Why Moody's said rated organisations are seeing increasing cyber threats

Indian Express

6 hours ago

Cyberattacks have surged in recent years, posing a risk to the creditworthiness of debt issuers that Moody's rates, the ratings agency said in a report. A survey of cybersecurity incidents affecting 9,600 rated debt issuers globally by Moody's showed that the number of organisations experiencing cyber incidents has steadily increased, from an annual rate of 4-5% prior to 2019 to approximately 7% since 2020.
This surge, which poses a rising risk to creditworthiness, is primarily driven by indirect attacks originating from third-party software providers. With advancements in artificial intelligence expected to heighten the volume and sophistication of attacks, coupled with increasingly intricate supply chain dependencies, Moody's projects this trend could persist.
While direct impacts on credit ratings have been limited to 14 organisations, three of these occurred in the past year alone, affecting prominent entities such as Mount Sinai Hospital, Financiere Verdi I S.A.S. (Ethypharm), and Ascension Health Alliance due to disruptions in operations or collections stemming from ransomware attacks. These entities received a worse revised rating from Moody's after facing cyber attacks.
The persistent nature of cyber vulnerability
The Moody's analysis underscored a troubling pattern: a past cyber incident significantly correlates with an increased likelihood of future breaches. One in three organisations examined since 2015 had experienced at least one incident. Crucially, for those affected, one in four encountered another incident within a year, and one in three within two years.
Organisations experiencing a cyber incident in one year are four to five times more likely to face another in subsequent years compared to those previously unaffected, Moody's said.
The agency said that several interconnected factors were contributing to this persistent vulnerability. Organisations may fail to adequately address initial root causes, implement insufficient remediation, or delay critical patching after a breach. Further, media attention following an incident can inadvertently highlight vulnerabilities, attracting repeat attacks.
Sectoral hotspots
The study identifies significant variation in incident frequency and recurrence across different sectors. Not-for-profit hospitals exhibited the highest rates, with 42% experiencing at least one incident since 2022, and 14% suffering multiple incidents within a year. This is largely attributed to the critical nature of their services, the sensitive healthcare data they manage, and often constrained cybersecurity resources.
Public-sector housing ranked second in frequency, yet led in recurrence, with 26% of entities facing more than one incident within a year, likely due to ongoing challenges in modernising legacy IT systems.
Education and not-for-profit organisations, along with the telecommunications sector, also saw high attack rates, presumably due to them handling critical data and sometimes weaker cyber defences. For example, 31% of telecommunications issuers in the study experienced a cyber incident since 2022, with 11% facing repeat attacks.
Despite often stronger cyber diligence and governance, banks also display one of the highest recurrence rates relative to impact, suggesting either highly targeted attacks or stringent disclosure requirements that increase visibility.
Soumyarendra Barik is Special Correspondent with The Indian Express and reports on the intersection of technology, policy and society. With over five years of newsroom experience, he has reported on issues of gig workers' rights, privacy, India's prevalent digital divide and a range of other policy interventions that impact big tech companies. He once also tailed a food delivery worker for over 12 hours to quantify the amount of money they make, and the pain they go through while doing so. In his free time, he likes to nerd about watches, Formula 1 and football. ... Read More