Data Breaches Drive Higher Loan Interest Rates

Companies that experience a data breach may not suffer a long-term drop in stock price, but will often have to pay higher loan interest rates and grant other concessions, according to a study published this week.

The academic study, conducted by researchers at Yeshiva University in New York City and Hong Kong Polytechnic University, found the average company paid almost $3.7 million more in interest every year. Businesses with a strong reputation for IT security, which often have more favorable loan terms compared to their peers, suffered more following a breach.

These results underscore how banks charge companies for the uncertainty following a breach, says Henry Huang, an associate professor of accounting at Yeshiva University's business school.

"After a breach, because of the direct and indirect costs, there is a lot of uncertainty in respect [to] the company's future," he says. "What happens with regulatory action? What happens with litigation? What happens if a major customer leaves? It's uncertainty, and banks hate uncertainty."

This study is the latest to attempt to quantify the impact data breaches have on companies. In April, an IOActive researcher found that a data loss event typically leads to a 5% drop in stock price, but almost two-thirds of companies recover in a month. Vulnerability disclosure causes a 4% drop in stock price, but the impact does not last more than a month, that study found.

While investors are forgiving when it comes to data breaches, banks are not, according to the study by Yeshiva University and Hong Kong Polytechnic University. In addition to higher loan interest rates, many banks required collateral or forced companies to meet other requirements.

There is good news for companies that suffer a breach: Banks rewarded those that took strong actions to improve security and mitigate the impact of the breach, researchers found.

The study "identified remedial actions that mitigated the adverse impact of data breaches," Chong Wang, co-author of the study and an assistant professor of accounting at Hong Kong Polytechnic University, said in a statement. "One take-away message is that firms, especially those in vulnerable industries, should invest more in data security in order to avoid costly punishment in capital markets."

Researchers evaluated 139 breach events between 2005 and 2014, and 1,081 bank loans throughout that period as well as two years before and after, examining the impact of data breaches on loan terms. Noting that previous studies have connected internal control weaknesses (ICWs) with unfavorable bank loan terms, the researchers posited that data breaches indicate previously hidden ICWs and would likely lead to higher bank loan rates and other concessions.

The study did find that the average company that suffered a breach paid $3.7 million extra in interest costs each year on the average loan of $923 million. In fact, breached firms pay an average of 40 basis points, or about 0.4 percentage points, higher interest rates than the average for all companies, compared to 28 basis points for firms with internal control weaknesses. Only financial restatement carried a higher penalty: 65 basis points, according to the study.

"The results suggest that before the data breaches, breached and non-breached firms do not exhibit significant differences in bank loan terms," the researchers' paper stated. "However, after the data breaches, the breached firms have higher loan spreads and a higher likelihood of collateral requirement, and they provide more covenants than non-breached firms."

Researchers also found that criminal breaches, as opposed to accidental data leaks, result in harsher loan terms, as do higher breached record counts. Companies in highly regulated industries, such as healthcare, transportation, personal services, or business services, suffer higher penalties, perhaps linked to their higher customer churn rates following a breach.

Finally, stronger breach reporting requirements in certain states and countries resulted in higher loan rates and more significant concessions to qualify for a loan.

"Companies who have to disclose the nature and the scope of data breaches, could be subject to fines and lawsuits, so they become more high profile and the market pays more attention," says Yeshiva University's Huang. "From the banks' perspective, they can take additional time to investigate, while investors forget in the long term."