Do Cyber Security Incidents Really Impact Valuations?

2016 was an interesting year for those interested in the impact of Cyber Security incidents on asset valuations. $350 million (7.2%) was wiped off Yahoo’s purchase price after it disclosed several Cyber Security incidents during its acquisition by Verizon. And Muddy Waters Capital shorted the medical implant manufacturer St Jude Medical (STJ) before releasing information about several serious security vulnerabilities in its core pacemaker products. The St Jude stock dropped over 10% intraday, and Muddy Waters Capital ended the year with a 16% gain.

The impact of Cyber Security incidents on asset valuation is clearly of interest to our clients, and these two examples would seem to suggest a strong correlation. However these are isolated incidents in a small sample size and so care should be taken in drawing such conclusions.

Several studies have looked at larger sample sizes aiming to provide more definite insights. One, “Market Implications of Data Breaches” concludes that there is a small impact in the first 3 days after a breach (-1.13%) which by day 14 has fully rebounded. Another, “The Cyber-Value Connection” concludes that companies suffer on average a 1.8% decline in share price, but this impact is permanent. Going further, “The Impact of Data Breaches on Reputation and Share Value” suggests that the immediate impact on share price is actually closer to 5%.

There is a lack of full consensus here, and it should be noted that the reports with the more headline grabbing conclusions were sponsored by security technology providers. (see “Cyber attacks knock millions off FTSE share prices”)

Sidestepping the sensationalism, all three do agree on one aspect however – that initially share prices drop, and in some cases quite significantly. The Lange and Burger study, which appears to be the more thorough of the three, also suggests that these losses are subsequently fully recovered. This fits well with the typical news cycle of a Cyber Security incident. Initially little is known, and the market expects the worst. Over time, as more information is released and the impact can be fully assessed, it is often determined to be less critical than initially feared.

The Lange and Burger study adds one further interesting conclusion. If a Cyber incident impacts a company’s core business, for instance if a VISA payments processor loses a significant number of credit card details, the resultant impact on share price can be catastrophic. Clearly Muddy Waters Capital understood this when they shorted St Jude:

“Muddy Waters Capital is short St. Jude Medical, Inc. (STJ US). There is a strong possibility that close to half of STJ’s revenue is about to disappear for approximately two years. STJ’s pacemakers, ICDs, and CRTs might – and in our view, should – be recalled and remediated.”

This returns us to traditional methods of asset valuation; analysis of damage to revenue streams, and the impact of Cyber Security incident cost on profitability.

Usefully the Ponemon Institute produce a yearly study of the cost of Cyber breaches . For those wanting a fuller understanding I would very much encourage reading the report in full, however for now two of the key take-aways are:

- Costs per country vary, with breaches in the US being 3.4 times more expensive than breaches in India and Brazil for example

- Costs per industry vary, with breaches in Finance being 1.7 times more expensive as in retail, and in Health 3.5 times more expensive.

Amongst other factors, Ponemon attributes these large discrepancies to the relative strength of regulation in the various countries and industries - e.g. highly regulated industries like Finance and Health are likely to incur greater costs. Bearing this in mind we can surely expect Cyber incident costs to rise in the EU and UK due to the introduction of GDPR, and it might be wise to take this into account when analysing portfolios for Cyber security risk.

An understanding of cost, however, is only half the equation, and needs to be seen in the context of turnover and profit. Clearly companies with larger turnovers and profits can absorb Cyber Security incident costs better than those with smaller turnovers and profits.

The infamous Talk Talk incident of October 2015 provides a clear example of this. The breach was estimated to have cost £60m, against a backdrop of operating profit of only £54m the previous year. This was one of the factors that led to a share price slide of 19%.

Another contributing factor to the share price slide was that this was the third incident that Talk Talk had suffered that year. This pointed to a very serious failure in Cyber security governance and insufficient Cyber security defences. Both the Ponemon IBM report and the Ponemon Centrify report also highlight poor Cyber Security governance, Cyber defences and lack of incident response capabilities as aggravating factors to increased cost / negative share price impact, and clearly this factor should not be overlooked.

All together this points to a far more sober analysis of Cyber Security impact on asset valuation than some headlines would suggest. In conclusion there are five key factors that should be considered:

- There is little direct correlation between Cyber security incidents and long-term asset values

- Initial impacts to asset value may be overstated and often prices recover in the medium to long term

- Traditional valuation models, which analyse the impact of Cyber incident costs on current and future earnings, are useful tools in determining value impact

- Cyber incidents that directly impact the core business, and hence turnover, will have a much greater effect on value than those that do not

- The Cyber Security maturity of an organisation – its ability to detect, respond and contain a Cyber incident – makes a material difference to the level of impact of an incident on asset value

And lastly one final point. If a company suffers a serious Cyber Security incident during a deal, as Yahoo did, there may be little or no time to recover from the initial impact and the sale price could be significantly affected. Strategies to prevent this occurring are therefore strongly advised!