Description

Thesis

Equifax is a great business recovering from a crisis. Although the stock has rebounded from the bottom, I still don’t think today’s price reflects normalized value due to institutional fear of owning such a controversial name. As the market gains comfort regarding the costs of fines/lawsuits, incremental IT spend, the earnings drag from the decline of the direct Global Consumer unit, and market share resilience in core USIS, the International and Workforce Solutions units, which were unaffected by the hack and the key growth drivers, will continue to grow EBIT over 12%. Add in a buyback of around $1.2 billion and a 25% consolidated tax rate and I project $7.45 of earnings in 2019. At 22x EPS, EFX’s pre-breach multiple and a 1x premium to Experian, I get a ~$164 target for the end of 2018 for 40% upside.  

The Breach

At the end of July, Equifax found that its consumer database was breached through a customer dispute portal, giving hackers access to Social Security Numbers, birth dates, addresses etc. on 145 million Americans. The company’s initial response was a clinic in how NOT to deal with a crisis. They didn’t announce the incident until September 7, more than a month after they learned of the breach, many insiders were accused of selling shares before they disclosed the breach to the market (subsequent investigations show they were selling before they knew about the breach), the free credit service that they offered to remedy the situation didn’t work well and customer call centers were overwhelmed. This culminated in Congressional hearings that threatened the entire industry. Ultimately, those hearings were inconsequential, and Equifax fired its Chairman/CEO, head of security and head of technology, and offered one year of free identity theft protection and monitoring on an improved product. Although we have more clarity regarding the effects of the breach than we did in September there are still four key overhangs that are depressing the stock:

Four Overhangs

Lawsuits/Regulation

Before the Congressional hearings, some were concerned with the prospect of additional regulation or even nationalization of the consumer credit bureaus. However, essentially nothing has come out of those hearing and the more time that passes before the next breach, the less likely there will be any change. Most Congressman understand the importance of easy credit to their constituents and recognize the role the consumer credit bureaus play in credit expansion. Furthermore, I’m not sure how centralization by a government bureaucracy would improve security and Republicans are against expanding the government’s role in the economy. I assume no meaningful new regulatory burdens, which I think is what the market is now assuming.

Another concern is the potential costs of government and class action lawsuits on Equifax. I estimate a total of $600 million of pretax settlement costs in 2018, $300 million to settle with governments and $300 million to settle a potential class action lawsuit. The most comparable government settlement is the breach of Anthem in 2015, which exposed the social security numbers and medical records of 79 million Americans. The government settled for $115 million. A proportional settlement for Equifax’s 145 million hacked records would cost $211 million. Given that medical records are less common on the dark web than social security numbers it may be conservative to assign the same value per person to the information lost by Equifax as what was lost by Anthem, and I am assuming almost $100 million on top of that value. The other potential liability is from class action lawsuits. These have not yet been consolidated. My conversations suggest this will be a difficult case for plaintiffs given that there is often a lag between a hack and the exploit of the information. As a result, it will be difficult for plaintiffs to prove that any damages were caused by information lost in the Equifax breach as opposed to the many other breaches that exposed the same information. Furthermore, only 2% of consumers have frozen their Equifax credit since the breach suggesting there hasn’t been an uptick in crime (at least not yet). Most lawyers I’ve spoken to think a number closer to $150 million is more likely, but I assume $300 million to settle the class action lawsuit. If these cases can be settled for ~$600 million or less, which I think is likely, the liability is easily manageable within the company’s free cash flow and will enable a buyback of $1.2 billion in 2019 without increasing leverage above 2x net debt/EBITDA.

Global Consumer Revenue Loss/Incremental Costs

Another concern is the lost revenue/profitability from the global consumer division, where the breach occurred. Fortunately, the direct portion of the consumer division (the Equifax website) was the slowest growing segment of the company and accounted for less than 5% of company EBITDA in 2016. I assume revenues get cut in half in the direct segment over the next three years, and only account for 1% of total EBITDA. Even if the slowdown is much worse than that, costs for this segment are almost entirely variable, meaning the hit to profitability will be relatively small and likely be offset by greater revenue through indirect channels. In meetings with the company, I got the impression that shutting down this division in the next three years would not be that unlikely. This would have a negligible affect on company EBITDA but significantly reduce liability to future hacks.

