Vincit’s Q4 revenue and operating profit were still weak, but nevertheless exceeded our low expectations. The beginning of the year still seems difficult, but efficiency measures should support profitability and lay the groundwork for earnings growth. However, it is important for the company to turn revenue back onto a growth path, so that earnings growth would be on a stronger footing in the future and new efficiency measures could be avoided. The stock’s valuation is attractive (2025e EV/EBIT 8x), considering the low forecasts and earnings potential in a “normal” market.
A bit more detailed information on the implementation method:
According to investigations, the username and password used in the attack had been saved in an employee’s home computer browser through the password synchronization function. Synchronization allows the user to utilize the same credentials and passwords on the same browser across different devices.
Measures initiated:
Information security has been elevated as one of Vincit’s key priorities for the current year, which is reflected, among other things, in the company’s launched Secure Vincit 2025 program.
And related to this program, for example:
Vincit’s cybersecurity partners include DNV (Nixu) and KPMG, with whom the company will conduct regular audits and penetration testing in the future. Vincit also plans to acquire 24/7 SOC (Security Operations Center) security monitoring from a service provider, which will improve its ability to detect and repel cyber threats in real-time.
A really great thing. Of course, actors who have taken information/cybersecurity seriously have paid attention to these matters already ten years ago, but it’s always better to act late than never. Unfortunately, in this case, it also smells like action was taken because it was necessary, a.k.a. the shit hit the fan and there was unpleasant publicity.
I read that Tivi article. According to it, Vincit says it was a human error. I disagree. Firstly, VPN software was used, whose password is saved in the browser. Secondly, the VPN was configured in such a way that multi-factor authentication was not in use.
Neither of these is a human error, but rather lax practices on the part of either Valio or Vincit. When such vulnerabilities are left open, it’s foolish to blame the incident on human error and thus incriminate the person in question.
No MFA enforcement, a really basic mistake, nowadays a minimum requirement when talking about logging in.
I don’t know what kind of VPN setup was used, I was wondering how on earth VPN passwords could be in the browser, but most likely the VPN is logged into with domain credentials that have been saved in the browser in some other context and then used, in any case, this is also a blunder.
All production systems should only be accessible from certain IP addresses and certain MAC addresses, which is why it is quite common to use so-called jump servers whose IP and MAC are authorized to access the production environment. And then this jump server is protected with separate passwords and strong authentications. Apparently, this was not used in this case either - a big blunder that goes especially to Valio’s account.
So yes, there have been a lot of blunders here; human errors happen all the time, which is why there must be systems that protect against these errors. No system is 100% protected, but in this case, far too many errors have been made, which is why the breach occurred.
Let it be said that Vincit quite smartly leaves the explanation at a rather high level and doesn’t throw the client under the bus; the biggest blunders have occurred specifically on Valio’s side.
It will be very interesting to see what the Data Protection Ombudsman’s office’s stance will be regarding the consequences. Indeed, based on the information that has been made public, it didn’t go “quite” perfectly. And a more detailed investigation may then reveal (or not reveal) more from beneath the surface.
Vincit announced on February 25, 2025, that it would initiate change negotiations, which have now concluded. The change negotiations concerned the personnel of the company’s service businesses and IT support functions in Finland.
A total of approximately 500 employees were within the scope of the change negotiations. At the start of the negotiations, Vincit estimated that the change negotiations could lead to the termination of employment for a maximum of 50 employees. As a result of the change negotiations, the employment of a total of 35 people from the company’s service businesses will be terminated. In addition, as part of the change negotiations, Vincit carried out a planned broader outsourcing of IT support functions, as a result of which the employment of three people transferred to the service provider.
The goal of the negotiations was to adapt Vincit’s operations to the changed operating environment and to improve the company’s competitiveness and profitability. Through the change negotiations, Vincit estimates it will achieve savings of approximately 1.4 million euros for 2025.
One-time costs related to the changes are approximately 0.5 million euros, and they will be recorded as items affecting comparability in the second quarter of 2025.
Joni is anticipating because Vincit will publish its business review next Thursday.
