KUALA LUMPUR (April 21):Cyber-attacks against financial institutions are an increasingly significant risk, according to Fitch Ratings.

In a report titled "Cybersecurity an Increasing Focus for Financial Institutions" released yesterday, the rating agency said cyber risk is a growing threat that can adversely affect credit ratings as attacks can compromise customer data and disrupt websites, with detrimental financial or operational consequences for individual issuers and financial systems.

It said related reputational damage may weaken business and access to funding and capital markets.

“In one of the latest reported attacks, payday lender Wonga said earlier this month that up to 270,000 customers in the UK and Poland may have been affected by a data breach.

“We believe that institutions with substantial consumer lending businesses and deposit franchises are most at risk of financially motivated attacks due to the scope for theft from customer accounts and the large volume of personal data they hold,” it said.

However, Fitch Ratings said larger institutions typically have stronger risk controls and regulatory oversight, mitigating some of the risks.

The report said that institutions that provide trade execution, clearing and settlement services are more vulnerable to disruptively motivated attacks, due to their interconnectivity with the financial system.

It said regulators have been increasingly vocal on cybersecurity and have urged cyber-attack stress testing. The chair of the U.S. Securities and Exchange Commission stated in 2016 that cybersecurity is the biggest risk to the U.S. financial system.

“Under the EU's General Data Protection Regulation, which takes effect in May 2018, banks face potentially large fines - up to 4% of their global turnover - for security breaches of personal data. All organisations that use data from EU citizens must comply, regardless of their domicile,”

“We believe that industry collaboration that has been in place for years will continue to be beneficial. Organisations such as the Financial Services Sector Coordinating Council and Financial Services Information Sharing and Analysis Center promote information sharing and security coordination,” said Fitch Ratings.

Furthermore, it said certain regulatory bodies are taking the view that cyber risk management should be internationally coordinated, as evidenced by committees and working groups such as The International Organization of Securities Commission's Committee on Payments and Market Infrastructures and G-7 Cyber Risk Expert Group.

Fitch Rating said according to the European Central Bank, the average lag until a breach is detected was 146 days in 2016, down from 205 days in 2014.

It said as information is shared across firms, cyber risk detection and response plans could improve, but coordination does not ensure that risks can be fully contained.

“Insurance against cyber-attacks may cover nominal losses but may not contain reputational damage that could lead to client outflows or loss of investor confidence. Cyber insurance underwriting has increased in recent years.

“We estimate that the U.S. property and casualty insurance industry wrote over USD1 billion in cyber-related insurance premiums in 2015 and expect these levels to grow in the coming years,” said Fitch Ratings.