This is the year, 2017, that cyber threats broke down the boardroom door and confronted board directors with the ugly reality that cyber risk could quickly escalate to operational risk, market risk and even enterprise risk.
First the WannaCry ransomware wave and then the even more destructive Petya virus have impacted the bottom line of some giant public companies—and that’s not easy to do.
As financial reports come out this year, we’re tracking the damage. Here’s what we know so far:
Equifax
Hackers staged a massive raid on the credit-data company, carrying off Social Security numbers and other vital personal information on 143 million consumers in March, the company announced September 7th. The attack exploited a known vulnerability in Apache software, according to the Apache Foundation which also blasted Equifax for not implementing a patch that had been released two months before the hack. The CIO, CISO and Equifax CEO and Chairman Richard Smith left their jobs shortly after the announcement.
Update: Equifax said in November that the data breach will likely cost the company more than $140 million in 2017. Third-quarter profits were down 27% from the year earlier, due to the breach. Equifax's share price has been trading at about 20% off its September high.
Uber Technologies
The giant of "ride-sharing" admitted in November that hackers stole records from 57 million customer and driver accounts back in 2016. The company reportedly paid its attackers $100,000 to destroy the data--not much of bottom-line impact. But the legal impact is just beginning, with lawsuits by the Illinois and Chicago governments quickly filed, and many more surely to come, seeking damages from Uber for concealing the breach. According to the Chicago suit, the hackers gained access through credentials found on GitHub, in "striking resemblance" to a hack on Uber in 2014, after which the company promised regulators it would tighten security.
Merck
One of the largest pharmaceutical companies in the world announced in late June that it too was a Petya victim.
Update: Merck says it lost $135 million in sales in its third quarter due to production slowdowns caused by the cyber attack and spent $175 million on remediation.The company says it also lost, at least temporarily, another $240 million in sales when the U.S. Centers for Disease Control and Prevention had to draw down supplies of a drug from its stockpile because the virus had knocked out Merck's production. Look for more cyber-related losses next quarter, the company warned.
FedEx
Petya hit the shipper’s TNT Express unit on June 28, disrupting operations and slowing deliveries, as workers had to make up for down computers with manual processes.
TNT is based in the Netherlands, with operations in Ukraine, ground zero for the Petya attack, and used a Ukrainian tax software that’s widely suspected as a Petya carrier.
Update: The cyber attack cut $300 million from first quarter profit and compelled FedEx to lower its profit outlook for the year, the company said in September.
Maersk
A.P. Moller-Maersk, the world’s largest container shipping line and the operator of 76 port terminals around the world, was massively disrupted by Petya starting in late June, with ships temporarilly unable to offload and cargo owners unable to track the whereabouts of their shipments. It took two weeks for the company to resume normal operations.
CEO Soeren Skou said there was "no data breach or data loss" but the virus "made all of our applications and data unavailable for a while."
Update: Maersk reported a loss for the third quarter, including $250-300 million due to the cyber attack, which halted shipment of 130,000 containers and cost the company another 260,000 containers worth of bookings.
Reckitt Benckiser
This UK-based maker of Lysol, Air-Wick and other household products suffered serious delays in product delivery as a result of the Petya attack. Reckitt announced July 6 that revenues for the second quarter would be down 2 percent year over year as a result. Its shares dropped as much as three percent on the news.
Update: The company announced its senior vice president for IT would depart in October.
Mondelez International
Petya knocked out the IT network for the maker of Oreo cookies and other snacks, disrupting shipping and sales operations.
Update: The company estimated in October that losses for the attack would hit $100 million for the year, but that was set against a rise in revenue and profit that beat Wall Street expectations.
Beiersdorf
The German maker of Nivea and other skin-care products said the cyber attack cost it $41.5 million in the first half of the year, as its sales figures came in below analyst estimates. It expects to make up the lost sales in the third quarter.
Related:
Petya Attack: Assess the Risk of Ransomware to Your Company Now