Last year was challenging for the company, as was the beginning of this year. We estimate that Vincit’s revenue clearly decreased and profitability was very weak in Q1. In addition, we are monitoring market comments and cost development. Vincit’s fixed costs have been clearly higher than those of its peers, which, in our estimation, limits the company’s competitiveness. The company conducted change negotiations in Q1, but these will only support profitability from Q2 onwards.
Joni interviewed CEO Manni after the Q1 report release.
Topics:
00:00 Introduction
00:14 Development in the Nordics
01:36 Change negotiations
02:50 US market
05:15 Cost structure in the US
06:17 Lessons learned from US challenges
09:02 Adjusting costs
11:00 SAP business in Finland
14:20 Positive signals in software development
16:38 Investment willingness of the private and public sectors
Mr. Grönqvist has prepared a new company report on Vincit after Q1.
Vincit’s Q1 revenue and profit fell short of forecasts and remained very weak. The development of the US business, in particular, was dismal, and the company made strong arrangements to break the losing streak. We forecast revenue to continue to decline significantly, but efficiency measures to support profitability in 2025. Going forward, it is important for the company to turn revenue back to a growth trajectory so that earnings growth would be on a stronger footing and new efficiency measures would be avoided. The stock’s valuation is attractive (2025e EV/EBIT 8x), considering the low forecasts and earnings potential in a ‘normal’ market.
Quoted from the report:
Examined by expense line, other operating expenses were 21% of revenue, which is still a very high level, considering that the sector operates with half of that expense mass. In our view, this is a clear area for savings that should be utilized to achieve even satisfactory profitability figures. The company did mention several small savings measures in other operating expenses, but the scale is still unclear. It is quite possible that cost savings would require more robust strategic solutions to bring the expense item to a competitive level. Now that the company reports expense items more precisely on a quarterly basis, we will monitor the development of expenses, and especially other operating expenses, more closely.
Here are Joni’s comments as Vincit publishes its half-year report next week on Thursday.
Vincit will publish its half-year report on Thursday, estimated at 9:00 AM. Last year was challenging for the company, as was the beginning of this year. We predict Vincit’s revenue to have decreased significantly in Q2. We expect profitability to have improved driven by efficiency measures, but to have remained weak in Q2. Additionally, we are monitoring market comments and cost development. Vincit’s fixed costs have been clearly higher than those of its peers, which, in our estimation, limits the company’s competitiveness. The company will transition to IFRS reporting starting from H1’25, and we have adjusted our forecasts accordingly.
Joni has diligently prepared a new company report after Q2.
We lower our target price to EUR 1.7 (previously 2.0) reflecting forecast changes and our recommendation to Reduce (previously Add). Vincit’s Q2 was a clear disappointment in terms of revenue and profit. The company is in a difficult situation, as revenue is declining sharply and efficiency measures are understandably lagging behind. It is important for the company to turn revenue back to a growth path so that the result can be put on a firmer footing in the future and new efficiency measures can be avoided. However, no clear pick-up in the market or the company’s business is yet in sight. Although the stock’s valuation is not very tight and there is potential if a turnaround succeeds, the risk-reward ratio is not currently attractive.
Joni has prepared a new comprehensive report on Vincit. As usual, this, like other comprehensive reports, is available for everyone to read. If Vincit doesn’t interest you, but the industry does, it’s worth reading, as the comprehensive report also includes an excellent industry overview.
Vincit, an IT service company, formed its current structure through the Bilot merger, which brought broader expertise, geographical presence, and improved competitiveness. However, due to market changes, the company has undergone a significant transformation over the past two years, which is still partially ongoing. The new financial targets are ambitious and, in our view, require support from a better market situation. We predict 2025 will still be difficult, but performance levels will gradually improve in the coming years. The stock’s valuation picture is challenging (2026e P/E 12x).
In the short term, geopolitical and general economic uncertainty, as well as the company’s ongoing transformation, continue to create clear uncertainty for Vincit’s business and our forecasts. The sector’s bottom seems to be near, but there is no better visibility yet regarding an improvement in market conditions. Vincit’s key risks relate to its US business, the ongoing transformation, the potential disruptive threat of artificial intelligence, the profitability turnaround, and internationalization.
