Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


Data Breaches Drive Higher Loan Interest Rates

Businesses that suffer a security breach may not see their stock price tumble, but they may pay higher rates for loans and be forced to provide collateral, researchers report.

Companies that experience a data breach may not suffer a long-term drop in stock price, but will often have to pay higher loan interest rates and grant other concessions, according to a study published this week. 

The academic study, conducted by researchers at Yeshiva University in New York City and Hong Kong Polytechnic University, found the average company paid almost $3.7 million more in interest every year. Businesses with a strong reputation for IT security, which often have more favorable loan terms compared to their peers, suffered more following a breach.

Related Content:

Data Breach Can Affect Company's Long-Term Stock Price

Special Report: Assessing Cybersecurity Risk in Today's Enterprises

New From The Edge: A View From Inside a Deception

These results underscore how banks charge companies for the uncertainty following a breach, says Henry Huang, an associate professor of accounting at Yeshiva University's business school.

"After a breach, because of the direct and indirect costs, there is a lot of uncertainty in respect [to] the company's future," he says. "What happens with regulatory action? What happens with litigation? What happens if a major customer leaves? It's uncertainty, and banks hate uncertainty."

This study is the latest to attempt to quantify the impact data breaches have on companies. In April, an IOActive researcher found that a data loss event typically leads to a 5% drop in stock price, but almost two-thirds of companies recover in a month. Vulnerability disclosure causes a 4% drop in stock price, but the impact does not last more than a month, that study found.

While investors are forgiving when it comes to data breaches, banks are not, according to the study by Yeshiva University and Hong Kong Polytechnic University. In addition to higher loan interest rates, many banks required collateral or forced companies to meet other requirements.

There is good news for companies that suffer a breach: Banks rewarded those that took strong actions to improve security and mitigate the impact of the breach, researchers found.

The study "identified remedial actions that mitigated the adverse impact of data breaches," Chong Wang, co-author of the study and an assistant professor of accounting at Hong Kong Polytechnic University, said in a statement. "One take-away message is that firms, especially those in vulnerable industries, should invest more in data security in order to avoid costly punishment in capital markets."

Researchers evaluated 139 breach events between 2005 and 2014, and 1,081 bank loans throughout that period as well as two years before and after, examining the impact of data breaches on loan terms. Noting that previous studies have connected internal control weaknesses (ICWs) with unfavorable bank loan terms, the researchers posited that data breaches indicate previously hidden ICWs and would likely lead to higher bank loan rates and other concessions. 

The study did find that the average company that suffered a breach paid $3.7 million extra in interest costs each year on the average loan of $923 million. In fact, breached firms pay an average of 40 basis points, or about 0.4 percentage points, higher interest rates than the average for all companies, compared to 28 basis points for firms with internal control weaknesses. Only financial restatement carried a higher penalty: 65 basis points, according to the study.

"The results suggest that before the data breaches, breached and non-breached firms do not exhibit significant differences in bank loan terms," the researchers' paper stated. "However, after the data breaches, the breached firms have higher loan spreads and a higher likelihood of collateral requirement, and they provide more covenants than non-breached firms."

Researchers also found that criminal breaches, as opposed to accidental data leaks, result in harsher loan terms, as do higher breached record counts. Companies in highly regulated industries, such as healthcare, transportation, personal services, or business services, suffer higher penalties, perhaps linked to their higher customer churn rates following a breach.

Finally, stronger breach reporting requirements in certain states and countries resulted in higher loan rates and more significant concessions to qualify for a loan.

"Companies who have to disclose the nature and the scope of data breaches, could be subject to fines and lawsuits, so they become more high profile and the market pays more attention," says Yeshiva University's Huang. "From the banks' perspective, they can take additional time to investigate, while investors forget in the long term."

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Cyberattacks Are Tailored to Employees ... Why Isn't Security Training?
Tim Sadler, CEO and co-founder of Tessian,  6/17/2021
7 Powerful Cybersecurity Skills the Energy Sector Needs Most
Pam Baker, Contributing Writer,  6/22/2021
Microsoft Disrupts Large-Scale BEC Campaign Across Web Services
Kelly Sheridan, Staff Editor, Dark Reading,  6/15/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-23
Vulnerability in OpenGrok (component: Web App). Versions that are affected are 1.6.7 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise OpenGrok. Successful attacks of this vulnerability can result in takeover of OpenGrok. CVSS 3.1 ...
PUBLISHED: 2021-06-23
A vulnerability in SonicOS where the HTTP server response leaks partial memory by sending a crafted HTTP request, this can potentially lead to an internal sensitive data disclosure vulnerability.
PUBLISHED: 2021-06-23
A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities.
PUBLISHED: 2021-06-23
Heap based buffer overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a crafted file.
PUBLISHED: 2021-06-23
Heap based buffer overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a crafted file.