7 ms·
For some context about CWT (I was curious about these figures) -- via Wikipedia[1]: * US$1.5 billion in revenue * 18k employees For a firm like this, the paym
by nlh 6y ago
For some context about CWT (I was curious about these figures) -- via Wikipedia[1]:
* US$1.5 billion in revenue
* 18k employees
For a firm like this, the payment probably amounts to a small uptick in a small portion of their IT budget and won't even come close to hurting them (and, frankly, neither would the $10m figure).
It's insane that this is the case and that companies are willing & able to pay ransoms like this, but the hackers were right - the payment is much less than lost business, bad PR, etc. if the actual information had leaked. Such is where we are.
[1] https://en.wikipedia.org/wiki/CWT_(company) https://en.wikipedia.org/wiki/CWT_(company)
- stu2b50 6y agoI don't know about that. For one, travel margins are not exactly the same as SaaS margins. Secondly, there's the global pandemic and all, kinda hurts the free cash of most travel companies. I wouldn't be surprised if they genuinely would have trouble coughing up 10 million two days after the attack hit.
- nitrogen 6y agoCWT is used by corporate travel systems. I'd expect their margins to be similar to enterprise software vendors, rather than other travel agencies.
- rs41 6y agoIt depends if they report revenue gross or net. If it is gross that means they recognize all booked travel as revenue (and earn a margin on top of that) instead of just recognizing their fee as revenue. In that case it would be much worse margins than a mature SaaS company. If I had to guess based on the figure, I would guess gross but I'm not sure.
- nlh 6y agoSorry I should have clarified -- according to Wikipedia, they had $1.5 billion in actual net revenue by processing $23 billion in transaction volume (aka GMV).
- namdnay 6y agotheyr'e what we call a travel management company ( = travel agency + software solutions). Their margins are close to the travel agency though, that represents the vast majority of their revenue. They're particularly exposed to business travel, so even worse for them at the moment
- paulcole 6y agoDoes that revenue include pass-through?
- ununoctium87 6y agoIs the ransom tax deductible?
- cure 6y agoI don't see why not. Business expense?
- SilasX 6y agoIsn’t stuff stolen in a theft/robbery deductible generally?
- lgregg 6y agoThe ransom payment isn't really a theft or robbery, they didn't have to give it.
- SilasX 6y agoIf you’re mugged, you don’t “have to give” your wallet either, but you were coerced by an external party.
- lgregg 6y agoI would argue those are different things because there was the threat of violence in the case of a mugging.
- deleted 6y ago[deleted]
- pjc50 6y agoAt the bottom of the thread the ransomers gave them security advice. Therefore this is an "unplanned penetration test" and gets filed as "consulting" on the expenses side of the accounts. Almost all money going out of a business can be deducted from money coming for purposes of counting taxable profit. I'm having a hard time thinking of one that isn't.
- tootie 6y agoIt doesn't matter how big your company is, every penny still gets counted. This will come out of some department's budget and have an adverse impact on operations or even cost them some employees. Hopefully whoever was auditing their security.
- elliekelly 6y agoFor all we know their security folks have been warning about something like this and have been pooh-poohed by senior management for years. Sometimes the auditors can only lead the horse to water.
- nkrisc 6y agoIt might over time. If I was deploying ransomware, the first thing I would do after receiving a ransom payment from a company would be to try them again in a month or two.
- HenryBemis 6y agoAnd if you don't 'visit' them in a month or two, someone else like you will visit them. Now they know their security is crippled, there is no way the patched all holes (system, process, operations) in such a short notice, and we know they can be blackmailed and pay big money. The only way to mitigate this risk is actually walk the walk (implement appropriate security controls).
- Dylan16807 6y agoWell if they care about money at all they'll have at least one good backup by then.
- mirekrusin 6y agoThey'll sack somebody for this for sure, it'll offet it.
- TheJoeMan 6y agoWell I hope they get fined by the US Government for negotiating with terrorists