Standard & Poor's said that cybersecurity measures could affect ratings
Standard & Poor's (S&P) ratings agency has said that banks with weak cybersecurity controls could be downgraded, even if they do not actually suffer from cyber-attacks, saying that "We view weak cybersecurity as an emerging threat that has the potential to pose a higher risk to financial firms in the future, and possibly result in downgrades". JP Morgan suffered a high profile cyber-attack last year, and experts have suggested that attacks of these kind are only likely to increase in frequency in the future; the bank spent $250m on cybersecurity in 2014 and will increase that to $450m by next year, S&P said.

Banks with weak cybersecurity controls could be downgraded even if they haven’t been attacked, Standard & Poor’s said Monday in a report.

While it hasn’t yet downgraded a bank based on its computer security, the ratings company said it would consider doing so if it determined the lender was ill-prepared to withstand a data breach. It would also drop a bank’s rating if an attack caused reputational harm or resulted in losses that hurt profit, S&P said.

"We view weak cybersecurity as an emerging threat that has the potential to pose a higher risk to financial firms in the future, and possibly result in downgrades," S&P analysts led by Stuart Plesser wrote in the report.

Cyberattacks have become a growing threat for banks, with more than a dozen U.S. depository institutions reporting hacks in 2012 and 2013 that prevented consumers from accessing their websites, according to the report. Last year, the personal data of tens of millions of JPMorgan Chase & Co. customers were compromised in a breach. The bank spent $250 million on cybersecurity in 2014 and will increase that to $450 million by next year, S&P said.

Hostile nation-states, terrorist organizations, criminal groups, activists and, in some cases, company insiders are behind most of the global cyberattacks on banks, S&P said. South Korea financial institutions have experienced security breaches in recent years, while a Russian security company working with law enforcement said it uncovered a two-year, billion-dollar theft from banks around the world by a gang of cybercriminals, according to the report, which didn’t identify the lenders.