Why does the financial sector underinvests in cybersecurity?
Data breaches are more likely to occur in the financial services. For the period between 2013-2017 cyber attacks to the financial sector accounted for nearly 22% of the 9,900 breaches in the sample below. So why financial services are not heavily investing on their cybersecurity infrastructure and instead consistently under report hacking events? Because “firms cannot reap the full benefits of their investments, they lack the incentive to ensure the socially optimal level of cybersecurity or cyberresilience. That is, they do not internalize the spillover effects on other firms and on the broader economy of their inadequate preparations.”
Cyber Instability
By: Stephen G. Cecchetti, Kermit L. Schoenholtz – Brandeis University, New York University
How do financial markets react to security breaches?
Bianchi and Tosun analyzed the effect on excess returns of a cyberattack announcement on the targeted firm but also on firms in the same industry as the targeted one. They find that over a 5-day window both targeted and non-targeted firms experience significantly downward trending excess returns.
Cyber Attacks and Stock Market Activity
Authors: Daniele Bianchi, Onur Tosun
From: University of Warwick
Estimating the potential losses
Our results should thus be considered as illustrative. Taken at face value, they suggest that average annual potential losses from cyber-attacks may be large, close to 9 percent of banks’ net income globally, or around $100 billion. In a severe scenario—in which the frequency of cyber-attacks would be twice as high as in the past with greater contagion— losses could be 2½–3½ times as high as this, or $270 billion to $350 billion.
Estimating Cyber Risk for the Financial Sector
By: Christine Lagarde – IMF
