enterprice risk management

TJX have turned a potential fatal breech into a profitable venture. A quick recap:

• In January 2007, the news broke loose that hackers had gained access to TJX sentrally stored customer data, resulting in the theft of 47 million credit card numbers (amongst other privacy data). Everyone can see that has to be bad for business.
• Then it turns out that the hackers had been doing this for over a year. Ouch. That gotta hurt real bad too.
• After a while, we learn that the hackers gained access through a (unprotected – using WEP) wireless network at one of the shops. Did I say unprotected? Oh. That hurts again. Then again, this was back in the stone age – aka summer of 2005.

We should be expecting TJX to suffer big time. Media has been all over this case. Bloggers too. I have been no better.

It would be reasonable to expect TJX to suffer lower revenue stream. A weaker company would have fallen over. And consumers would turn their backs to the shops.

But only some of this happened. Lets see the status per october 2007 (from Yahoo Finance):

• TJX has a revenue stream of $4.1B and $4.3B the first two quarters 2007, and $5.1 Q4 2006. If they continue to increase the revenue in Q3, and do a strong Q4 – as you will expect as it is the xmass and end-of-year – they will do as good as 2006, or even exceed those $17.44Billion revenue from 2006. Not a huge loss, nothing near the expected anger from the consumers.
• What if we look at growth rate? The past three years, TJX has grew with aprox. one US$billion per year. They risk not to grow with that amount this year – but as we saw above, they look to target or exceed revenue from 2006. It seems TJX will ride the storm well.
• Lets take a look at the profit, then. Even if the consumers don’t seem to abandone TJX, surely there must be expenses? And surely there are – some will show up this year, most will not (see next bullet). Profit. (in thousands)
  Q3 2006: 1.114,316
  Q4 2006 (ends jan. 27): 1.159,153
  Q1 2007 (ends apr. 28): 990,866 – so there is 170 million drop in the first quarter after the breech go public. And considering this is the first quarter of the year, this is not a dramatic drop.
  Q2 2007 (ends jul. 28): 1.035,601
  It seems to me that profit is not affected in the dramatical way we should be expecting.
• Risk can be transferred. It is called insurance. Someone else will pay a large amount of the bill.
• What about the law suits, I hear you ask. TJX is quick there too – they have offered a check of $20 and a gift voucher to all affected customers. They initially tried to be a bit more dirty – a $50 gift voucher and no check, but that was too obvious. What happens with a gift voucher? You go to the store and spend it. Along with some other cash – there is plenty of stuff to buy, and when you are in the shop in the first place, why not do some spendings. TJX know. After all, they are in the consumer market space!
• Market value? Well, the consumers don’t seem to care much.
• The share holders? Surely they must have run away? Hah, no, 2007 is their best year ever. TJX shows a steady growth of value, and the bad news in January could not take the shares down to June 2006 values. TJX is nothing but a money machine.
• What about the breech in the first place? Well, this was in 2005, a WEP protected WIFI point was hacked. Most of my readers would know how to do that themselves – and in less than 10 minutes. If you don’t, take my word for it. WEP does give you protection against those who do not know how to hack it, though.

You may do a risk assessment, and determine that the risk of a hacker hacking you is so small, you will risk it. If you do, that is exactly what you are supposed to do – evaluate the risk at hand, and treat it accordingly.

I suspect that TJX did evaluate the risk, and did make a valid decision. After all, they did start to implement WPA only a few months after the initial breech.

I have to admit - they seem to be doing all the right things. From a business point of view, they are. They are analysing the situation, evaluating options, and choosing the road to minimize risk and maximize profit.

And it seems like they are pulling it off too! Congratulations to TJX!