Equifax’s core results prove hack-proof

Soon after Equifax Inc. disclosed in early September that a data breach had exposed the private financial information of 145 million Americans, some advocated that the credit-reporting agency be shut down. At the very least, many thought, it would suffer some financial repercussions. Instead, Equifax reported its second-best quarter ever based on sales and its preferred measure of profits.
In the company’s first quarterly report since the hack and the departure of its longtime CEO Richard Smith, earnings rose 7 percent, or $12 million, to $184 million after excluding a charge related to the hack and some other one-time and noncash expenses, with as much as a third of that most likely coming after it disclosed the breach. Sales rose and were $835 million, or just 2 percent below the range in revenue that the company predicted in late July, two days before the company received the initial indication that it had been hacked.
Equifax’s ability to increase its operating earnings during one of the most disastrous quarters, at least operationally and reputationally, in its history, or the history of most companies, really, attests to how entrenched the business is in the financial system. That will most likely add to the frustration of consumers and their advocates.
It also underscores the core incentive problem underlying the hack. Equifax’s cybersecurity costs and expenses related to the hack are climbing now, but without any serious financial jeopardy, the incentive to protect against future breaches, especially minor ones, dissipates. Remember, Equifax had been the victim of a number of smaller hacks before the one that made headlines.
Equifax’s business is collecting information on consumers that lenders, landlords and others can use to make a judgment about the reliability of borrowers, renters and, increasingly, employees. But the consumers whose financial information was stolen and who were put at risk are not Equifax’s customers. They are the banks, landlords and others that use its data. And while consumers were clearly upset about the hack, Equifax’s results show that its real customers were not angry enough to stop using the company, at least not in any meaningful way.
The main reason is that the structure of the relationship benefits everyone but the consumer. The existence of Equifax and the other credit-reporting agencies means that banks don’t have to collect and keep the information on their own. It also means they can deflect some consumer anger when a borrower is rejected for a loan. The banks point the finger at the credit-reporting agency, which consumers don’t get to choose.
Even the relatively small part of Equifax’s revenue that it does generate from selling products to consumers wasn’t hurt seriously. Revenue in that division was basically flat from a year ago, in part because Equifax sells those services through third parties without its name attached.

—Bloomberg