4 ms·
This isn't really true. Stock price is not an indicator of a company's "bottom line". As someone who helps respond to major breaches at big companies, these ty
by awsthro00945 5y ago
This isn't really true. Stock price is not an indicator of a company's "bottom line".
As someone who helps respond to major breaches at big companies, these types of breaches often result in enormous expenditures on company-wide efforts to close security gaps or revamp processes. Either a regulatory agency, or more often the company's board of directors, will make a mandate to the C-suite that something must be done. Some of these expenditure campaigns are low-visibility, some even to the employees of the company, and they are usually not very sexy or noteworthy, so you won't read about them on the front page of CNN but they do happen and they are very costly to the company (in the ballparks of tens to hundreds of millions of dollars).
I do think there should be harsher punishments in the form of fines, etc. But to say that there is "zero impact" just isn't true.
- atatatat 5y agoShare price doesn't regularly continue to go up while profits continue to contract.
- genmud 5y agoDude, if you look at Equifaxes and Solarwinds EBITDA/earnings statements following their respective breaches, you will clearly see that there has been no major impact to their bottom line. Sure, expenses rise a bit for a short period of time, but these are not catastrophic by any means. I mean, I'm looking at Solarwinds last earnings statement and comparing quarters from last year to now, they are up about 3.5% in revenue (3/31/2020 vs 3/31/2021).
- CyberRage 5y agoThat doesn't mean anything. in such a year their products should have flown off the shelves. Remote monitoring\management? in COVID year? just 3.5% that's horrendous
- faeyanpiraat 5y agoAre you sure about that? The customers who had experience with remote work and already knew that SW products would help them in this situation was a fixed number. The number of companies who had no clue about how to do remote work, and after haphazardly had to switch to it may still have no idea that you need to use products provided by SW. Also do you really need any of that to do remote work? Of course not.
- CyberRage 5y agoI'm sorry but I have pretty good info about SW. I can tell things are rough there. More than anything, it proved that their model is flawed. Just the number of gov agencies that are forced to stop working with them is a major blow.
- faeyanpiraat 5y agoYou missed my point. I agree they are not doing well, but I also do not see why they should’ve, even if the breach didn’t happen.
- awsthro00945 5y ago>Dude, if you look at Equifaxes and Solarwinds EBITDA/earnings statements following their respective breaches, you will clearly see that there has been no major impact to their bottom line. I'm looking at Equifax's 2018 statements right now. With Operating Revenue of $3.4 billion and profits of $850 million, they had $400 million of expenses related to the breach. "No major impact" my ass.
- karmelapple 5y agoRoughly 10% of revenue is something, but not that big of a deal, especially since their overall revenue is up. Don’t you think stronger consequences than that should happen when a company unintentionally discloses tens of millions of people’s personally identifiable information that has been collected without any particularly explicit permission given by those people? Credit agencies hold a special place in the US economy, and when they messed up this badly, the team threat of some near-going-out-of-business level consequences seem like the only way to truly get other companies to take this seriously. Especially considering that there are other credit agencies in the country - they don’t have a monopoly on this.
- chillwaves 5y agoTheir business model is weaponizing this information against consumers. They work for the businesses that do lending, not for the recipients of the loans. And you would think that given their one job is to supposedly safeguard this info, the consequences would be more severe or we would re-think this entire business model of consumer credit, but our society is not capable of that kind of consumer advocacy. Likely due to some powerful interest's bottomline.
- genmud 5y agoIf you compare year over year, many of the things they attribute to the breach are actually just IT/overhead costs they were able to shift to a loss. If you look at their EBITDA, everything is essentially static. In the grand scheme of things, it really isn't a huge impact to them. Lets say you are a CEO: If you underspend on technology/security by ~50-100m/year, for 5 or 10 years... then have a bad breach, which costs you 400m, what do you get? A: A Ferrari, because you saved the company 500m dollars and got a cyber insurer to pay for your technology/security program. I'm not even joking you, I have been in meetings with a CEO, CIO and CISO, where they literally joked around that they should have more breaches because they actually made money on the intrusion and that they were able to upgrade a bunch of stuff they were planning on upgrading next year anyways.
- djrogers 5y ago> they are up about 3.5% in revenue Revenue != bottom line. Bottom line is profit, ie revenue minus expenses.
- hourislate 5y agoI don't believe you. Give me an example of a company spending 100's of millions as a result of a breach. Companies understand it costs them nothing and if there is a cost it's trivial. When there is no penalty or the fine is a pittance, no company is going to spend 10's to 100's of millions. It makes no business sense first of all and secondly they can blame a foreign actor to mask their own incompetence.
- awsthro00945 5y agoSee: https://news.ycombinator.com/item?id=27719281 https://news.ycombinator.com/item?id=27719281
- quickthrowman 5y agoPlease point out some 10Q/10K filings that go into detail about these enormous expenditures related to security breaches. The SEC EDGAR database [0] is where you can find public quarterly financial statements and forward guidance from management (which will definitely mention the security breach related expenses), for every US-listed publicly traded company. Good luck! [0] https://www.sec.gov/edgar/searchedgar/companysearch.html https://www.sec.gov/edgar/searchedgar/companysearch.html
- awsthro00945 5y agoLiterally the first company I pulled up, Capital One, has this in the 2020 10-K: >During the year ended December 31, 2020, we incurred $66 million of incremental expenses related to the remediation of and response to the Cybersecurity Incident, offset by $39 million of insurance recoveries. To date, we have incurred $138 million of incremental expenses, offset by $73 million of insurance recoveries pursuant to the cyber risk insurance coverage we carry. These expenses mainly consist of customer notifications, credit monitoring, technology costs, and professional and legal support. Go look at Equifax's 2018 10-K and it has pages upon pages talking about the impact, including: > During the year ended December 31, 2018, the Company recorded $401.2 million of pre-tax expenses related to the 2017 cybersecurity incident and insurance recoveries of $75.0 million for net expenses of $326.2 million. Costs related to the 2017 cybersecurity incident are defined as incremental costs to transform our information technology infrastructure and data security; legal fees and professional services costs to investigate the 2017 cybersecurity incident and respond to legal, government and regulatory claims; as well as costs to provide the free product and related support to the consumer. For Equifax, there is also an additional $112 million (net, after insurance recovery) in breach-related expenditures in the 2017 10-K.