23/May/2019
Credit rating agency Moody’s has cut its rating outlook on Equifax, citing cybersecurity issues as the reason for a downgrade. This is the first time that a cyber breach has been named as a factor in an outlook change.
Moody’s reduced Equifax’s outlook from stable to negative on Wednesday, May 22. Equifax continues to suffer from a massive breach of consumer data that took place in 2017.
The decision is significant because, increasingly, investors look to ratings firms and insurance companies to adequately predict the longer-term fallout of some of the biggest breaches. This task is made difficult because of the relative lack of historical data on such incidents.
Moody’s cited Equifax’s recent $690 million (£545 million) first-quarter charge for the breach as contributing to the downgrade. The expense represents the company’s estimate for settling ongoing class action cases, as well as potential federal and state regulatory fines. The note also cited Equifax’s hefty cybersecurity investments as problematic for its future strength.
“We estimate Equifax’s cybersecurity expenses and capital investments will total about $400 million (£316 million) in both 2019 and 2020 before declining to about $250 million (£197 million) in 2021,” the note says. “Beyond 2020, infrastructure investments are likely to remain higher than they had been before the 2017 breach.” Moody’s also said Equifax may not be alone.
“The heightened emphasis on cybersecurity for all data oriented companies, which is especially acute for Equifax, leads us to expect that higher cybersecurity costs will continue to hurt the company’s profit and free cash flow for the foreseeable future,” Moody’s said.
The firm recently said it is working on building cyber risk into its credit ratings, which would put corporations on the hook for their cybersecurity practices. Moody’s has indicated that the types of companies most at risk include financial firms, securities firms, hospitals, market infrastructure providers and electric utilities.
To date, the stolen Equifax data has never been found. Security experts believe that it has been collected and used for foreign intelligence purposes.
