Cyber-paperwork blizzard will soon blind markets

SolarWinds

14/12/2023 16:47

(The author is a Reuters Breakingviews columnist. The opinions
expressed are his own.)
    By Jeffrey Goldfarb
       NEW YORK, Dec 14 (Reuters Breakingviews) - Following
corporate paper trails is about to get more confusing. New
rules will go into effect next week requiring companies to
divulge system hacks and data breaches within four days of
deeming them serious. To avoid falling foul of the Securities
and Exchange Commission, chief executives probably will err on
the side of caution, creating a deluge of disclosure that’s hard
to parse.
    Cybersecurity gaps are an increasingly widespread and pricey
problem. Some 95% of organizations examined by IBM’s  IBM.N 
security division experienced more than one breach. Each cost
about $4.5 million, with detection and other expenses about 40%
higher than three years ago, according to the study.
    SEC Chair Gary Gensler has taken notice and pushed to
improve and standardize how such incidents are managed and
disclosed. His commitment is becoming clear: The agency recently
accused software developer SolarWinds  SWI.N , victim of a
massive hack in 2018 that affected clients including the U.S.
government, of fraudulently ignoring cybersecurity red flags and
misleading investors about them.
    With such legal risks looming, companies are likely to
comply right away. For investors sifting through the coming
volume of documentation, the challenge will be sorting real
catastrophes from minor stumbles or boilerplate language, while
discerning whether customers and suppliers may be affected, too.
    Clorox  CLX.N  recently provided something of a dry run. The
$18 billion cleaning-products maker in mid-August flagged
“unusual activity” on its IT systems. In an indication of the
tortuous process of assessing the fallout, an escalating series
of statements ensued, as it became clear the attack had
significantly disrupted operations. From the initial revelation,
Clorox shares fell about 30% to their nadir in November.
    Not all attacks will be so damaging. Johnson Controls
International  JCI.N  said in September that it had
investigated a cybersecurity incident that might delay
publication of its financial results. Following various updates,
it tallied the damage on Tuesday at a modest $60 million of lost
or deferred revenue, with a 4% reduction to this quarter’s
bottom line and another small hit in early 2024. The
building-products manufacturer’s shares have swung around, only
to end up roughly where they were when the saga started. 
    Companies have much work to do to ensure they’re suitably
prepared. One recent study found that 88% of S&P 500 Index
 .SPX  constituents have no director with relevant cybersecurity
credentials. In the meantime, hackers are exploiting the
confusion, by exposing their own dirty work to the SEC as
whistleblowers. Until more of this fog lifts, investors will be
flying partially blind.
    Follow @jgfarb on X

    CONTEXT NEWS
    Johnson Controls International, which makes and installs
building products, said on Dec. 12 that a recent cyberattack
shaved 4 cents off its fourth-quarter adjusted earnings per
share, reported at $1.05, and that it expects it will cost it 2
cents a share in the first quarter.
    The company had warned on Nov. 13 that its quarterly
financial results would be delayed because of the cybersecurity
incident, a ransomware attack first detected on Sept. 23.
    Johnson’s shares fell about 6% on Dec. 12, to $53.20.

 (Editing by Jonathan Guilford and Sharon Lam)
 ((For previous columns by the author, Reuters customers can
click on  GOLDFARB/ 
jeffrey.goldfarb@thomsonreuters.com; Reuters Messaging:
jeffrey.goldfarb.thomsonreuters.com@reuters.net))