Incremental Cybersecurity Costs

A third concern is the incremental cost to improve cyber security. One offset to this is that EFX has cyber insurance estimated to cover $100-150 million of breach response costs. In terms of ongoing security expenses, I assume ~$60 million of additional yearly costs. EFX says they spent 12% of IT budget on security before that hack (they say this was in the middle of the range of competitors). If the company spends 5% of sales on IT costs, security spend would be ~$20 million pre-hack. Therefore, $60 million would represent a tripling of annual cybersecurity spend. My guess is this would put them at or very close to the highest cyber security spending company among their peers, which is probably what they want to announce in their next conference call to reassure regulators and investors. While this represents a big increase in spending within the category, it is still a highly manageable cost in the context of around $1.1 billion of EBITDA in 2017.

Market Share Loss in Other Units

A final concern is that even though the hack was in the Consumer unit, customers in USIS, Workforce Solutions, and International will alter spending due to security concerns. One area where this seems to be likely to occur is the Financial Marketing Solutions subsegment of ISIS, which represents about 7% EFX sales. Most of these projects are discretionary in nature, so it would be reasonable for customers to either delay projects until they feel EFX security concerns are out of the spotlight or give the projects to competitors. I assume sales in this subsegment decline ~10% in 2018 to account try to for this.  However, I believe customers are unlikely to switch providers in other segments because the services are more embedded in customer workflow, many customers would be required to notify regulators in each state in which they operate before they change data providers, and Workforce Solutions and many International products are less competitive/more differentiated. Furthermore, Equifax has said that they have not seen any share loss outside of the Consumer segment and both Transunion and Experian have told me that they have not seen share gains as a result of Equifax’s breach.

Valuation

I project $7.45 of EPS in 2019 on EBITDA just above consensus. At 22x earnings this yields a ~167 stock price, for 40% upside. I believe 22x is justified because (1) EFX traded at this multiple before the breach and up to 24x in 2016 (before tax reform was semi-priced in), and I don’t think the breach has really changed the normalized value of the business (2) EXPN is trading at 21x and EFX traded around 2 turns higher for the past three years (3) Transunion is trading at 26x. TRU is growing faster and is more domestic so it gets a bigger boost from tax reform but I’m still leaving a 4 turn gap (4) intrinsically, this is very good business with ROA ~10% in normal environments, minimal capex requirements, free cash flow greater than net income, MSD organic revenue growth and double digit EPS growth. I think this should trade at a premium to the market.

Business Segments

For those less familiar with Equifax, the following section describes the business in greater detail. Equifax has four business segments with multiple subsegments within each:

USIS (~42% 2018 EBIT, -5% growth in 2018, +6% in 2019)

USIS includes three subsgments:

·       Online Information Solutions (~75% of USIS sales) provides credit history, payment status, address information etc. to lenders regarding potential or existing borrowers. Essentially, whenever a consumer gets a mortgage, auto loan, credit card application, or opens a new utility, the lender will use data aggregated by Equifax or a competitor to help determine whether or not to extend a loan and at what rates. For basic information like credit history, the data is typically provided by the banks for free in raw form and then aggregated/analyzed by the credit bureau to sell back to lenders.

·       Mortgage Solutions (~18% of USIS sales) provides tri-merged reports for mortgage lenders, which combine information from the three credit bureaus (this industry is a triopoly with Experian and Transunion being the other two players) into one report to help mortgage lender underwrite risk.

·       Financial Marketing Solutions (~13% of USIS sales) uses credit, net worth, and other data to helps customers market products. For example, a bank marketing a new high end credit card could target customers with net worth over $10 million and send marketing information to particular streets where customers fill that profile.

·       Online Information Solutions and Mortgage Solutions products are embedded in lender workflow and more recurring in nature (as long as credit is expanding) while Financial Marketing Solutions revenue is more discretionary and lumpy. Given its discretionary nature, Marketing Solutions is one of the subsegements most affected by the breach as customers have delayed, and may ultimately cancel, projects if they don’t gain comfort with Equifax security protocols or the reputational headache of associating with Equifax.

