Equifax data breach hacks away at credit-monitoring firm's third-quarter profit

Credit-monitoring firm Equifax, which was hit by a cyber attack caused by lax online security that enabled hackers to steal personal data from roughly 145 million customers and resulted in widespread damage to its image, reported that costs related to the hack totaled $87.5 million in the third quarter.

The hack, which was first reported by the company on Sept. 7 and was later found to be caused by its failure to properly patch a software flaw, thrust Equifax into a public relations crisis that has led to a management shakeup, the removal of CEO Richard Smith, dozens of lawsuits and numerous grillings of past and current executives on Capitol Hill.

The company's interim CEO, Paulino Barros, addressed the breach before getting to the financial results on the company's quarterly earnings report released after Thursday's closing bell on Wall Street.

"As we report our third quarter results, we recognize that we have an important journey in front of us to regain the trust and confidence of consumers and our business customers," Barros said in a statement. 

The data breach resulted in a 27% drop in the company's third-quarter net income to $96.3 million vs. the same period a year ago. 

More:Equifax breach hit 2.5 million more Americans than first believed

More:Ex-Equifax CEO Richard Smith apologizes; doesn't say why a fix wasn't carried out

More:Equifax data breach could create lifelong identity theft threat

More:Equifax image is battered by data breach as consumers feel violated

However, Equifax's overall revenue for the quarter rose 4% to $834.8 million from last year's third quarter. Still, revenue was below Wall Street's expectations of $846 million and shy of the company's own forecast of $853 million to $861 million that it predicted in July. (Its U.S. revenue, however, fell 3% to $307.7 million, the company said.)

Equifax reported adjusted earnings per share of $1.53 per share, which topped analyst expectations by 4 cents. 

The  company included a special section in its earnings report to address the cyber hack and its cost. The before tax quarterly hit of $87.5 million related to the data breach, included "costs to investigate and remediate the cybersecurity incident," as well as legal costs.

Equifax also said the cost to offer free credit monitoring services and identity theft protection to all U.S. consumers through the Jan. 31, 2018, deadline, was $4.7 million through the end of September. The company estimates that it could incur additional costs of $56 million to $110 million. 

The company's stock has taken a hit during the crisis. Shares closed Thursday at $108.95, down nearly 24% from where it was trading before the company announced that it had been a victim of a cyber breach. For the year, shares are down nearly 8%.

Barros, in his statement, reiterated that Equifax is committed to protecting consumers against future attacks.

"Our teams have taken immediate actions to improve our data security and provide improved support for consumers who were impacted by our cybersecurity incident," the interim CEO wrote.  (As we look to the future, I have committed Equifax to four things: protecting consumers, enhancing our security, empowering consumers to control access to personal credit data, and leading our industry to confront the massive economic and national security threats represented by cyber criminals."

The company will host a conference call with investors Friday morning.