Cyber security was ranked eighth among the 12 biggest specific risks facing Reckitt Benckiser Group in its last annual report. That danger became real when the consumer goods giant was hit by the Petya attack last month.
Reckitt said this will probably cost it 2pc of second-quarter sales, some of which will never be recovered. It’s tempting to see this as an unlucky one-off. That would be too kind.
The British company was already beefing up its systems before Petya hit and the ¬expert view is this was a ¬particularly malicious attack. Other ¬multi-nationals suffered too. ¬Nevertheless, Reckitt is a blue-chip firm with considerable resources. It has just spent $18bn (€15.7bn) in cash on its latest acquisition – baby formula producer Mead Johnson Nutrition Co. Investors can reasonably expect that an organisation of this stature should be in the group of big companies not affected by these events.
Investors don’t know if it was exposed because an employee breached internal protocols – say by wrongly opening an attachment – or whether its systems have a particular vulnerability. The attack disrupted its manufacturing and distribution across “multiple markets”, leading to failed shipments to customers. Some factories still aren’t back to normal.
Reckitt needs to be transparent about what went wrong as soon as possible, while not offering up anything that would compromise the business. Investors need to know how preventable this was. The same goes for the other large companies affected. It would be inexcusable if Reckitt’s or anyone else’s failings came down to using outdated operating systems, simple software ‘hygiene’ or poorly implemented protocols.
The cost here is manageable. Based on 2016 second-quarter performance, the hit would be about £45m (€50.8m) before adjusting for any benefit from sterling’s devaluation, although Reckitt is indicating the impact on full-year sales will be greater. Part of the sales disappointment is linked to separate problems in India.
But this cannot be brushed aside easily. There will be a price to pay to remedy the failings. What’s more, the attack is yet another ‘one off’ after problems in Korea and with new product launches, as Kepler Cheuvreux research notes.
As activists hover around the consumer goods sector, management should be on guard. You can get away with disappointments when things are going well. But the Reckitt story has lost its mojo. This will be the worst start to the year for Reckitt on record, according to Bloomberg Intelligence. Each acquisition makes the group more complex, creates distractions and makes it much harder to manage.
Stock has sharply under-performed the FTSE 100 and the Stoxx 600 consumer goods index over the past 12 months.
By Reckitt’s own admission, the Mead Johnson deal could take at least five years to cover its cost of capital. Some say 10.
Breakneck acquisitions, share price under-performance and operational ball-dropping. Any activist building a case for shrinking Reckitt might well gain traction. (BloombergView)