Could a Cyberattack Hit Stocks You Own?

Last week, Intel revealed in an SEC filing that its networks had been the cyber victim of sophisticated attacks, turning the chip maker into the latest casualty of computer hacking. The disclosure, in a 10-K filing, was briefly worded and Intel declined to elaborate further. The timing of the attack between January and February -- coincided with the highly-publicized security breach reported by Google.

Alarm over hacking is of course growing, as are the security and financial implications. All 2,100 businesses and agencies surveyed by software security firm Symantec in January said they had suffered a security breach, and 75% said they'd been victims of a cyber attack in the past year. Slightly more than a third of the organizations rated the breaches as either somewhat or highly effective. After retailer TJX revealed in January 2007 that it had lost the credit- and debit-card information of more than 40 million consumers to hackers, it was hit by a wave of lawsuits, which cost it $40-plus million to settle.

How online security issues affected five companies.

Typically, companies report security breaches only when required to by law, unless they calculate it is worth their while. Contrast Intel s tight-lipped revelation with Google s very public airing of its charges against China. In that case, Google made headlines accusing the Chinese of trying to censor search results. Positioning itself as blazing a trail, the search giant touted freedom of speech, human rights implications and broad security issues. It threatened to withdraw from the Chinese market, even though the company had complied with Beijing s censorship measures since it entered the Chinese market in 2006. At least for now, Google.cn is still up and running.

So, what should an investor be worried about in the case of a cyber attack? Probably the main issue is reputation. Revealing a security breach can give a company a black eye, says John Bumgarner, research director for security technology at the U.S. Cyber Consequences Unit, a non-profit research institute. If a firm s data has been compromised, it can be challenging to regain the trust of investors and consumers. Other possible concerns for investors include the compromising of a company s intellectual property, litigation and weakened market share. Currently, the Senate Committee on Commerce, Science and Transportation, as well as other bodies, are calling for stricter cyber security regulation.

Experts say that looking for individual stock price adjustment due to a security breach is unreliable, since there are a wide range of factors affecting a ticker s daily movement. Instead, concerned investors should monitor fluctuations in market share, says James A. Lewis, a technology expert at the nonprofit Center for Strategic and International Studies (CSIS). Employing the latest antispam and antiphishing software, as well as keeping an eye on online banking and investment platforms, is always a safe bet for protecting sensitive information.

Here s a look at how some companies have been affected by cyberattacks.

THE BREACH: Earlier this year, Google said Chinese hackers had stolen its intellectual property and infiltrated two Gmail accounts of Chinese human rights activists.

THE STOCK: On Jan. 12, 2010, the date the breach was announced, Google shares fell 1.7%, to $590.48; they have fallen 10.8% since.

After Google detected the breach, the company took the unusual step of going public with the information. Google s chief legal officer, David Drummond, wrote about the attacks in a Jan. 12, 2010, blogpost, noting that at least 20 large companies were likewise affected. While Google was at first lauded in the media for challenging China (and risking its business there), the blogosphere was rife with speculation that Google was trying to distract consumers so they wouldn t worry about their accounts being hacked, too. Others saw Google s move as an attempt to take a principled position, says CSIS s Lewis. Clearly the move put the issue of cyber security on the front page and affected U.S.-China relations, but it might also have moved the needle in the way companies choose to speak in the case of a breach. When Gmail was affected, it wasn t so much that people were going to close their Gmail accounts and switch to Yahoo, because Yahoo could have just as well been attacked, says Todd Feinman, CEO of Identity Finder. Google declined to comment further on this incident, and referred us to the original blog post.

THE BREACH: Intellectual property was breached in January 2010, according to an Intel filing with the SEC.

THE STOCK: On Feb. 22, the day of the SEC filing, Intel shares rose five cents, to $20.87; they have fallen 1.6% since.

Last week, Intel revealed in its Securities and Exchange Commission (SEC) 10-K filing that it had been the target of a sophisticated cyber attack in January, around the same time as the Google incident. It s not unusual for companies to reveal these kinds of attacks in 10-Ks. The only thing that s different is that Intel linked the cyber-assault to the Google announcement, says Bumgarner of the U.S. Cyber Consequences Unit. According to Intel s 10-K: One recent and sophisticated incident occurred in January 2010 around the same time as the recently publicized security incident reported by Google. We seek to detect and investigate these security incidents and to prevent their recurrence, but in some cases we might be unaware of an incident or its magnitude and effects.

