NICE Investors Service: "Data Breaches at Financial Companies Have Limited Short-Term Credit Impact"

NICE Investors Service analyzed that the short-term credit impact on financial companies from recent data breaches in the financial sector would be limited. However, it expects the burden could grow over the medium to long term if the incidents lead to secondary financial harm, customer compensation, or sanctions by financial regulators.

In a report published on the 8th titled "Data Breaches at Financial Companies and Their Credit Impact," NICE Investors Service said, "The direct impact of data breaches to date on the financial and business foundations of the financial companies involved has been limited."

NICE Investors Service noted that many of the recent incidents occurred in operational and support systems or externally connected systems, rather than in core financial transaction systems such as internet and mobile banking. It also said that, to date, only a limited number of cases have led to large-scale financial losses or disruptions to core financial services.

Since September, financial companies affected by data breaches have included banks such as Shinhan Bank, KB Kookmin Bank, Hana Bank and BNK Busan Bank, as well as Yegaram Savings Bank, Welcome Savings Bank and Hyundai Capital.

NICE Investors Service assessed that "considering the scale of damage identified to date, as well as the earnings capacity and capital buffers of the financial companies, direct costs associated with containing the incidents and upgrading systems are unlikely to significantly weaken financial stability in the short term."

However, it noted that if the leaked information leads to secondary harm such as voice phishing or identity theft, or if claims for damages increase, the costs of providing relief and compensation and of litigation could exceed expectations. If investigations by financial regulators find deficiencies in security measures or in the detection and reporting of incidents, the companies could also face surcharges, corrective measures, sanctions against institutions or employees, and business restrictions.

NICE Investors Service said that "if data breaches recur or the response following an incident is inadequate, the business foundations and earnings capacity of financial companies could weaken through reduced transactions and customer attrition among existing clients, as well as diminished customer acquisition." It added that it plans to assess the credit impact by focusing on the final scope of each breach and the sensitivity of the information involved; the extent of secondary harm; the amount of customer compensation; the results of financial regulators' investigations and sanctions; the extent of disruption to and recovery of core financial services; customer attrition and reduced transactions; and whether similar incidents recur.

This content was produced with the assistance of AI translation services.