The credit information industry, which is one of the sectors I cover, is an interesting example as several high-profile attacks and breaches on data bring the issue to the front of investors’ minds. Data security may not come across as an obvious ESG factor but we all have sensitive personal data collected and used in one way or another by many organizations. The mishandling of individuals’ personal data can greatly affect their financial well-being and privacy which raises ethical, social and governance concerns.
Cybersecurity is relevant for any companies that have access to personal data. This risk is one of the most significant business risks for the credit information industry where the business model depends on their ability to collect, analyses and use consumer and client information. Therefore, effective oversight of the ESG issues is not only a social responsibility of the companies operating in the industry but also a requirement that is highly interlinked to the sustainability of their business model.
Consider the latest high-profile data security breach at one of the credit information companies. Almost 150 million consumers in the US had their personal information compromised in the incident, resulting in reputational and financial damages for the company. The incident saw its stock price tumble 27% and its bond maturing in 2026 drop 10 percentage points in price. In addition, S&P, one of the credit rating agencies, eventually downgraded the company’s credit rating because of increased costs related to the breach incident, signaling a meaningful deterioration of its credit quality.
Within the credit information industry, one of the companies we invest in is Experian. With $4.6bn in sales, it’s the largest and most diversified business in the sector. The company offers data and analytical tools to clients to help manage credit risk, prevent fraud and automate decision-making. For example, think about a telecom operator who is looking to finance purchases of smartphones. The operator will obtain credit reports from either Experian or its competitors to assess credit risks of prospective customers.
Our investment thesis for Experian is predicated on its defensive revenue stream and excellent diversification in terms of products, geographies and end-markets. The attractive business model is supported by Experian’s world-class cyber security program which demonstrates that safeguarding of personal data and privacy is the Company’s highest priority. The threat of cybercrime is ever growing and evolving, and it is crucial for businesses like this to have adequate infrastructure in place to manage cyber security risks, as well as intensive regulatory scrutiny.
My recent conversation with Experian’s management team has reinforced our view that Experian constantly strives to ensure best practices to help them stay ahead of today’s increasingly sophisticated cyberattacks. Admittedly, after its own minor data breach incident, the management made further investments in growing their information security teams, creating a new role of Chief Information Officer and upgrading processes and technologies. They aim to invest an additional point one percent of sales every year on information security to navigate a world of increasing cyber criminality. Lastly, the company has sufficient financial flexibility to sustain its credit ratings should it encounter breach incidents of a similar magnitude to those we have recently seen in the industry.
In the credit information industry, it is clear that the ESG factors such as data security are inherently important to a companies’ long-term value. These factors protect the industry’s high barriers to entry and profitability. Additionally, a company’s approach to these issues can provide a key way to differentiate itself from competition and offer significant growth potential that comes with a prolific use of data. ESG factors present both risks and opportunities for the credit information sector. At T. Rowe Price, we consider the various investment implications of these factors in our fundamental credit analysis.