Hacker News Reader

Comment by nlh | Hacker News Reader

For some context about CWT (I was curious about these figures) -- via Wikipedia[1]:

* US$1.5 billion in revenue * 18k employees

For a firm like this, the payment probably amounts to a small uptick in a small portion of their IT budget and won't even come close to hurting them (and, frankly, neither would the $10m figure).

It's insane that this is the case and that companies are willing & able to pay ransoms like this, but the hackers were right - the payment is much less than lost business, bad PR, etc. if the actual information had leaked. Such is where we are.

[1] https://en.wikipedia.org/wiki/CWT_(company)

View on HN

I don't know about that. For one, travel margins are not exactly the same as SaaS margins. Secondly, there's the global pandemic and all, kinda hurts the free cash of most travel companies.

I wouldn't be surprised if they genuinely would have trouble coughing up 10 million two days after the attack hit.

CWT is used by corporate travel systems. I'd expect their margins to be similar to enterprise software vendors, rather than other travel agencies.

It depends if they report revenue gross or net. If it is gross that means they recognize all booked travel as revenue (and earn a margin on top of that) instead of just recognizing their fee as revenue. In that case it would be much worse margins than a mature SaaS company.

If I had to guess based on the figure, I would guess gross but I'm not sure.

Sorry I should have clarified -- according to Wikipedia, they had $1.5 billion in actual net revenue by processing $23 billion in transaction volume (aka GMV).

theyr'e what we call a travel management company ( = travel agency + software solutions). Their margins are close to the travel agency though, that represents the vast majority of their revenue. They're particularly exposed to business travel, so even worse for them at the moment

It doesn't matter how big your company is, every penny still gets counted. This will come out of some department's budget and have an adverse impact on operations or even cost them some employees. Hopefully whoever was auditing their security.

For all we know their security folks have been warning about something like this and have been pooh-poohed by senior management for years. Sometimes the auditors can only lead the horse to water.

Is the ransom tax deductible?

I don't see why not. Business expense?

Isn’t stuff stolen in a theft/robbery deductible generally?

The ransom payment isn't really a theft or robbery, they didn't have to give it.

If you’re mugged, you don’t “have to give” your wallet either, but you were coerced by an external party.

I would argue those are different things because there was the threat of violence in the case of a mugging.

At the bottom of the thread the ransomers gave them security advice. Therefore this is an "unplanned penetration test" and gets filed as "consulting" on the expenses side of the accounts.

Almost all money going out of a business can be deducted from money coming for purposes of counting taxable profit. I'm having a hard time thinking of one that isn't.

In Portugal you can actually make a payment as "Confidential or Undocumented Expense" (with no invoice supporting it), making it taxable instead of tax deductible.

That's ... not a massive loophole used to hide money from taxation?

No, because they are taxed at basically the maximum marginal rate. There are cheaper ways to avoid taxation.

It's seldom used and only when there's no alternative (e.g. a lost invoice that you don't want to charge your employee for).

Ach, sorry, I misread your comment -- so, it doesn't change their tax situation, so there's no reason to falsely use this. Understood. Never mind.

You don't have to pay Bill $40/hour in wages, you could have probably hired someone who could do the job for $30/hour.

Yet, regardless of how much you pay Bill, his wages are tax-deductible.

Well I hope they get fined by the US Government for negotiating with terrorists

It might over time. If I was deploying ransomware, the first thing I would do after receiving a ransom payment from a company would be to try them again in a month or two.

And if you don't 'visit' them in a month or two, someone else like you will visit them. Now they know their security is crippled, there is no way the patched all holes (system, process, operations) in such a short notice, and we know they can be blackmailed and pay big money.

The only way to mitigate this risk is actually walk the walk (implement appropriate security controls).

Well if they care about money at all they'll have at least one good backup by then.

They'll sack somebody for this for sure, it'll offet it.

Does that revenue include pass-through?

Good question, I was wondering the same thing. It seems it doesn't. The main article body puts total transaction volume at $23B.

That makes sense. $1.5 billion didn’t sound like it would buy a lot of travel/conferences/whatever once you paid 18k employees.

Reply on news.ycombinator.com