Dish Network has never explained what exactly happened with a cybersecurity incident on February 23, which affected its internal communications, customer call centers and internet sites. The company said some data was extracted from its IT systems, but it has not yet made any public statement clarifying whether it was a ransomware attack or whether sensitive customer data, such as credit card information, was stolen.
It appears the company has made some progress restoring its sites. This morning, the Boost Infinite website has a message, saying “Thank you for your patience.” It said forensic investigators were still assessing the incident, but that its customer service call support has been restored. Customers can also activate new service, manage their account and get chat support through the Boost Infinite app.
The Boost Mobile website has a message at the bottom, saying “Good news, we're back to normal.” But it said that due to higher-than-normal call volume, calls to customer care may have longer-than-average wait times.
Dish did not reply to a request for comment for this story. (**See update below)
The company’s relative lack of transparency about its cybersecurity problems seems to have spooked investors. Dish’s stock was trading at $13.76 on February 23. And this morning it’s trading at about $9.25, a five-year low.
The analysts at New Street Research led by Jonathan Chaplin have updated their models for Dish Network in light of the cybersecurity incident.
“The hack impacted the Boost and [direct broadcast satellite] DBS businesses, bringing installations, disconnects, bill payments, and customer care to a standstill for three weeks,” wrote New Street. “We assume it had a bigger impact on Boost because pre-paid customers may be automatically disconnected if they don’t pay their bills. With customers unable to pay bills, the company unable to reinstate service, and customer care offline, affected subs will have signed up for service elsewhere.”
The analysts lowered their projections for DBS adds by 75,000 for the first quarter of 2023, and they lowered their projections for Boost adds by 200,000 for Q1. They assume that billing issues lowered average revenue per user (ARPU), as well.
This isn’t good for either of those businesses — DBS or mobile — which were both seeing subscriber declines in recent quarters.
In addition, New Street is assuming hack-related costs of $75 million and bad debt of $70 million in addition to losses from delayed payments.
But the analysts said the biggest impact will be from the loss of near-term free cash flow on Dish’s funding needs, likely widening its funding gap to build out its new 5G wireless network.
“This isn’t enough of a change to materially impact our thesis,” wrote New Street. “Dish investors should prepare to be patient.”
**Update: After publication of this story, a Dish spokesperson sent an email to Fierce, saying, "DISH TV customers can now make a payment through a secure payment form on our website or by mail. In addition, our in-home technicians are visiting homes and assisting customers with new and existing services. Boost Mobile customers can pay their bill and have normal account functionality on my.boostmobile.com and at Boost Mobile stores. Payments can also be made on the MyBoost or BoostOne apps."