Monday, September 25, 2017

Unfortunate timing for SEC disclosure of hacking incident

We recently looked into the massive data breach of personal information maintained by the publicly-traded company Equifax (EFX), one of the three major credit bureaus entrusted with such sensitive information.  The debacle claimed two of the company's top executives, chief information officer David Webb and chief security officer Susan Mauldin, who both resigned in mid-September.  On September 26, the company announced that its CEO Richard Smith is retiring but would act as an unpaid adviser for 90 days to help with the transition.  Mr. Smith will collect $72 million owed for this year and $17.9 million in pension and other benefits.  Fortune mischievously apportioned the $90 million payday across the customers whose information was improperly accessed at roughly 63 cents a head.

The House Energy and Commerce Committee and the Financial Services Committee have signaled their intent to hold hearings on the matter and the Senate Commerce and Finance Committees sent letters to the company demanding answers about the extent of the breach and the steps the company is taking to mitigate the damage.  Breaking with normal practice because of the scale and seriousness of the incident, the Federal Trade Commission publicly disclosed that it had opened a formal investigation of the massive data breech.  Days later, thirty-six U.S. senators asked the SEC and other federal authorities to investigate approximately $1.8 million of Equifax stock sales by three of its executives between July 29 - the day the company said it learned of the data breach - and September 7, when it was revealed it publicly.

The SEC hasn't publicly indicated if such an investigation is underway but it has definitely been out front in pushing entities it oversees to be vigilant in staying on top cybersecurity risks and candid in informing investors and other market participants of such risks.  In December 2014, the SEC released Regulation Systems Compliance and Integrity (Regulation SCI), which promulgated regulations requiring securities exchanges and clearinghouses to "take corrective action with respect to SCI events (defined to include systems disruptions, systems compliance issues and systems intrusions), and notify the Commission of such events."  Then on September 20, the Commission released a lengthy statement "highlighting the importance of cybersecurity to the agency and market participants, and detailing the agency's approach to cybersecurity as an organization and as a regulatory body."

Midway through the document, the Commission divulged that it learned last month that a hacking "incident previously detected in 2016 may have provided the basis for illicit gain through trading."  "Specifically, a software vulnerability in the test filing component of our EDGAR system, which was patched promptly after discovery, was exploited and resulted in access to nonpublic information.  Distinguishing the situation from the Equilar data breach, the Commission expressed the belief that "the intrusion did not result in unauthorized access to personally identifiable information, jeopardizing the operations of the commission, or result in systematic risk."

Although the Commission did not provide the specifics of the "incident" referenced in the document, it can pinpointed to May 14, 2016, an otherwise quiet Thursday when a sudden 20% surge in Avon Products (AVP) shares caused a stir.  The unexplained move was quickly traced to a filing by a "private-equity" firm, purportedly bidding to take Avon private, that was uploaded to Edgar, the SEC's online public filing repository.  The authenticity of the document became suspect because it was riddled with typographical errors, and also misspelled the firm's name, specifically its 3-letter acronym.  Further investigation did not turn up a PTG Capital operating in London, where it was located according to the filing, or anywhere else.  Investors quickly determined that the filing was a hoax and Avon shares plummeted to their preexisting level.  At the time, federal prosecutors attributed the episode to a Bulgarian hacker and said the culprit made a mere $5,000 from the plot.

In an editorial entitled "The SEC's Cyber Embarrassment", the Wall Street Journal took the Commission to task for dropping the news that the filing system had been penetrated - all four sentences of it - in the middle of a 4,000 word document advising publicly-traded companies and exchanges on regulatory obligations to manage and disclose cyber risks; in journalism, the editorial board deadpanned, this is known as burying the lead.  Indeed the document raised more questions than it provided answers.

Considering that the EDGAR system receives and processes 1.7 million fillings year, more frequent or widespread intrusions into it could undermine the integrity of the information and wreak havoc on investment and trading decisions.  Moreover, news of the hack of its systems might not inspire confidence in the security of the SEC's Consolidated Audit Trail that is scheduled to go online this fall after seven years of development.  If all goes according to plan, the CAT, a single, comprehensive database, will enable regulators to more efficiently and thoroughly track all trading in the U.S. equity and options markets.  U.S. financial exchange officials have warned that the system will be an inviting target for hackers.

The SEC demands that publicly-traded companies scrupulously adhere to stringent disclosure regulations, which has been facilitated in recent years by its online platforms.  After required information is made known in public filings via SEC systems, companies are not responsible for its safekeeping and integrity.  But any shortcomings in doing so will invariably be felt on the issuer side.

