than for other corporations. It now faces 240 class-action lawsuits in North America, and investigations by a who’s who of watchdogs, including the Securities and Exchange Commission, Britain’s Financial Conduct Authority and the attorneys general of all 50 states. Equifax says it cannot yet estimate damages and fines, but there are likely to be some of both.
Although overall revenue was up in the third quarter, sales in its biggest division, which handles American consumer credit reports, fell 3 percent. That was a sharp turnaround from 7 percent growth in the first half, considering that the breach was made public only on Sept. 7. To give that result, the unit’s revenue in the last three weeks of the quarter would have had to slump by about a third from what was expected, according to Breakingviews calculations. Executives expect overall revenue to decline by 3 to 4 percent in the fourth quarter as customers defer more orders.
Investors have lopped off about a quarter of Equifax’s market capitalization since the breach. That’s consistent with a sustained drop in profit on the scale of the third quarter, but it doesn’t allow for an extended slide in revenue or big legal outlays. The investors may be too sanguine.
