Henry Schein after the cyber disruption
Download case PDF (6 pages)Request teacher’s pack
Strategy case | Information cutoff: March 1, 2024
On February 29, 2024, Henry Schein’s leadership had a company with its distribution systems restored, customers still expecting dependable deliveries, and a growth plan that depended on technology and value-added services. The October 2023 cyber incident had interrupted important operations and affected earnings. The company was not describing an active outage, but it expected some residual financial impact in 2024 and said it would continue investing resources to protect against interruptions and data breaches.
For discussion, assume you are advising a hypothetical executive operating group preparing its 2024 priorities. How should the group sequence attention across distribution and e-commerce continuity, customer and supplier assurance, and growth initiatives? The company has not disclosed a fixed budget or said that one priority must displace another. Your task is to recommend measures and decision gates as well as priorities.
A distribution and technology business
Henry Schein supplies products and services to dental and medical practitioners and other care settings. It reported more than one million customers worldwide and more than 25,000 employees. In 2023, its healthcare distribution segment generated $11.533 billion in sales; its smaller technology and value-added services segment generated $806 million. The segments serve the same customer base, but provide different offerings. The company describes its distribution network as a way to provide broad product availability, rapid and accurate fulfillment, and customer service. It ships almost all orders through third-party delivery services.
The business also depends on supplier relationships. The 10-K says the top ten healthcare-distribution suppliers represented about 25% of aggregate purchases in its risk discussion and about 24% in its business section; both sections put the largest supplier at 4%. The filing says Henry Schein generally does not have long-term contracts with suppliers. It also says many products are available from several sources and customers tend to have relationships with several distributors. These are company-wide disclosures, not a map of which products, systems, or suppliers are most critical.
What happened
Henry Schein disclosed a cybersecurity incident on October 15, 2023. Its 2023 Form 10-K later said the incident primarily affected North American and European dental and medical distribution operations. The company reported taking systems offline as a precaution, restoring affected systems and applications, resuming distribution, and reactivating e-commerce. Henry Schein One, its practice-management and related software business, was not affected; manufacturing was mostly unaffected.
Around November 8, the company determined that a threat actor had obtained personal and sensitive information belonging to certain third parties. The scope remained under investigation in the 10-K. A related e-commerce disruption on November 22 was described as remediated. The company did not disclose the attack’s source or a system-by-system account of downtime and lost or recovered orders.
The financial disclosures describe several different measures. Henry Schein estimated that the interruption and recovery affected fourth-quarter and full-year 2023 GAAP and non-GAAP net income by $0.70–$0.75 per diluted share. Separately, the 10-K reported $11 million of direct expenses related to the incident, mostly professional fees. The company disclosed a $60 million cyber-insurance policy after a $5 million retention, subject to policy limitations; it did not identify an actual insurance recovery amount in that disclosure. Do not treat these measures as additive or as interchangeable estimates of total loss.
Results and the next year
Reported 2023 sales totaled $12.339 billion, down 2.4%. Internal sales, calculated at constant exchange rates and excluding acquisitions, declined 4.4% after adjusting for an extra week in 2022. Internal growth differed by segment: Dental declined 1.4%, Medical declined 11.2%, and Technology and Value-Added Services grew 7.2%.
Management attributed some of the 2023 weakness to the cyber incident, especially its fourth-quarter effect, but also cited lower PPE prices and reduced COVID-19 test-kit demand. The company estimated that Dental PPE sales declined $110 million in 2023, while combined Medical PPE and COVID-test-kit sales declined $422 million. Before the fourth-quarter disruption, internal sales excluding PPE and COVID-test kits had grown 3.5% through the first nine months; full-year internal sales on that basis were flat. The data do not isolate a single cause for the change.
For 2024, management forecast sales growth of about 8%–12%, in part reflecting expected merchandise recovery and 2023 acquisitions. It forecast adjusted EPS growth of 11%–15% and adjusted EBITDA growth above 15%. The company estimated a residual cyber impact of about $0.15 per diluted share, primarily in the first quarter. These were forecasts, not results.