Robert Stead

Friday, September 15, 2017

EFX execs' untimely stock sales draw heightened scrutiny

By now everyone's aware of the Equifax (EFX) data - or security - breach in which hackers accessed the personal information (i.e., names, Social Security numbers, birth dates, addresses and, in some instances, driver's license numbers) for up to 143 million people in the U.S, per the press release attached to the company's 8-K filed with the SEC on September, 7.  The unidentified culprits also stole credit card numbers for about 209,000 U.S. customers and "personal identifying information" for 182,000 Americans; the company has not explained how this latter information differs from the aforementioned personal information.  The company also revealed that unspecified numbers of U.K. and Canada residents had "limited personal information" compromised.  (The company subsequently divulged that 400,000 U.K. customers may have also had their data compromised.)

According to Equifax, I'm one of those whose "personal information may have been impacted by this incident."  If you haven't yet checked for yourself, you can do so by visiting this website set up by Equifax and input your last name and last six digits of your Social Security number.

The breach lasted from mid-May through July.  The company discovered the hack on July 29 and informed the public on September 7.  The breach was traced to a tool, called Apache Struts, used to build web applications.  Equifax utilized it to support its online dispute portal, where customers go to log issues with their credit reports.  The company admitted that its personnel was aware of the security vulnerability a full two months before the hackers first accessed customer data.

Unsurprisingly, a wave of investigations and lawsuits has been unleashed by the debacle that has affected so many.  "The [Federal Trade Commission] typically does not comment on ongoing investigations, Peter Kaplan, the FTC's acting director of public affairs, said in a statement.  "However, in the light of the intense public interest and the potential impact of this matter, I can confirm that FTC staff is investigating the Equifax data breach."  The attorney general of Massachusetts, Maura Healey, said she intends to file the first state lawsuit over the breach of customer data.  U.S. Rep. Jeb Hensarling (R-TX), chairman of the House Financial Services Committee, has indicated that preparations are underway to hold congressional hearings on the matter.  Not to be outdone, Senate Minority Leader Chuck Schumer (D-NY) compared Equifax to Enron, the eponymous company brought down by an accounting fraud scandal.

Along with Experian (LON: EXPN) and TransUnion (TRU), Equifax is a major credit reporting bureau that collects and maintains consumer credit information and resells the data in mainly the form of credit reports.  While Equifax has been publicly-traded since 1978 and Experian since 2006, TransUnion only went public in 2015.  Because of the often determinative impact of credit scores in the financial lives of Americans, and because the bureaus "don't care, because they don't have to," Bloomberg's Joe Nocera says that, at a minimum, the government needs to create incentives that would reward the companies for accuracy, customer service, and ironclad data security.  If that doesn't do the trick, he proposes a "radical and sensible" solution: treat the three companies like public utilities.  The companies would remain publicly-traded but would be overseen by a government regulator that would set performance standards for accuracy, data security, etc., and would be empowered to restrict dividends and executive compensation for failing to measure up.

As if that's not enough, according to SEC Form 4 filings, three senior EFX executives sold shares worth approximately $1.8 million three days after the company discovered the security breach.  Company spokeswoman Ines Gutzmer said they "had no knowledge that an intrusion had occurred at the time" and only "sold a small percentage of their Equifax shares."  On August 1, Chief Financial Officer John Gamble sold just over 13 percent of his shares worth $946,347, president of U.S. information solutions Joseph Loughran sold 9 percent of his shares (in conjunction with an option exercise) worth $584,099, and president of workforce solutions Rodolfo Ploder sold 4 percent of his shares worth $250,458.  The filings do not indicate that these were transactions pursuant Rule 10b5-1 plans, by which executives can sell a predetermined number of shares at a predetermined time.

Given the foreseeable reverberations of selling shares while cognizant of adverse - or explosive - non-public information, it's hard to fathom executives nonetheless proceeding with the transactions under such circumstances.  We're likely to find out, though, because a bipartisan group of 36 senators sent a letter urging the FTC, the Department of Justice and the Securities and Exchange Commission to investigate the company over the executives' early-August stock sales.  Having worked at MSCI/ISS, I'm rather familiar with the intricacies of an elaborate system of option exercise blackout periods, share trading windows, preclearance requirements, and the like.  In the midst of dealing with the fallout of the massive customer data breach, temporarily tightening prohibitions on executive stock sales was probably the last thing on their minds in the C-suite.  But, at the very least, the transactions aren't helping with optics in the light of the mounting damage to customer relationships, company and industry reputation and, potentially, the bottom line.

Robert Stead

Sunday, September 3, 2017

Weekend Update: WFC, AMZN, Dole Food & Uber

The dog days of summer are drawing to a close but there are a few bones that we can't let go of as the situations continue to play out.  So, we'll resume reporting by following up on several high-profile matters covered previously.

