Could an Identity Data Breach Get Any Worse Than Equifax's?

In this MarketFoolery podcast segment, host Chris Hill, Million Dollar Portfolio's Jason Moser, and Stock Advisor Canada's Taylor Muckerman try to get some perspective on the Equifax (EFX 0.25%) data breach, which, based on the numbers and the universe of information in the hands of a credit agency, means that nearly every U.S. adult with a credit card was affected. But looking beyond the breach, Equifax has followed up with one gaffe and blunder after another. What does it all mean for consumers, the company, and, of course, investors?

A full transcript follows the video.

This video was recorded on Sept. 11, 2017.

Chris Hill: Let's move on to Equifax, because it's easy to have missed this story with so much of the coverage, and rightly so, on the storms recently. Equifax, which is the credit reporting agency, late last week revealed an enormous data breach that exposed personal information of up to 145 million consumers.

Taylor Muckerman: Basically every adult with a credit card in the United States.

Hill: Pretty much, yeah. [laughs] As we talked about on Motley Fool Money, Ron Gross found out that he was one of them.

Jason Moser: [laughs] I guess, I just think, I'm not laughing at his misfortune, because technically we all kind of got screwed here. But, over the weekend, I think I saw some stuff where, if you register for Equifax's year-long monitoring, apparently you're foregoing your rights to a class action lawsuit. Have we advised Ron of this? I feel like maybe we need to catch him after we get done taping here.

Muckerman: That and the auto-renewal, where they charge your credit card at the year's up for a new year of this service.

Hill: Yeah, the way that Equifax has handled this, they appear to have made every mistake possible. This is a data breach that happened in late July. There were three executives who sold stock before this information became public.

Muckerman: Over $1 million worth, I believe.

Hill: Right, before the stock tanked 17% in the last two days, which is what has been going on here. Yeah. They, I use this word in air quotes, "magnanimously" offer a free year of credit reporting, but as you mentioned, Jason, people very quickly found out that in the small print was, "Oh, and, by the way, you can't sue us if you sign on for this." They've got the data breach, and part of their solution is to say, "Give us your social security number, and we'll check to see if ... "

Moser: Yeah, I feel really good about including my Social Security number on your website at this point in time.

Hill: And I'm waiting for some sort of Uncle Sam knocking on the door moment here, because part of my thought would Equifax is something, and I forget who made this point earlier in the last couple of weeks when we were talking about Wells Fargo, when Wells Fargo came out and said, "Oh, by the way, it's not two million fake accounts be created, it's three and a half million." And someone made the point --

Muckerman: Hold my beer. [laughs]

Hill: Yeah. Someone made the point, if this wasn't Wells Fargo, and instead it was a small community bank, the authorities would be kicking the door in and shutting them down. And I feel that Equifax is kind of on that level here, too. I'm waiting for someone from the federal government to knock on their door and be like, "We'd like to have a conversation with you."

Moser: Yeah, I think that's distinctly possible. I'm not sure how that impacts them at the end of the day. What Equifax does, they have a fairly diverse business. We know them for basically credit reporting purposes. It's a fairly diverse business with their biggest customer accounting for about 3% of total revenue. So, they provide a lot of different services for a lot of different things. With that said, this is in the U.S. Information Services segment of the business, which is responsible for somewhere in the neighborhood of 40% of revenue, but even more than half of the company's operating profits. So, this does matter to the business. But with that said, I feel like I'm about to turn my nose up even thinking about this, but the fact of the matter is, you have to ask the question, is this an opportunity for investors? I mean, that's what we're here to do.

Hill: Shares of Equifax are on sale.

Moser: They are. Is this something where, can you hold your nose and actually buy shares of this company and feel good about it? Can you recognize that perhaps there's an opportunity here? Because, I'll tell you what, we went back through the financial crisis, and boy, I tell you, a lot of people looked at Moody's (MCO -1.58%)and were thinking the same thing. We were thinking, "Man, this business was complicit, and they need to fix something because something obviously went wrong," and you know what? That company has made it through relatively unscathed. It has rewarded shareholders. And we actually own Moody's today in Million Dollar Portfolio, and part of that is because it holds a very enviable position in what it does as a ratings agency, and it has not been displaced. If the financial crisis didn't knock this thing out, I don't know what does. So, with Equifax, it still does something that is needed, but its business isn't solely based on that, so when you look at the business itself, there's some attractive parts of the business. I mean, it's a nice top line that's growing at a reasonable rate, it produces very high margins, cash flow rich, decent enough balance sheet. Sure, there's some leadership issues --

Hill: I was going to say, how's the management? How are we feeling about the management?

Moser: Leadership is very fixable. You just get a few guys out, you bring another team in there, and who knows? I think this is something that investors at least have to take a look at, particularly if you're a value investor. I see some similar traits as to something like Moody's. I don't think it holds that same enviable position as Moody's, but it's similar. And I don't know that it's necessarily going to be displaced by this. I think we're going to have a very long trail of litigation. It's going to go on for who knows how long, it'll be quite some time. But one thing I am very sure of, data breaches will continue to happen. It just happened to be Equifax this time. It's going to be someone else next time. It just happens. If these are man-made systems, they're hackable. So, you have to look at it from that perspective, and from the investor's perspective, the stock has obviously gotten throttled in the past few days, and rightly so. And there might be more to come here. But I think you have to be at least looking at this and thinking, maybe there's an opportunity to make a little money.

Muckerman: And a year from now, they might have a lot of recurring revenue suddenly jumping onto their income statements with all these folks signing up for this free service, and still having to give their credit card number.

Hill: We have to get Ron Gross. [laughs] We have to talk to Ron.

Muckerman: We have to pipe him in.

Moser: Given his penchant for value investing, I think this would be right up his alley. I think we need to have --

Hill: You know what? That's absolutely the question. Ron is a value guy. He got hit. Is he going to be --

Moser: He could at least break even.

Hill: He could. Or he could just be so angry that he's like, "No."

Muckerman: You have to leave the bias aside.

Moser: I tell you, the other thing that's really fascinating here is, you sort of see this other narrative in that the IRS could be facing a big problem here, too, just from the perspective of fraudulent tax returns. And that's where I start to get a little bit worked up, because I'm not the biggest fan of doing my taxes, and I've just passed that on to someone else to do for me because I loathe the process from start to finish. But, if it's that easy for someone to go out there and file a fraudulent tax return, and the IRS just cuts them a check, or better yet, direct deposits that money into their account, I mean, that could be something else that really lasts for years and years. I think the IRS is another example of an institution that is really going to have to take a look at their policies, their procedures, their process, and try to figure out how they're going to overcome something like this, because I think that could be a real threat. Not just this year, not next year. Five, 10 years, this is going to be something that probably is ongoing for them.