Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

Data Breaches Drive Higher Loan Interest Rates

Businesses that suffer a security breach may not see their stock price tumble, but they may pay higher rates for loans and be forced to provide collateral, researchers report.

Companies that experience a data breach may not suffer a long-term drop in stock price, but will often have to pay higher loan interest rates and grant other concessions, according to a study published this week. 

The academic study, conducted by researchers at Yeshiva University in New York City and Hong Kong Polytechnic University, found the average company paid almost $3.7 million more in interest every year. Businesses with a strong reputation for IT security, which often have more favorable loan terms compared to their peers, suffered more following a breach.

Related Content:

Data Breach Can Affect Company's Long-Term Stock Price

Special Report: Assessing Cybersecurity Risk in Today's Enterprises

New From The Edge: A View From Inside a Deception

These results underscore how banks charge companies for the uncertainty following a breach, says Henry Huang, an associate professor of accounting at Yeshiva University's business school.

"After a breach, because of the direct and indirect costs, there is a lot of uncertainty in respect [to] the company's future," he says. "What happens with regulatory action? What happens with litigation? What happens if a major customer leaves? It's uncertainty, and banks hate uncertainty."

This study is the latest to attempt to quantify the impact data breaches have on companies. In April, an IOActive researcher found that a data loss event typically leads to a 5% drop in stock price, but almost two-thirds of companies recover in a month. Vulnerability disclosure causes a 4% drop in stock price, but the impact does not last more than a month, that study found.

While investors are forgiving when it comes to data breaches, banks are not, according to the study by Yeshiva University and Hong Kong Polytechnic University. In addition to higher loan interest rates, many banks required collateral or forced companies to meet other requirements.

There is good news for companies that suffer a breach: Banks rewarded those that took strong actions to improve security and mitigate the impact of the breach, researchers found.

The study "identified remedial actions that mitigated the adverse impact of data breaches," Chong Wang, co-author of the study and an assistant professor of accounting at Hong Kong Polytechnic University, said in a statement. "One take-away message is that firms, especially those in vulnerable industries, should invest more in data security in order to avoid costly punishment in capital markets."

Researchers evaluated 139 breach events between 2005 and 2014, and 1,081 bank loans throughout that period as well as two years before and after, examining the impact of data breaches on loan terms. Noting that previous studies have connected internal control weaknesses (ICWs) with unfavorable bank loan terms, the researchers posited that data breaches indicate previously hidden ICWs and would likely lead to higher bank loan rates and other concessions. 

The study did find that the average company that suffered a breach paid $3.7 million extra in interest costs each year on the average loan of $923 million. In fact, breached firms pay an average of 40 basis points, or about 0.4 percentage points, higher interest rates than the average for all companies, compared to 28 basis points for firms with internal control weaknesses. Only financial restatement carried a higher penalty: 65 basis points, according to the study.

"The results suggest that before the data breaches, breached and non-breached firms do not exhibit significant differences in bank loan terms," the researchers' paper stated. "However, after the data breaches, the breached firms have higher loan spreads and a higher likelihood of collateral requirement, and they provide more covenants than non-breached firms."

Researchers also found that criminal breaches, as opposed to accidental data leaks, result in harsher loan terms, as do higher breached record counts. Companies in highly regulated industries, such as healthcare, transportation, personal services, or business services, suffer higher penalties, perhaps linked to their higher customer churn rates following a breach.

Finally, stronger breach reporting requirements in certain states and countries resulted in higher loan rates and more significant concessions to qualify for a loan.

"Companies who have to disclose the nature and the scope of data breaches, could be subject to fines and lawsuits, so they become more high profile and the market pays more attention," says Yeshiva University's Huang. "From the banks' perspective, they can take additional time to investigate, while investors forget in the long term."

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
What the FedEx Logo Taught Me About Cybersecurity
Matt Shea, Head of Federal @ MixMode,  6/4/2021
Edge-DRsplash-10-edge-articles
A View From Inside a Deception
Sara Peters, Senior Editor at Dark Reading,  6/2/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-23394
PUBLISHED: 2021-06-13
The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP.
CVE-2021-34682
PUBLISHED: 2021-06-12
Receita Federal IRPF 2021 1.7 allows a man-in-the-middle attack against the update feature.
CVE-2021-31811
PUBLISHED: 2021-06-12
In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
CVE-2021-31812
PUBLISHED: 2021-06-12
In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
CVE-2021-32552
PUBLISHED: 2021-06-12
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-16 package apport hooks, it could expose private data to other local users.