The long tail of WFC's fake account debacle

In the spring, we traced the sequence of the events for what's come to be known nationally as the "fake account scandal" that - presumably - culminated in the Wells Fargo board clawing back over $180 million in compensation from top executives.

On the last day of last month, Wells Fargo filed an 8-K and issued a press release disclosing the completion of its previously announced expanded third-party review of retail banking accounts dating back to early 2009 and providing an update on the company's progress regarding customer remediation.  The new investigation uncovered another 1.4 million unauthorized accounts opened by bank personnel, bringing the total to date to 3.5 million.  Thus far, the company has paid $7 million in refunded fees and interest, $3.7 million in compensation to complainants and $147 million to settle a class-action lawsuit - in addition to $185 million to settle with federal and Los Angeles regulators. Due in part to the fake accounts matter, the Office of the Comptroller of the Currency downgraded WFC's Community Reinvestment Act rating, which in turn prompted some state and municipal governments to pull business from the bank.

In November of last year Warren Buffett, CEO of Berkshire Hathaway, WFC's largest shareholder with a 9.4% stake, observed that former WFC CEO John Stumpf was slow to respond to the crisis and that one should face up to a problem fast.  In other words, "[g]et it right, get it fast, get it over."  When we reported on the matter this spring, the company had announced another tranche of claw-backs from Mr. Stumpf and Executive Vice President Carrie Tolstedt, head of retail banking, amounting to $75 million.

Back then, Mr. Buffett nonetheless was upbeat about the company's prospects looking ahead, noting that one third of the nation does business with WFC and that, although a bond of trust was broken, the number of depositors would be higher a year hence.  Commenting on the latest disclosures late last week, however, Mr. Buffett said: "There's never just one cockroach in the kitchen when you start looking around.  Any tine you put your focus on an organization that has hundreds of thousands of people...you may very well find that it wasn't just the one who misbehaved that you find out about."

Long past time for preventative measures, Berkshire Hathaway Vice Chairman Charlie Munger might deem WFC to be in the ton-of-cure phase.

Amazon consummates acquisition of Whole Foods

When we last visited the subject earlier this summer, it was not long after Amazon's "whirlwind courtship" of Whole Foods Market resulted in the former popping the offer to acquire the  grocer for $13.7 billion or $42 per share, a 27% premium over the previous days' closing price.  "We just fell in love," WFM CEO and Co-founder John Mackey said at the time.  "It was truly love at first sight," he emphasized.

At WFM's special meeting held on August 23rd, almost 72% of outstanding shares were voted FOR the merger agreement, versus negligible votes AGAINST (.3%), making support virtually unanimous after factoring out the ABSTAIN vote and the broker non-vote.  On the same day, the Federal Trade Commission (FTC) green-lighted the deal, noting that "[o]f course, the FTC always has the ability to investigate anticompetitive conduct should such action be warranted."

Since the acquisition was first announced in June, investors have expressed concern that Amazon's entry into the grocery sector would adversely impact other competitors.  These worries were not allayed when Amazon slashed prices on some staples like eggs, butter, ground beef, apples and bananas almost immediately after closing the transaction.  The combined market capitalization of six major players - Costco (COST), Kroger (KR), Sprouts (SFM), Supervalu (SVU), Target (TGT), Wal-Mart (WMT) - declined by $12 billion in the ensuing days after Amazon announced that its acquisition of WFM would close in a matter of days.  Sprouts, losing almost 10%, and Supervalu, losing over 2%, were the hardest hit.

Lower prices should endear Amazon to the ambivalent Whole Foods customer, tired of parting with her whole paycheck, but both entities' progressive reputations are being tested by their converging business practices.  Currently accounting for 34% of online sales, on the way to a 50% share by 2021, Amazon's growing dominance is earning it enmity from certain quarters.  Amazon is displacing Walmart, in the eyes of many, as the destroyer of mom-and-pop businesses.  A 2014 Salon article suggested that Amazon Prime membership might be morally indefensible in light of the company's alleged mistreatment of workers, or sick brutality and secret history of ruthless intimidation, as the piece's title put it. 

In the not-too-distant future, Amazon's unrelenting success and expansion plans could draw intensified antitrust scrutiny.  The view of this prospect, and its potential impact on shareholder value, from the boardroom and executive suite could be the subject of future analyses.

Laying the groundwork for IPO, Dole Food prunes operations

As we detailed in July, Dole Food Co. is preparing for the third initial public offering (IPO) in company history.

