Technology & Innovation

Heartland Payment Systems

March 18, 2015

Global

March 18, 2015

Global
James Chambers

Former senior editor

James is Bureau Chief for Monocle, Hong Kong. Prior to this he worked as a Senior Editor with The EIU's Thought Leadership team for over three years researching business, technology and cities. He has also written about business and technology for The World In 2015 and economist.com. James has previous experience from IR magazine, a finance publication, where he was research editor in London and Shanghai. Additionally he contributed to Legal Week, a weekly legal magazine, and worked on the FT Innovative Lawyers Awards in the US and Europe. James is an English law-qualified solicitor (currently non-practising) and holds post-graduate legal qualifications from BPP Law School and an LLP in Law from the London School of Economics.

January 20th 2009 was an important date. It was the inauguration of America’s first black president, Barack Obama. It was also the day on which Heartland Payment Systems announced that its systems had been breached. Critics accused Heartland of using the auspicious date to try and bury bad news*.

But if that was the US-based payment processing firm’s intention, it failed. Within days of the announcement, Heartland’s share price fell by 50% and continued its sharp descent into early March 2009, losing 78% of its pre-breach value at its lowest ebb.

Even when sensitive data are not stolen, a data breach can have an impact on share price, as Sony learned after its European subsidiary’s websites were breached in June 2011. The data that were stolen were already in the public domain, but that did not stop 2% being knocked off the firm’s share price^.

Although data breaches are common, protecting data is important if an organisation wishes to maintain the trust of its customers, investors and other stakeholders. If a data breach breaks this trust, it can have a significant impact on share price, says Abbott Martin, senior director at Corporate Executive Board (CEB), a business advisory fi rm. But Mr Martin admits that the impact of an incident on share price is “difficult to quantify”.

One lesson that can be learned from the Heartland incident is that being open about a data breach is not detrimental in the long run. Heartland’s chief executive, Robert Carr, tried to be as open as possible about the breach and encouraged other firms to share information about cyber-attacks. He also cofounded the Payments Processing Information Sharing Council (PPISC), an organisation that encourages firms in the payments industry to exchange relevant information.

If Heartland’s share price took a plunge after the breach announcement, it has certainly rallied since then. On March 9th 2009, less than two months after the event, Heartland’s share price opened trading at US$3.98. By 2013 its shares were trading at more than ten times that value.

 

 

 

 

 

*

^

Enjoy in-depth insights and expert analysis - subscribe to our Perspectives newsletter, delivered every week