Abstract
Equifax Inc. (EFX) recently announced a cyber-security breach where criminals accessed the personal data of approximately 143 million U.S. consumers. Following the breach, shares fell nearly 40% from a 52-week high of $147 to a recent low below $90. We believe the selling has been overdone and detail our hypothesis below.
Company Description
Equifax Inc. (EFX) is a consumer credit reporting agency which collects and aggregates information on over 800 million individual consumers and more than 88 million businesses worldwide. Founded in 1899 and based in Atlanta, Georgia, it is the oldest of the three largest credit agencies along with Experian and TransUnion.
In addition to offering credit and demographic data and services to business, Equifax sells credit monitoring and fraud-prevention services directly to consumers. The company also provides employment verification services on over 250 million employment records. Table 1 shows the breakdown of EFX sales and operating profit by segment.
Why the Opportunity Exists
On September 7, 2017, Equifax published the following press release:
Equifax Inc. (NYSE: EFX) today announced a cybersecurity incident potentially impacting approximately 143 million U.S. consumers. Criminals exploited a U.S. website application vulnerability to gain access to certain files. Based on the company's investigation, the unauthorized access occurred from mid-May through July 2017. The company has found no evidence of unauthorized activity on Equifax's core consumer or commercial credit reporting databases.
The information accessed primarily includes names, Social Security numbers, birth dates, addresses and, in some instances, driver's license numbers. In addition, credit card numbers for approximately 209,000 U.S. consumers, and certain dispute documents with personal identifying information for approximately 182,000 U.S. consumers, were accessed. As part of its investigation of this application vulnerability, Equifax also identified unauthorized access to limited personal information for certain UK and Canadian residents.
The magnitude of the breach, combined with ongoing negative headlines and continued management missteps, have created a compelling entry point for investment. Despite the potential for substantial fines and incremental operating costs, we believe the strength of the company’s core business remains largely intact.
Notably, the company’s core credit reporting databases were not impacted by the breach. While costs are likely to increase in the near term, insurance coverage is likely to offset a portion of the liability, and related fines will take years to settle. To the extent these costs are one-time in nature, they are likely to be treated as non-recurring items and should have minimal impact on normalized earnings power.
Where We See Value
Since the story broke, Equifax has been embroiled in one of the biggest public-relations disasters in recent memory.2
- Three of the firm’s executives cashed out of stocks and options in the month between when the company first learned about the hack, and when it was disclosed to the public. Federal prosecutors have opened a criminal investigation into Equifax to determine if the company was criminally negligent in failing to patch a hole in its cybersecurity systems and to determine if the stock sales constitute securities fraud.
- Equifax head of cyber security was revealed to have no background in computer science or security. The executive’s social-media profiles were subsequently scrubbed of the previously reported bachelor’s degree in music composition.
- Several Congressional committees have asked the company to turn over information relating to the hack, while several attorney generals have joined a probe into the handling of the breach.
- The company has been hit with dozens of lawsuits from consumers alleging fraud, abuse and negligence.
- Equifax CEO Rick Smith has been called to testify before a special House panel early next month.
As a result, Equifax announced this week that Richard Smith will retire as Chairman of the Board and Chief Executive Officer, effective September 26, 2017. The financial impact of these issues may be slow to arrive. Yet the impact to EFX stock price has been rapid and dramatic. From peak to trough, EFX market capitalization dropped $6.5 billion, in response to an isolated issue in one business segment that generated $112 million in operating income last year.
Discussion
Equifax is one of three providers of consumer credit reports along with Experian and TransUnion. Over the past several decades, the credit bureaus have benefited from the continued expansion of consumer credit with revenues and operating profits growing alongside the number of credit applications.
The business operates in a stable oligopoly with relatively fixed expenses and low capital requirements, since consumers provide the credit bureaus with most of their data for free (in part due to legal requirements). Equifax then packages this data once and sells reports to lenders who assess new credit applications, often selling the same report multiple times. As a result, the credit bureaus require little investment to drive growth, as illustrated in Table 2 below.
The largest financial institutions generally purchase data from all three credit bureaus since the cost of the reports is minimal relative to the capital at risk. Morningstar estimates that total credit bureau industry revenue equates to only 1.5 basis points of total household debt.
High barriers to entry allow the three incumbents to operate rationally and profitably, resulting in attractive economics across the oligopoly. Table 3 shows company level profit margins for all three credit bureaus as of the most recent fiscal year-end.
Equifax’s 26% consolidated operating margin masks the profitability of the company’s core credit bureau business, which accounts for more than 39% of sales and nearly 51% of operating profit. This business segment reported 43% operating margins during the most recent fiscal year.
With little in the way of capital requirements and highly scalable operations, we calculate that Return on Assets (ROA) in the USIS segment has increased from 17.0% to 29.4% in the last five years.
Importantly, the USIS Segment was not impacted by the breach; thus, we expect little in the way of long term consequences. The premium returns on capital generated within the USIS segment deserve to trade at a premium multiple, in our opinion. Historically, that has been the case - over the past five years, EFX has traded at an average multiple of 20x forward earnings.
Prior to the breach, the stock traded at 23.6x earnings, in line with peers Transunion and Experian, which traded at an average of 23.6x earnings. At the recent low, EFX traded at nearly a 30% discount to its fellow credit bureaus. With roughly $4 billion in market capitalization wiped out in the past few weeks, the stock may prove to be a good long-term investment for investors willing to ride out near-term volatility.
While it is impossible to quantify the financial impact of the breach with any precision, we can adopt an outside view to frame the perspective in a manner that downplays its uniqueness. Of the biggest data breaches in the 21st century, Anthem paid a $115 million fine, the largest settlement ever for a breach.4 While the current situation is arguably worse on several counts, it should not be viewed in isolation.
Even if we assume EFX were to borrow $1 billion to cover total costs and fines, we estimate that, at its recent trough, the stock was trading at 11.7x adjusted EV/EBITDA, nearly a 25% discount to its pre-breach valuation.
Implementation
While shares appear cheap relative to history and compared to peers, we believe that the sale of put options represents a better risk/reward than outright purchases of stock at existing levels. Given the sharp fall in the shares and rapidly deteriorating investor sentiment, option premiums have surged relative to normal levels as shown in Figure 1 below.
Since investors are being paid a healthy premium to write shorter maturity options, we think the risk/reward to selling volatility is more attractive than owning the shares outright at current prices.
Conclusion
In our opinion, the nearly 40% fall of EFX stock in response to the cyber-security breach and prior management’s poor handling of said breach, overly discounts to even a worst-case scenario for the business. We expect most of the expenses related to this incident to be one-time in nature, and hence should have little impact on the company’s normalized earnings power. With trough valuations at a 30% discount to peers, we believe EFX represents a compelling long-term investment. Moreover, we like the added margin of safety offered by options trading at historically elevated levels of volatility.
Article by Broyhill Asset Management
See the full PDF below.
