Equifax's Wide Moat Intact After Data Breach

We have decreased our fair value estimate as we incorporate the potential impact of the data breach, which we think will include a substantial fine, one-time resolution costs, and longer-term costs to improve security. However, we think the wide economic moat that surrounds the business is intact and will limit long-term damage.

The information accessed includes names, Social Security numbers, birth dates, addresses, and driver’s license numbers. Further, credit card numbers for about 209,000 consumers and dispute documents for about 182,000 consumers were accessed. Equifax has established a website that consumers can check to see if their information was compromised, and it has offered to provide its identity theft products free to consumers for one year.

In our view, the potential costs to Equifax fall along three lines. It is highly likely that the company will have to pay a substantial fine, but historically, fines for these matters have been manageable. Additionally, the company will probably incur near-term costs related to resolving the impact of the breach and give up some revenue from its identity theft products; it could also endure longer-term costs to beef up security. These costs could be material but are likely to be fairly limited.

The biggest risk, in our view, would be that the blow to the company’s reputation affects the wide moat around its business. However, we believe that Equifax’s entrenched oligopolistic position in its core credit bureau business is unlikely to be affected. We note that while the company provides consumer information, its customers are consumer lenders, who will not be directly affected by this event.

We do see potential for this breach to slow growth in the company’s more nascent workforce solutions segment. In this segment, Equifax’s employment verification business relies on companies being willing to provide sensitive employee data, such as annual compensation. The demonstrated weakness in its security measures could give employers pause on this front.

Pursuing Growth Through New Markets, New Businesses Limited competition in its core credit bureau business allows Equifax to enjoy healthy margins, but the maturity of its core business restricts potential growth, so the company has been expanding through acquisition into new geographies and new lines.

Equifax’s biggest move in recent years has been the buildout of its workforce solutions segment, which now accounts for a little more than 20% of revenue and has been performing well recently. We think the employment verification part of this segment is the moatiest. Given the need to persuade businesses to provide this sensitive information, we believe the business benefits from a first-mover advantage that will allow it to establish strong barriers to entry. In general, we have a negative view of the expansion away from the credit bureau business, but we appreciate that management has limited itself to businesses with similarly attractive economics. Growth in this segment has been fairly strong and margins have improved significantly as the business has scaled, trends we expect to continue. However, we believe that the boost this segment has recently seen from services related to the Affordable Care Act will prove temporary, and growth will slow.

We think the most value-creative expansion opportunity lies in emerging markets, where growing middle-class populations will allow Equifax and the other leading providers to export their business model as consumer finance markets grow. But Equifax has been outperformed historically in this area by its larger peer Experian EXPGY, and opportunities are somewhat limited, given the set of conditions necessary to establish operations. The largest targets are largely already realized (Brazil, where Experian holds a dominant position) or distant (India, where building a database from scratch will take many years), and we think the near-term opportunities are in smaller countries that won’t move the needle. Additionally, currency and macroeconomic headwinds have been muting recent results. Still, the company recently made a major acquisition in Veda, which will provide it with a solid base in Australia and could open other opportunities in the Asia-Pacific region.

Credit Bureau Business Has High Barriers to Entry We think a wide moat surrounds the credit bureau business. Equifax's data is critical to users' underwriting decisions, and the price of the company's services is very small relative to the loan amounts at risk. We estimate that North American credit bureau industry revenue equates to about 1.5 basis points of total household debt. With only three meaningful players domestically and many clients using more than one credit bureau, Equifax and its competitors have little incentive to compete on price, which has led to operating margins that have averaged 40% during the past five years for Equifax in this segment. There is a stable oligopolistic structure to the industry, and we think there are high barriers to entry surrounding this business, as replicating the databases of Equifax, which has more than a century of information, and its main competitors would be incredibly difficult, and users are more concerned about the quality and accuracy of the data than the price. We think the strength of this intangible asset supports a wide economic moat for the business as a whole.

While Equifax has expanded from its credit bureau roots, we give management credit for staying in areas with attractive economics. We believe the company’s employment verification business has the potential to be as moaty as its credit bureau operations over time. This business relies on employers to provide salary information on its employees, and we think companies will be reluctant to work with multiple providers. With its head start, we think this business is poised to benefit from significant barriers to entry over time; margins have already increased to a level on par with its legacy operations.

Security Breach Not the Only Risk Equifax is exposed to the amount of mortgage and other credit applications; a tight credit market could reduce demand for its information. A security breach in Equifax's systems could damage its reputation and expose it to legal liability. Regulatory changes could limit Equifax's ability to monetize its database and increase its costs. Equifax relies on third parties for much of its data, and its business could be disrupted if it lost access to key data suppliers. Equifax generates a significant portion of its revenue internationally, generating currency risk. It typically does not hedge this exposure, which could add volatility to the top line.

Because Equifax’s business is not capital-intensive, the balance sheet structure is largely at management’s discretion. We think management has been fairly conservative with its balance sheet structure over time. Leverage has typically increased after acquisitions, with management reducing debt fairly quickly afterward. The acquisition of Veda materially increased leverage to the high end of the historical range. We would expect a reduction in leverage to be the primary use of cash flow in the near term.

Previously, Equifax had to consider an unusual agreement with Computer Sciences that gave the latter company the option of selling its credit reporting business to Equifax at any time through August 2013. Equifax bought this unit for about $1 billion in December 2012. This removed a potential point of uncertainty, but longer term, it could lead to a more aggressive stance toward leverage, as management no longer has to maintain liquidity to meet this event.