Please ensure Javascript is enabled for purposes of website accessibility

The Time Bomb Ticking on Staples' Balance Sheet

By Rich Duprey - Sep 22, 2015 at 4:24PM

You’re reading a free article with opinions that may differ from The Motley Fool’s Premium Investing Services. Become a Motley Fool member today to get instant access to our top analyst recommendations, in-depth research, investing resources, and more. Learn More

The office supplies retailer may have bigger problems than its merger deal potentially falling through.

The data breach of retailer photo processing sites managed by a Staples-owned third-party vendor could be a costly affair.

Forget Staples' (SPLS) merger with Office Depot getting new scrutiny from antitrust regulators that could derail the deal. The office supplies retailer has another time bomb ticking away on its balance sheet that's just as serious, and could be ready to detonate.

PNI Digital Media is the third-party photo processing service for retailers like Costco, CVS Health (CVS 1.10%), and Wal-Mart whose database of customer account information was hacked this past summer. It caused the retailers to scramble to take down their sites and warn customers that their credit card information may have been compromised.

Despite initial expectations that the service would be restored quickly, full functionality has been delayed, and CVS updated its notice the other day to confirm that there was "an illegal intrusion into PNI's system that potentially resulted in the unauthorized acquisition of data entered by certain users on"   

The problem for Staples is that it bought PNI Digital Media for $67 million last year. It undoubtedly seemed like a simple way to generate additional incremental revenue at a time when sales of paper, pencils, and copies were still sluggish, but the hack may have turned the acquisition into a major liability.

A roster of big customers
The breach was first reported in July by web security site Krebs on Security, which noted CVS had taken down its website soon after Walmart Canada had similarly warned that data from its site had been compromised after its third-party vendor was attacked. Krebs reported PNI Digital Media had listed CVS, Wal-Mart, and Costco as customers on its site, but soon scrubbed all mention of them as news of the attack spread. Like dominoes falling, other retailers began warning their customers of the breach as well.

Although the full extent of the damage wrought by the hack is still unknown, Staples is preparing for the worst. In last quarter's earnings report, the office supplies retailer said the costs associated with the attack aren't material to its finances yet, but it expects that losses in the future are probable and "may be material to our results of operations and financial condition."

The question for investors is just how "material" it could get.

Some of the biggest retailers partnered with Staples' photo processing service, PNI Digital Media. Image source: m01229.

It's not going to be cheap
One study suggests it might not be much, as many companies reporting breaches have said that actual expenses amounted to less than 1% of annual revenues. But others say it could get very pricey indeed.

According to an annual study by IBM and the Ponemon Institute of data breaches, the average cost to a company was $170 per record last year, a 7% increase over 2013. But that's globally. In the U.S., the cost is $217 per record, up from $207 the year before. It also depended on the type of industry that was hacked (retail saw the most dramatic increases in costs, up 57% year over year) and how many records were compromised. 

Target's (TGT -0.81%) massive credit card breach in 2013, that it's still getting out from under, has so far cost it $264 million in cumulative expenses, though they've been offset by $90 million in reimbursements from its insurance policies, for a total of $174 million. 

That's a mere pittance since it earned $2.5 billion on continuing operations last year, but there are more costs to come. Earlier this year, Target settled, for $10 million, a number of class action lawsuits related to the breach, and just a few weeks ago, it settled a lawsuit brought by Visa (V 1.94%) for $67 million. 

But only a few days ago, a federal judge certified another class action lawsuit that was brought by banks affected by the breach, and it failed to get enough financial institutions to sign up for the settlement it had reached with MasterCard (MA 2.11%)

According to the Congressional Research Service, Target could be also liable for as much as $1.1 billion in fines from the Payment Cards Industry Council based on the amount of fraudulent charges made with compromised cards (though others say it could be as little as $240 million).

Home Depot (HD -0.99%), which suffered an even bigger breach than Target last year, has so far incurred $232 million in expenses related to it, $100 million of which has been reimbursed by its insurers. Still, expenses remain ongoing, and it's apparently reached the limits of its liability policies.

Cut the red or blue wire?
So, for Staples, which recorded just $135 million in GAAP operating earnings last year, it's easy to see why, even though the expenses for Target and Home Depot weren't considered material to their financial health, the office supplies company is saying the risk to its own operations may be substantial.

Despite the discovery of the breach being some 2 months old now, there's really not much information available regarding the extent of the damage the breach at CVS, Costco, Wal-Mart, and the others -- or its breadth. But because of PNI Digital Media's extensive customer list, it remains a situation that could blow up in Staples' face just as its merger effort implodes.

Invest Smarter with The Motley Fool

Join Over 1 Million Premium Members Receiving…

  • New Stock Picks Each Month
  • Detailed Analysis of Companies
  • Model Portfolios
  • Live Streaming During Market Hours
  • And Much More
Get Started Now

Stocks Mentioned

Staples, Inc. Stock Quote
Staples, Inc.
The Home Depot, Inc. Stock Quote
The Home Depot, Inc.
$284.90 (-0.99%) $-2.86
Wal-Mart Stores, Inc. Stock Quote
Wal-Mart Stores, Inc.
$119.50 (0.36%) $0.43
Target Corporation Stock Quote
Target Corporation
$152.18 (-0.81%) $-1.25
Costco Wholesale Corporation Stock Quote
Costco Wholesale Corporation
$419.42 (-0.83%) $-3.51
Mastercard Incorporated Stock Quote
Mastercard Incorporated
$339.24 (2.11%) $7.01
Visa Inc. Stock Quote
Visa Inc.
$201.20 (1.94%) $3.83
The ODP Corporation Stock Quote
The ODP Corporation
$40.05 (-1.72%) $0.70
International Business Machines Corporation Stock Quote
International Business Machines Corporation
$129.09 (-0.44%) $0.57
CVS Health Corporation Stock Quote
CVS Health Corporation
$94.17 (1.10%) $1.02

*Average returns of all recommendations since inception. Cost basis and return based on previous market day close.

Related Articles

Motley Fool Returns

Motley Fool Stock Advisor

Market-beating stocks from our award-winning service.

Stock Advisor Returns
S&P 500 Returns

Calculated by average return of all stock recommendations since inception of the Stock Advisor service in February of 2002. Returns as of 05/20/2022.

Discounted offers are only available to new members. Stock Advisor list price is $199 per year.

Premium Investing Services

Invest better with The Motley Fool. Get stock recommendations, portfolio guidance, and more from The Motley Fool's premium services.