Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


Data Breaches Drive Higher Loan Interest Rates

Businesses that suffer a security breach may not see their stock price tumble, but they may pay higher rates for loans and be forced to provide collateral, researchers report.

Companies that experience a data breach may not suffer a long-term drop in stock price, but will often have to pay higher loan interest rates and grant other concessions, according to a study published this week. 

The academic study, conducted by researchers at Yeshiva University in New York City and Hong Kong Polytechnic University, found the average company paid almost $3.7 million more in interest every year. Businesses with a strong reputation for IT security, which often have more favorable loan terms compared to their peers, suffered more following a breach.

Related Content:

Data Breach Can Affect Company's Long-Term Stock Price

Special Report: Assessing Cybersecurity Risk in Today's Enterprises

New From The Edge: A View From Inside a Deception

These results underscore how banks charge companies for the uncertainty following a breach, says Henry Huang, an associate professor of accounting at Yeshiva University's business school.

"After a breach, because of the direct and indirect costs, there is a lot of uncertainty in respect [to] the company's future," he says. "What happens with regulatory action? What happens with litigation? What happens if a major customer leaves? It's uncertainty, and banks hate uncertainty."

This study is the latest to attempt to quantify the impact data breaches have on companies. In April, an IOActive researcher found that a data loss event typically leads to a 5% drop in stock price, but almost two-thirds of companies recover in a month. Vulnerability disclosure causes a 4% drop in stock price, but the impact does not last more than a month, that study found.

While investors are forgiving when it comes to data breaches, banks are not, according to the study by Yeshiva University and Hong Kong Polytechnic University. In addition to higher loan interest rates, many banks required collateral or forced companies to meet other requirements.

There is good news for companies that suffer a breach: Banks rewarded those that took strong actions to improve security and mitigate the impact of the breach, researchers found.

The study "identified remedial actions that mitigated the adverse impact of data breaches," Chong Wang, co-author of the study and an assistant professor of accounting at Hong Kong Polytechnic University, said in a statement. "One take-away message is that firms, especially those in vulnerable industries, should invest more in data security in order to avoid costly punishment in capital markets."

Researchers evaluated 139 breach events between 2005 and 2014, and 1,081 bank loans throughout that period as well as two years before and after, examining the impact of data breaches on loan terms. Noting that previous studies have connected internal control weaknesses (ICWs) with unfavorable bank loan terms, the researchers posited that data breaches indicate previously hidden ICWs and would likely lead to higher bank loan rates and other concessions. 

The study did find that the average company that suffered a breach paid $3.7 million extra in interest costs each year on the average loan of $923 million. In fact, breached firms pay an average of 40 basis points, or about 0.4 percentage points, higher interest rates than the average for all companies, compared to 28 basis points for firms with internal control weaknesses. Only financial restatement carried a higher penalty: 65 basis points, according to the study.

"The results suggest that before the data breaches, breached and non-breached firms do not exhibit significant differences in bank loan terms," the researchers' paper stated. "However, after the data breaches, the breached firms have higher loan spreads and a higher likelihood of collateral requirement, and they provide more covenants than non-breached firms."

Researchers also found that criminal breaches, as opposed to accidental data leaks, result in harsher loan terms, as do higher breached record counts. Companies in highly regulated industries, such as healthcare, transportation, personal services, or business services, suffer higher penalties, perhaps linked to their higher customer churn rates following a breach.

Finally, stronger breach reporting requirements in certain states and countries resulted in higher loan rates and more significant concessions to qualify for a loan.

"Companies who have to disclose the nature and the scope of data breaches, could be subject to fines and lawsuits, so they become more high profile and the market pays more attention," says Yeshiva University's Huang. "From the banks' perspective, they can take additional time to investigate, while investors forget in the long term."

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
How Enterprises are Attacking the Cybersecurity Problem
Concerns over supply chain vulnerabilities and attack visibility drove some significant changes in enterprise cybersecurity strategies over the past year. Dark Reading's 2021 Strategic Security Survey showed that many organizations are staying the course regarding the use of a mix of attack prevention and threat detection technologies and practices for dealing with cyber threats.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-10-28
There is a Register tampering vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may allow the register value to be modified.
PUBLISHED: 2021-10-28
There is a Memory out-of-bounds access vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause malicious code to be executed.
PUBLISHED: 2021-10-28
There is a issue of IP address spoofing in Huawei Smartphone. Successful exploitation of this vulnerability may cause DoS.
PUBLISHED: 2021-10-28
There is a SSID vulnerability with Wi-Fi network connections in Huawei devices.Successful exploitation of this vulnerability may affect service confidentiality.
PUBLISHED: 2021-10-28
There is a issue of Unstandardized field names in Huawei Smartphone. Successful exploitation of this vulnerability may affect service confidentiality.