The company said its cyber program aligned with the NIST Cybersecurity Framework and had partial-scope ISO 27001 certification. It described a CISO-led cybersecurity office, outside experts, incident-response procedures, employee training, and Board committee oversight. It planned to devote additional resources to business-interruption and data-security risks. The company also warned that customers and suppliers might impose additional security requirements; some had already made requests.
Decision for discussion
The hypothetical operating group can organize its 2024 agenda around three questions:
- Which distribution, e-commerce, or recovery capabilities should receive the first operating attention, and what evidence would demonstrate that critical paths are resilient?
- What should Henry Schein communicate or verify with customers and suppliers to address security requirements and preserve dependable service?
- How should the group sequence these actions alongside technology and value-added service initiatives, given the public evidence and the limits of what is known?
Recommend a sequence, not a fabricated spending amount. State any additional information you would request, identify leading and lagging indicators, and explain what results would cause you to change course.
Selected exhibits
Exhibit 1. 2023 results and 2024 outlook
| Measure | 2023 reported result | 2024 management outlook at Feb. 27, 2024 |
|---|---|---|
| Total sales | $12.339bn; −2.4% reported | Growth about 8%–12% |
| Internal sales growth | −4.4% (constant FX, ex-acquisitions, adjusted for extra week) | Not directly comparable to reported-sales guidance |
| Dental internal growth | −1.4% | Merchandise recovery expected, among other factors |
| Medical internal growth | −11.2% | — |
| Technology & Value-Added Services internal growth | +7.2% | — |
| Adjusted EPS growth | — | +11%–15% |
| Adjusted EBITDA growth | — | >15% |
| Estimated residual cyber impact | — | About $0.15 per diluted share, primarily Q1 |
Sources: P1, Item 7, printed pp. 50–52; P2, Feb. 27 results release, paragraphs 6–16. Internal growth is the company’s local-currency measure excluding acquisitions; 2023 comparisons adjust for an extra week in 2022. The 2024 figures are management forecasts.
Exhibit 2. The incident: scope and financial disclosures
| Disclosure | What the company reported by cutoff |
|---|---|
| Operational scope | Primarily North American and European dental and medical distribution; Henry Schein One unaffected; manufacturing mostly unaffected |
| Recovery status | Affected systems restored, distribution resumed, e-commerce reactivated; related Nov. 22 e-commerce disruption remediated |
| Information exposure | Threat actor obtained certain third-party personal/sensitive information; scope remained under investigation |
| Estimated earnings impact | $0.70–$0.75 per diluted share on Q4 and FY2023 GAAP and non-GAAP net income, attributed to business interruption and recovery |
| Direct expenses | $11m in 2023, mostly professional fees |
| Insurance disclosure | $60m policy after $5m retention, subject to policy limitations; no actual proceeds amount stated in the cited note |
Sources: P1, Item 1A, printed p. 29; Item 7, printed p. 54; Note 2, printed p. 81; P2, Q4 and FY2023 results paragraphs 2–3 and 6–10. The measures differ in scope and must not be combined without additional information.
Exhibit 3. Supplier and customer context
- More than 1 million customers worldwide; more than 25,000 employees.
- The top ten distribution suppliers represented approximately 24%–25% of aggregate purchases, depending on which 10-K section is used; the largest supplier was reported as 4% in both sections.
- Henry Schein generally does not have long-term contracts with suppliers.
- Almost all orders ship through third-party delivery services; expedited delivery is part of the company’s customer proposition.
Sources: P1, Item 1, printed p. 4; Item 1A, printed pp. 21–22. The filing does not disclose product-level critical-supplier substitution, order losses, or incident effects on carriers.
Source key
- P1: Henry Schein, Inc. 2023 Form 10-K, filed Feb. 28, 2024, accession 0001000228-24-000011. SEC filing.
- P2: Henry Schein, “Reports Fourth Quarter and Full Year 2023 Financial Results and Introduces 2024 Financial Guidance,” Feb. 27, 2024. Issuer release.
- P3: Henry Schein, “Provides Information on Cybersecurity Incident,” Oct. 15, 2023. Issuer release.