Security Breach Affects Near-term Profitability, Buy On Weakness
Our earnings sensitivity suggests an 11% and 3% earnings impact in FY23-24F as a result of the Optus data security breach. Share price has corrected 6% in the past month, and we think that this has partly factored in the negative newsflow. We advocate a BUY on weakness with an unchanged DCF-based target price of S$2.90/share. We continue to like the stock as management strives for high single-digit ROIC by FY25 (FY22: 5%).
WHAT’S NEW
• Optus: Personal data compromised. Optus had a data security breach whereby 9.8m of its customers (c.96% of subscribers) had personal data stolen and compromised by hackers. Out of the 9.8m customers, 1.2m customers had at least one valid and current form of identification document (ID) stolen along with other personal information such as email addresses, Medicare card numbers and date of births. Optus has notified these customers and recommended that they replace their IDs to prevent any identity theft. 900k customers had numbers from expired IDs stolen, with next steps being discussed with authorities. The remaining 7.7m customers had no valid or current ID stolen but had other personal
information compromised.
• Mounting costs. Under Australia’s Privacy Act, the maximum penalty that Optus faces is around A$2.2m. For customers that had their identification numbers exposed, Optus has offered to pay for a 12-month subscription (A$15/month) to credit monitoring service Equifax, which could cost Optus A$189m. We reckon this pertains to the 2.1m customers who had IDs stolen as these customers have the highest risks of material losses from fraudulent loans and identity fraud. Facing calls to bear the replacement costs for affected customers, Optus has also agreed to bear passport replacement costs (A$193/passport) for affected customers. For driver’s licenses, various state governments have stated that Optus would
bear the replacement costs as well.
STOCK IMPACT
• Worst-case scenario of 17% drop in FY23 earnings. Our base case sees an 11% and 3% drop in FY23 and FY24 net profit respectively. Worst-case scenario suggests a 17% and 6% drop in earnings respectively.
• Expected aftershock. Following the data security breach, we opine that there may be a loss in confidence for Optus mobile services, with a small exodus of mobile customers to other competitors. Assuming a 2ppt loss in net adds growth for Optus from our current FY23 estimates, Singtel’s FY23F revenue and PATMI would drop by 0.2% and 0.3% respectively.