Workforce Solutions (~32% 2018 EBIT, growing ~12%)

This is a crown jewel asset and key growth driver that Equifax acquired for $1.4 billion at the beginning of 2007. It is still underpenetrated within the US, is beginning to expand internationally, and is built off of a unique database. The larger subsegments, Verification Services (~66% of segment sales) provides employment status and income information to lenders through the Work Number, which has over 300 million current and historical employment records. 7,100 organizations, including three quarters of the Fortune 500, freely contribute payroll information to the database to reduce the administrative burden of verifying employment for lenders, while lenders pay per transaction to obtain data for loan approval, underwriting, and ability to pay requirements. The other subsegment, Employer Services (~33% of segment sales), uses data contributed to the Work Number database to help companies reduce unemployment tax liabilities, access employment related tax credits, and comply/digitize W-2, W-4, I-9, and ACA processes (less than 5% of sales is ACA related). Management has said that this segment has been mostly unaffected by the breach.

International (~18% 2018 EBIT, growing ~13%)

The International segment provides similar services as USIS in international markets and is the other key growth driver for Equifax. Current EBIT margins (~20%) are about half of USIS margin due to rapid investments for growth. However, because the three credit bureaus are expanding in different geographies, the markets are less competitive, which should enable margins to grow over time. Europe (~30% of segment sales) includes sales from the UK, Portugal, and Spain. Latin America (~25% of segment sales) operates in Argentina, Chile, Costa Rica, Ecuador, El Salvador, Honduras, Mexico, Paraguay, Peru, and Uruguay. The Asia Pacific subsegment  (~30% of segment sales) operates in Australia and New Zealand. Canada accounts for the rest at about 15% of segment sales. Management has said that this segment has been mostly unaffected by the breach.

Global Consumer (~8% 2018 EBIT, -11% growth in 2018, +15% in 2019)

Although Equifax doesn’t divide this into subsegments, this really includes two subsegments. The indirect subsegments resells consumer data to companies like Credit Karma, where consumers can get credit reports for free. Using information from conversations with Equifax and Transunion, I estimate about ~2/3 of EFX Consumer EBITDA was from indirect in 2016. The Direct subsegment, includes a credit check/monitoring services on Equifax.com. This is where information was breached. I estimate it was responsible for about 1/3 of segment EBITDA, and less than 5% of total company EBITDA, before the breach. Even before the breach, the indirect subsegment was the faster growing and higher margin subsegement and management was beginning to deemphasize the direct subsegement.

Risks

·       Chipotle scenario. If there were another large hack in the next 3 years, whether on Equifax or one of its direct competitors, this would cause regulators to get more serious or at least cause the market to think more regulations/fines are coming. You can hedge most of this risk by shorting one of the competitors or you can just hope the increased security spending and no bad luck keeps you protected. If there is another hack I will quickly move on.

·       Higher interest rates without accompanying real growth. 18% of the business is mortgage related. Fewer refinancing due to higher interest rates would hurt the business. Higher interest rates caused all of the consumer credit bureaus to fall at the end of 2016. However, if real growth increases at the same time that interest rates rise, other areas of the business would probably offset a refinance slowdown. For example, purchase mortgage originations, which are below 2004 levels despite a bigger population, may increase.

·       Recession. This is a procyclical business with exposure to auto, mortgage, and general credit expansion. In 2009, organic revenue declined 6% and EPS declined 12%.

Catalyst

·       Q4 earnings call. Management has deferred answering many questions regarding incremental IT and regulatory costs to the Q4 call. Less uncertainty regarding these costs will be helpful. Management could also create more clarity regarding how much share loss the business will experience outside of the consumer segment. Certainty regarding incremental spending/liability/share loss could help the multiple expand.

·       Legal settlements under $600mm.

·       Share buyback. If the fines/lawsuits are settled for $600 million or less, EFX will have lots of cash building up on the balance sheet (which is what the sell side is modeling). I project that once the lawsuits are settled, EFX will begin a $1.2 billion buyback in 2019, which would keep net debt half a turn below the 2.5x EBITDA that’s typical for the business.