Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


End of Bibblio RCM includes -->

Data Breaches Drive Higher Loan Interest Rates

Businesses that suffer a security breach may not see their stock price tumble, but they may pay higher rates for loans and be forced to provide collateral, researchers report.

Companies that experience a data breach may not suffer a long-term drop in stock price, but will often have to pay higher loan interest rates and grant other concessions, according to a study published this week. 

The academic study, conducted by researchers at Yeshiva University in New York City and Hong Kong Polytechnic University, found the average company paid almost $3.7 million more in interest every year. Businesses with a strong reputation for IT security, which often have more favorable loan terms compared to their peers, suffered more following a breach.

Related Content:

Data Breach Can Affect Company's Long-Term Stock Price

Special Report: Assessing Cybersecurity Risk in Today's Enterprises

New From The Edge: A View From Inside a Deception

These results underscore how banks charge companies for the uncertainty following a breach, says Henry Huang, an associate professor of accounting at Yeshiva University's business school.

"After a breach, because of the direct and indirect costs, there is a lot of uncertainty in respect [to] the company's future," he says. "What happens with regulatory action? What happens with litigation? What happens if a major customer leaves? It's uncertainty, and banks hate uncertainty."

This study is the latest to attempt to quantify the impact data breaches have on companies. In April, an IOActive researcher found that a data loss event typically leads to a 5% drop in stock price, but almost two-thirds of companies recover in a month. Vulnerability disclosure causes a 4% drop in stock price, but the impact does not last more than a month, that study found.

While investors are forgiving when it comes to data breaches, banks are not, according to the study by Yeshiva University and Hong Kong Polytechnic University. In addition to higher loan interest rates, many banks required collateral or forced companies to meet other requirements.

There is good news for companies that suffer a breach: Banks rewarded those that took strong actions to improve security and mitigate the impact of the breach, researchers found.

The study "identified remedial actions that mitigated the adverse impact of data breaches," Chong Wang, co-author of the study and an assistant professor of accounting at Hong Kong Polytechnic University, said in a statement. "One take-away message is that firms, especially those in vulnerable industries, should invest more in data security in order to avoid costly punishment in capital markets."

Researchers evaluated 139 breach events between 2005 and 2014, and 1,081 bank loans throughout that period as well as two years before and after, examining the impact of data breaches on loan terms. Noting that previous studies have connected internal control weaknesses (ICWs) with unfavorable bank loan terms, the researchers posited that data breaches indicate previously hidden ICWs and would likely lead to higher bank loan rates and other concessions. 

The study did find that the average company that suffered a breach paid $3.7 million extra in interest costs each year on the average loan of $923 million. In fact, breached firms pay an average of 40 basis points, or about 0.4 percentage points, higher interest rates than the average for all companies, compared to 28 basis points for firms with internal control weaknesses. Only financial restatement carried a higher penalty: 65 basis points, according to the study.

"The results suggest that before the data breaches, breached and non-breached firms do not exhibit significant differences in bank loan terms," the researchers' paper stated. "However, after the data breaches, the breached firms have higher loan spreads and a higher likelihood of collateral requirement, and they provide more covenants than non-breached firms."

Researchers also found that criminal breaches, as opposed to accidental data leaks, result in harsher loan terms, as do higher breached record counts. Companies in highly regulated industries, such as healthcare, transportation, personal services, or business services, suffer higher penalties, perhaps linked to their higher customer churn rates following a breach.

Finally, stronger breach reporting requirements in certain states and countries resulted in higher loan rates and more significant concessions to qualify for a loan.

"Companies who have to disclose the nature and the scope of data breaches, could be subject to fines and lawsuits, so they become more high profile and the market pays more attention," says Yeshiva University's Huang. "From the banks' perspective, they can take additional time to investigate, while investors forget in the long term."

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Threaded  |  Newest First  |  Oldest First
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
How Machine Learning, AI & Deep Learning Improve Cybersecurity
Machine intelligence is influencing all aspects of cybersecurity. Organizations are implementing AI-based security to analyze event data using ML models that identify attack patterns and increase automation. Before security teams can take advantage of AI and ML tools, they need to know what is possible. This report covers: -How to assess the vendor's AI/ML claims -Defining success criteria for AI/ML implementations -Challenges when implementing AI
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2022-10-01
SonicJS through 0.6.0 allows file overwrite. It has the following mutations that are used for updating files: fileCreate and fileUpdate. Both of these mutations can be called without any authentication to overwrite any files on a SonicJS application, leading to Arbitrary File Write and Delete.
PUBLISHED: 2022-09-30
### Impact In a CSRF attack, an innocent end user is tricked by an attacker into submitting a web request that they did not intend. This may cause actions to be performed on the website that can include inadvertent client or server data leakage, change of session state, or manipulation of an end use...
PUBLISHED: 2022-09-30
Dell Hybrid Client prior to version 1.8 contains a Regular Expression Denial of Service Vulnerability in the UI. An adversary with WMS group admin access could potentially exploit this vulnerability, leading to temporary denial-of-service.
PUBLISHED: 2022-09-30
Dell Hybrid Client below 1.8 version contains a Zip Slip Vulnerability in UI. A guest privilege attacker could potentially exploit this vulnerability, leading to system files modification.
PUBLISHED: 2022-09-30
A vulnerability in the LIEF::MachO::SegmentCommand::virtual_address function of LIEF v0.12.1 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted MachO file.