Shares in cyber security group Avast (AVST) have plunged in the wake of a joint investigation published by PCMag and Motherboard, which alleges that its Jumpshot subsidiary has been selling sensitive browser history data to third-parties. The report (as detailed in PCMag) found that “what should be a giant chunk of anonymised web history data can actually be picked apart and linked back to individual Avast users”. For Avast – whose focus area is consumer cyber-security – claims of this nature are clearly bad news.
In a statement dated 28 January, the group said that “at no time have we sold any personally identifiable information to a third party”. Then, on 30 January, it announced that it was winding down data analytics business Jumpshot with immediate effect. The group is also buying back the 35 per cent stake in Jumpshot that it sold to Ascential (ASCL.L) last July. It has agreed to pay a cash consideration equivalent to Ascential’s investment, plus expenses incurred in relation to the original transaction.
Avast’s chief executive Ondrej Vlcek said in a message to stakeholders that his group’s “core mission is to keep people around the world safe and secure, and I realise the recent news about Jumpshot has hurt the feelings of many of you, and rightfully raised a number of questions – including the fundamental question of trust”. He explained that Avast had started Jumpshot in 2015 “with the idea of extending our data analytics capabilities beyond core security. This was during a period where it was becoming increasingly apparent that cybersecurity was going to be a big data game”. Jumpshot was operated independently from Avast, with its own management.
Mr Vlcek added that “during all those years, both Avast and Jumpshot acted fully within legal bounds – and we very much welcomed the introduction of GDPR [General Data Protection Regulation] in the European Union in May 2018”, committing to “100 per cent GDPR compliance”. However, Mr Vlcek – who ascended to his role seven months ago – “came to the conclusion that the data collection business is not in line with our privacy priorities as a company”.
Jumpshot will be counted as a discontinued business in Avast’s future reporting statements. Its termination will not affect FY2019 results, which Avast says are in line with expectations. It anticipates organic billings of $901m (£693m) – up by a tenth – with organic revenues up 9 per cent to $863m and adjusted cash profits up 7.9 per cent to $483m.
For the 2020 financial year, Avast expects mid-single-digit organic revenue growth (excluding Jumpshot). Market expectations had been for around 8 per cent growth – with Jumpshot’s 200 basis-point impact, Barclays reckons that underlying growth should slow to 6 per cent. Analysts here say that reported growth could be about 2 per cent – with a reacceleration in 2021.
The adjusted cash-profit margin will be broadly flat versus the prior year, because operating costs previously allocated to Jumpshot will be reinvested into growing the rest of the business. Avast expects a one-off cost of $15m-25m to cover closure costs, asset write-down and workforce restructuring. It still expects to recommend a FY2019 dividend and to continue with its payment policy in 2020.
Barclays sees the share price reaction as overdone. Jumpshot was already in the process of being disposed of – albeit with the Ascential deal, Avast would still have been giving data to the latter. The broker comments, “perhaps there are other developments around the data usage which we are not aware of and there are clearly still questions”.