In recent weeks, the company has announced the closing of packing and cooling plants in Southern and Northern California, and layoffs of the facilities' employees, as well as those harvesting strawberries to be packaged.  "This is part of an ongoing initiative to evaluate all berry operations to ensure they remain aligned with our growth objectives and position to remain competitive in the market place," Dole spokesman William Goldfield.

More broadly, according to the S-1, Dole Food is "continuing the rationalization of [its] footprint of locations and offices" and aims to "improve cash flow generation by being actively engaged in divestment of non core assets, particularly the approximately 14,800 acres of idle land [the company owns] in Hawaii."  The company owns and operates 124,000 acres worldwide, but only 1,600 acres on the mainland U.S.  Although they only represent a fraction of the overall portfolio, these acres are likely among the most valuable, and yet among the most costly to farm; the company also farms 19,000 acres on leased land across five states.

According to the S-1, the company signed a term sheet to acquire Dole Plantation, a theme park and one of Hawaii's leading tourist attractions, from Castle & Cooke Properties, Inc., another company owned by Dole Food owner and chairman David Murdock.  The company said the intention for entering into the transaction is primarily to increase earnings.  Last spring, the company anticipated structuring the acquisition as a like-kind exchange (to defer tax liability per IRC §1031) for the company's headquarters facility in Westlake Village, CA, which apparently Dole would still occupy.  Per the S-1, the company contemplated completing the acquisition by mid-2017, but there's been no indication that this has happened.

Dole Food Co. remains the largest producer of fruit and vegetables in the world but is striving to boost revenues and operating margins, while reducing debt.  Revenues for year ended December 31, 2016, were down 3% from the previous year.  The company's operating margin is less than 1%, versus 4.4%, according to Morningstar, for Fresh Del Monte Produce (FDP), a publicly-traded company with a comparable profile.  Total debt of approximately $2.5 billion at yearend 2016 was up slightly from the previous yearend.  So there seems to be some work to do before Dole's IPO ripens enough to sell.

Uber hails new CEO to ready for IPO

Earlier this summer, we considered the corporate governance recommendations in Eric Holder's report on the hostile work environment allegedly tolerated, if not encouraged, by senior management at Uber.  Among the recommendations was that the company hire a COO who would act as a "full partner" with the CEO (who took an indefinite leave of absence at the time) but focus on day-to-day operations, culture and institutions within Uber.  Within a week, founder Travis Kalanick stepped down as CEO, reported the New York Times, after five major investors demanded that he resign immediately.

Later in the summer, the Washington Post proclaimed that "Uber's search for a female CEO is narrowed down to three men."  The article opened by asserting that "[a] company trying to recover from allegations from rampant sexism might reasonably think that hiring a female chief executive would help it restore credibility with customers and - perhaps more importantly - with potential employees in a tight marketplace for talent."  Although there's no indication that the company predetermined that a female would be be hired as CEO only to be thwarted, several high profile women reportedly were approached to fill the role.  General Motors (GM) CEO Mary Barra, EasyJet (LON:EZJ) CEO Carolyn McCall, Facebook (FB) COO Sheryl Sandberg, HP (HPQ) CEO Meg Whitman and Google (GOOGL) subsidiary YouTube CEO Susan Wojcicki all apparently turned down overtures from Uber's board.

Late in August, the Uber board settled on the highly-regarded CEO of online travel company Expedia (EXPE), based in Bellevue, WA; among other accomplishments, Dara Khosrowshahi drove revenues from $2.1 to $8.7 billion since becoming EXPE's chief in 2005.  "This company has to change," Mr. Khosrowshahi said in a tweet on Wednesday, August 30, before a private all-hands meeting at Uber's headquarters in San Francisco.  "What got us here is not what's going to get us to the next level."

While Mr. Holder recommended appointing an independent chairman, the company tweeted that Mr. Khosrowshahi plans to bring in a chairman who can serve as his "partner at the board level."  The new CEO also has multiple C-suite openings, such as chief operating officer, chief marketing officer and chief financial officer, to fill.  Just after taking the helm. the new CEO was greeted with more controversy when news leaked that the Justice Department was looking into allegations that company officials violated U.S. laws by bribing foreign officials.

At the Uber all-hands assembly, Mr. Khosrowshahi reportedly indicated that privately-held Uber could go public in "18 to 36 months."  While the new CEO plans to focus on the core business to "pay the bills," he also must change the company's "baller" culture, burnish the tarnished brand, rebuild the depleted executive team, beef up legal and regulatory compliance, decide which big bets, e.g., self-driving car research, to stick with, and overhaul the "founder-friendly" corporate governance structure, among other things.  So there's a lot on his plate.

Robert Stead