The increasing sophistication of cybercriminals continues to make cybersecurity a greater focus of risk mitigation in public finance. Along with all the other exogenous risks facing rated entities in 2020, cyberattacks continue to grab headlines, as seen recently with attacks on the state of Minnesota; the city of Hartford, Conn.; numerous Texas school districts; and health care and higher education institutions on the front lines of the pandemic. Even as issuers become better prepared and more nimble, the threat from cyberattacks is increasing.

Municipal entities and public enterprises are built on a foundation of trust and transparency with their constituencies: budgets are approved in public; taxes and other revenues are collected; and constituents rely on services being delivered. Cyber breaches can not only lead to financial losses and the misuse of information, but any service disruptions they cause also erode the inherent trust and credibility of the affected organizations. Cyber threats are common within the municipal sector, but we have observed that disruptive events--whether social, environmental, or governmental--provide additional opportunity for breaches and further contribute to this risk.

Their Very Public Nature Makes Municipal Issuers Prime Targets For Cyberattacks

Global pandemics, periods of social or political tension, and natural disasters can all be exploited by cybercriminals while a management team is focused elsewhere. Increased interest from hostile actors, including international players, who might disagree with specific government policies, could be partially predicated on the fact that municipal institutions are public, which often leads to information being more freely available than that of corporate counterparts. In addition, given the service mission and base of many municipal issuers, some actions could create an emotional response or be perceived as reasons to attack. These issues, coupled with the finite nature of many issuers' resources, make municipal and public enterprises prime targets for cyberattacks. We consider cyber risk an important emerging risk to consider when evaluating issuer creditworthiness and believe that cyber risk issues will become worse before getting better. With all these factors considered, S&P Global Ratings ranks cybersecurity as a top risk to North American public finance issuers (see "Credit Conditions North America: Potholes On The Road To Recovery," published Sept. 29, 2020, on RatingsDirect).

Hostile actors in the cyberspace realm are always honing their approach, continuously improving tools such as social engineering attacks and communication disruptions. Most of all, these groups keep well apprised of the news and global events because they know the most effective time to strike is when management is already preoccupied elsewhere. Cybercriminals can be more adaptive and flexible in their approach than the existing countermeasures designed to thwart them; therefore, effective and robust cybersecurity policies, regularly preparing for attacks, and good cyber hygiene are critical to safeguard institutions, especially during periods of disruption.

Cyberattacks Are Flourishing As Organizations Struggle To Respond To The Spread Of COVID-19

Responding to disruptive events or disasters has always been one of the most challenging aspects of governance in public finance. Today, this is further exacerbated by the rise in cyberattacks occurring simultaneously with the need to respond to disasters or disruptive events.

The global spread of COVID-19 has been the most significant disruptive event of the past decade. While the pandemic has resulted in tragic human suffering and economic hardship, it has also contributed to an increase in cyber risk for municipal entities. Interpol's secretary general has observed that there has been an "alarming rate of cyberattacks during COVID-19" and that "cybercriminals are developing and boosting their attacks at an alarming pace, exploiting the fear and uncertainty caused by the unstable social and economic situation created by COVID-19" ("Cybercrime: COVID-19 Impact," www.interpol.int, Aug. 4, 2020).

The pandemic presents a "perfect storm" scenario for cybercrime to flourish. One of the most effective defenses against the spread of the coronavirus is physical distancing. However, as organizations rapidly shifted to remote work and social-distancing countermeasures, they also had to adapt their technological footprint to cope with an unprecedented new reality. The rapid switch to remote work exposed gaps in the critical infrastructure of many organizations, which cybercriminals have exploited. Criminals have used the rapid increase in virtual business and communication to better mask their efforts to target municipal entities in more nuanced ways.

We have observed an increase in social engineering attacks, which consist mainly of phishing and pretexting (an attempt to trick users into helping attackers evade security controls), opening the cyber door for criminals to carry out ransomware infections, invoice fraud, and other attacks that can cost substantial amounts of cash at a time when public finance budgets are already stressed. The effects of this have been especially acute in the health care sector.

Hospitals Face Two Foes: The Pandemic And Cybercriminals

Health care organizations, due to the financial and personal information they collect, have long been a favorite target for cybercriminals. Public health care institutions rated by S&P Global Ratings have been discussing cyber-protective measure, or good cyber hygiene, with our analysts for years. However, the pandemic has added an extra layer of complexity to cyber challenges in the sector. As hospitals and medical facilities are on the front line of the pandemic and are grappling with the demands of treating complex cases, they are increasingly being targeted by cybercriminals who recognize that such institutions cannot afford to be locked out of their systems at this time, and would most likely pay ransoms--posing a risk to their already finite finances.

Although this problem has been most pronounced in the health care sector since the start of the pandemic, the same trend has made itself felt in the other municipal government sectors. Nefarious cyber actors depend on the assumption that while senior management is navigating the realities of tailoring its business operations around the pandemic, it will be less prepared and more vulnerable to attack and exploitation.