The company won t comment further, but the threat here seems to be the potential loss of intellectual property, says the CSIS s Lewis, who has testified in front of a Senate committee, urging better federal regulation of cyber security. The Chinese have long wanted to build their own microprocessor, he adds. If you can steal what Intel has, it makes it much easier. Companies need to take this seriously, says Lewis. This is really the flipside of piracy. You wouldn t let someone walk off with a filing cabinet, you need to make sure there s no way for someone to walk off with a computer file.

THE BREACH: Over 10,000 Hotmail accounts affected by a phishing scheme, where scammers trick consumers into giving out passwords and other sensitive information.

THE STOCK: On Oct. 5, 2009, the day Microsoft revealed the breach, shares fell 1.3%, to $24.42; they have risen 17% since.

Software giant Microsoft revealed last October that over 10,000 Hotmail accounts had been compromised, as the result of a vast phishing scheme. The accounts affected were the ones where consumers unknowingly gave information to the hackers, says Feinman. But they [Microsoft] were upfront about it. On Microsoft s official blog, the company said the attack was not a breach of internal Microsoft data.

Last Thursday, Microsoft won U.S. court approval to deactivate an international network of computers that the software giant says is spreading viral computer codes and spam. A total of 277 domains apparently linked to a so-called botnet or a throng of contaminated computers controlled by cyber criminals from a central machine.

The company declined to be interviewed, but offered statements through a Microsoft spokesperson. According to the spokesperson, the company has supported 191 enforcement actions against phishers world-wide. These include civil lawsuits filed by Microsoft, as well as civil and criminal actions by international government and law enforcement agencies for which Microsoft made referrals and subsequently provided support, according to the spokesperson.

Aimee Larsen Kirkpatrick from StaySafeOnline.org says to never give out a password or any private information to an unknown site. Make sure you re using a strong password, she says. Use fake words, along with letters, numbers and symbols to make sure that a password keeps your information safe.

THE BREACH: Credit-card data and information stolen from more than 40 million consumer credit-card accounts.

THE STOCK: On Jan. 17, 2007, the day TJX revealed the attack, shares fell 0.7%, to $28.33; they have risen 47% since.

Discount retailer TJX, which owns TJMaxx, Marshall s among others, announced in January 2007 that hackers had stolen credit-card data and other information from its systems. The company was barraged by lawsuits, and has since paid out some $40 million to settle the claims. In some instances, the company is paying for credit monitoring for litigants. Meanwhile, Albert Gonzalez, 28, has pleaded guilty to charges including wire fraud, aggravated identity theft and conspiracy, in a 19-count indictment stemming from the case. A former Secret Service informant, Gonzalez is scheduled to be sentenced on March 18.

Looking ahead, more regulation in this area seems likely. On March 1, new laws to protect consumers from data security breaches went into effect in Massachusetts, where TJX is based.

THE BREACH: In an attack on RBS WorldPay, the payment processing business of the Royal Bank of Scotland, cyber criminals stole $9 million in less than 12 hours, according to the U.S. Department of Justice.

THE STOCK: On Nov. 10, 2008, the day RBS revealed the breach, shares fell 2.3%, to $18.85; they have fallen 38.8% since.

In this cyber-theft episode, a global gang of alleged hackers bypassed encryption codes on debit cards, which RBS WorldPay distributes to customers for employee payroll purposes. The hackers then raised the limits on these cards, and withdrew money from ATMs in cities around the globe, according to the Justice Department. Data from 1.5 million cardholders as well as 1.1 million Social Security numbers were left exposed. Eight men allegedly involved with the scam, including one Russian, one Moldovan, five Estonians, and one man identified only as Hacker 3, were indicted on Nov. 10, 2009, by a federal grand jury in Atlanta.

INVESTOR CENTER

MARKETS:
Chart
TODAY
Portfolio Chart

RESEARCH STOCKS & FUNDS

Subscriber Tool

Stock Screener

Screen over 7,000 stocks using more than 100 different variables.

Portfolio Tracker

Track your own buys and sells

See More Tools

Answer Engine
Find Answers to Life's Challenges  

Find solutions to this and many other problems using

Answer Engine from SmartMoney. 

Copyright 2012 Dow Jones & Company, Inc. All Rights Reserved
This copy is for your personal, non-commercial use only. Distribution and use of this material are governed by our Subscriber Agreement and by copyright law. For non-personal use or to order multiple copies, please contact Dow Jones Reprints at 1-800-843-0008 or visit
www.djreprints.com.