Natural Disasters Provide Fertile Ground For Cyberattacks

Natural disasters can also expose municipal entities to cyber threats. Hurricanes, earthquakes, and wildfires cause significant disruptions in the flow of information and make conducting business difficult. With senior leadership and staff attempting to manage the disaster response, cybercriminals could step up phishing and pretexting campaigns to gain access to critical systems. During disasters, local governments are contacted by a multitude of governmental, environmental, professional, humanitarian, and charitable organizations offering assistance or services to the affected community. Cybercriminals have become astute at masquerading as representatives of legitimate organizations to fool staff into unknowingly allowing them into their systems. Successful phishing campaigns pose multiple risks, as the resulting loss of data could hamper ongoing efforts to deal with the natural disaster, lead to a loss of public trust in institutions, and ultimately cost much-needed recovery dollars.

We believe that planning and cyber vigilance before a disaster occurs are key to credit stability. Since the nature of cybercrime is constantly evolving, training, preparedness, and employee awareness must also adapt and evolve. With the uptick in the frequency of wildfires and severity of hurricanes, due in part to climate change, coupled with the limited resources of municipal institutions and the continuously growing expertise of cybercriminals, cyber risk stemming from natural disasters could be on the rise.

In Times Of Social Unrest, Online Activists Are Seeking A Platform For Their Views

Another emerging cyber risk to municipal institutions is sustained internet activism that results from periods of social or political tension and unrest. This phenomenon generally affects state and local institutions. In recent months, we have seen a pronounced uptick in cyberattacks and hacktivism, mostly centered on the divisive political mood of the nation and the discourse about race and police tactics in the wake of the death of George Floyd in Minneapolis. Street protests and unrest have been accompanied by a slew of online activism, which has sometimes taken the form of cyberattacks. These attacks are generally perpetrated by ideologically motivated groups of hackers. The goal of hacktivism is to use techniques, generally in the form of distributed denial of service (DDoS) or redirecting type attacks, to avenge a perceived injustice, or expose embarrassing or incriminating materials related to an organization. Incidents in Minneapolis and the State of Minnesota showed that these DDoS attacks are not necessarily financially motivated, but aim to disrupt flows of information when the public might be looking to the entity's website to be better informed about ongoing protests; or to divert users to another webpage to give the attackers a platform for their opinions. Hacktivism can result in a loss of credibility for management and the organization as a whole, leading to the erosion of public trust, which could affect the entity's mission.

The loss of constituent trust is an important risk factor, as diminished public support could weaken or damage the ability of the affected entity to raise the funds needed to rebalance the system, or lead to calls for the removal of management and leadership. Therefore, an organization's response planning should always include transparency in addition to clear methods of communicating with its constituency.

Geopolitical Events Can Lead To Increased Cyber Risk For Local Governments

The use of cyberattacks as an instrument to impair an entity or disrupt operations due to geopolitical tensions poses unique risks to municipal institutions. The FBI has listed cyber as one of its top risks to the nation in 2020 ("Worldwide Threats To The Homeland," www.fbi.gov, Sept. 24, 2020). For a motivated cybercriminal, targeting municipal institutions creates a scenario where risks to the attacker are low and rewards for disruption can be high. In the past, municipal institutions were much more insulated from risks posed by geopolitical conflicts. These days, technological innovation and the efficiencies it creates for municipal institutions have transformed how business is conducted. However, the reliance on technology as a benchmark of critical municipal infrastructure means that local institutions can now be targeted in ways that were not possible in the past. Public finance within the U.S. entities can find themselves affected by geopolitical conflicts where diplomatic tension or conflicts on the other side of the globe could make them targets, either directly or as collateral damage. Geopolitical cyberactivity poses both governmental and social risks for municipal entities. Cyberattacking organizations with political motives might not distinguish between federal, state, or local entities, and could see all three as legitimate targets in conflicts. With public trust as a key component of local government success, targeted disinformation campaigns could harm the social fabric and cause discord, resulting in the loss of constituent confidence. The very visible recent high-profile attacks on major U.S. cities, such as Atlanta, and port facilities, as experienced as the shipping line Maersk was attacked, illustrates the potential for geopolitical events to directly affect the creditworthiness of municipal issuers in the U.S.

Related Research

• Credit Conditions North America: Potholes On The Road To Recovery, Sept. 29, 2020
• Cyber Risk In A New Era: Remedy First, Prevent Second, Sept. 17, 2020
• U.S. Public Finance Issuers Must be Nimble to Fend Off Cyberattacks Or They Could Face Credit Fallout, Feb. 25, 2020
• Cyber Risk Management For U.S. Municipal Utilities Should Be Routine And Requires Vigilance And Flexibility, Feb. 3, 2020