Cyber attacks are becoming a more prevalent means of achieving foreign policy objectives, given their lower deployment costs relative to conventional military tactics and uncertain scope for retaliation. We are also seeing a hybrid cyber-kinetic form of warfare, where cyber assaults can precede or be accompanied by military operations. The intent of such attacks is often to undermine confidence in key institutions and infrastructure, which implies wider credit implications across sectors and geographies. Given tensions between Russia and the West over Ukraine in recent weeks, S&P Global Ratings sees a heightened risk that Ukraine will be the target of additional cyber attacks. We are monitoring if such attacks could spill beyond the country's borders and their potential credit implications.

Cyber Attacks Are Adding To Geopolitical Tensions

Cyber attacks have become a key element of geopolitics, involving state and nonstate actors. The frequency and severity of cyber events are rising rapidly, and their impact ranges from mild disruption of activities to influencing regime change and attacks on critical physical infrastructure. The difficulty in identifying the source and motive of attacks makes nearly all rated sovereigns vulnerable to a geopolitically motivated attack. Advanced and developing economies alike are at risk. Cyber warfare is being used to achieve several different political objectives, including:

• Espionage;
• Propaganda;
• Influence over elections, including through the support of specific political candidates;
• Sabotage or denial of service of critical or noncritical infrastructure; and
• Coordinated military and cyber action or hybrid warfare.

Geopolitical tensions between Russia and the West over Ukraine have recently intensified, raising the risk of restricted trade and capital flows and downside risks to economic growth (see "Global Credit Conditions Special Update: Geopolitical, Inflation, And Rate Risks Rise," published on Feb. 8, 2022, on RatingsDirect). While we are closely watching the developments, we are also monitoring actions on the cyber front that may signal a potential escalation in conflict.

In the most severe scenario of military escalation, we consider that there could be disruptive cyber attacks on critical infrastructure in Ukraine, including communications and power systems, similar to the invasion in Crimea in 2014. However, even in a milder scenario where tensions de-escalate on the back of diplomatic efforts, we may still see cyber attacks. Following the recent defacement of government websites and malware incidents in January 2022, Ukraine has reported attacks against websites of state-owned Oschadbank and Privatbank, the ministry of defense, and its armed forces in mid-February originating from several countries.

There have also been several reports of possible cyber attacks on the U.S. and EU financial sectors.

In response, the U.S. and the EU have threatened a variety of sanctions against Russia that could be triggered by the broader conflict escalation and cyber attacks in particular. Strict sanctions on Russia will, however, likely have broader consequences, such as higher commodity prices and a temporary energy price shock in Europe, which could worsen inflationary pressures (see "Possible Credit Consequences Of Escalating Russia-West Tensions Over Ukraine And Further Sanctions Against Russia," published on Feb. 8, 2022).

Our Sovereign Ratings On Ukraine Account For High External Security Risks

Ukraine has experienced several cyber attacks since 2014 that have been attributed to the Russian government, Russian-backed groups, or Russia-sympathetic hacktivists (see timeline of key events in Chart 1 below). This highlights our view that Ukraine has a ways to go in developing its cyber awareness and expertise, improving coordination among institutions, and responding effectively to breaches. Our sovereign rating and outlook on Ukraine (B/Stable/B) take into account its relatively weak and developing institutions that reflect reduced predictability of future policy responses, uncertain checks and balances between institutions, and high external security risks (see "Ukraine Full Analysis," published on Sept. 13, 2021).

We note that while Ukraine's macroeconomic policy framework is stronger than in 2014, a more extreme scenario involving a growth shock, disruptions to infrastructure and exports, fiscal pressures, and financial instability could put pressure on the sovereign in our view.

Table 1

Another "NotPetya"-Type Attack Could Be More Severe Due To Increasing Digital Interconnectivity

Increasing technological dependency and global interconnectedness means cyber risk poses a systemic threat and significant single-entity risk (see "Global Credit Conditions Special Update: Geopolitical, Inflation, And Rate Risks Rise," published on Feb. 8, 2022). Cyber events and threats are evolving dynamically. As attacks become more sophisticated, new targets and methods are emerging. Organizations face the risk of criminal and state-sponsored cyber attacks as well as disruptions caused by increasing digitalization with opaque and complex global systems.

Depending on the magnitude and financial impact of future cyber attacks, such an event could trigger widespread rating actions. In our view, entities with weaker balance sheets that lack adequate cyber insurance or other means of liquidity to address financial impacts will be more vulnerable to potential rating actions.

To help mitigate the potential negative credit impact of cyber attacks, robust cyber security remains vital. Other key factors that determine how well entities manage cyber risk include: prompt remedial action, active detection, C-Suite support including budget allocation, and a better understanding of risks arising from third-party providers or supply chains. The latter especially applies to companies that do business with Ukrainian organizations, since connections to Ukrainian systems might be used as a pivot point to other targets.

Although it is crucial to learn from previous attacks and strengthen cyber risk frameworks in real time, the appropriate detection and remediation of attacks takes precedence as the nature of threats will continue to evolve. Key questions are whether organizations have: (i) response plans (business continuity and disaster recovery plans) that are defined, understood, and tested prior to an attack; (ii) backup procedures that ensure that critical data can be restored following a ransomware or destructive cyber attack; and (iii) backups that are isolated from network connections.

Cyber Insurance Is Evolving As Insurers And Policyholders Move Away From Silent Cyber

Cyber insurance is a key component of cyber governance. The "NotPetya" case highlighted the risk of silent cyber, that is where cyber risk is neither explicitly included nor expressly excluded within insurance policies (see "Let's Not Be Quiet About Insurers' Exposure To Silent Cyber," published on March 2, 2021). Where policies carry this type of uncertainty, insurers can find themselves facing losses to settle unexpected cyber-related claims, and policyholders may be exposed to risks they thought were covered.

For example, Merck had a traditional "all-risk" insurance policy with Ace American Insurance. The insurer denied the claim associated with "NotPetya" stating that the policy language did not cover a "hostile or warlike action". However, since this war exclusion was not designed in the context of cyber warfare, but rather for traditional forms of warfare, a New Jersey court ruled in Merck's favor in January 2022. This court decision could have ripple effects for insurers and underscores the importance of insurers having robust cyber war exclusions in noncyber policies to avoid unanticipated exposure to silent cyber.

Silent cyber is also concerning for policyholders as it leaves the scope of their coverage uncertain. Several insurers have been pulling back on cyber coverage and charging higher premiums since 2021, largely due to growing ransomware attacks. In December 2021, Lloyd's of London announced that they would introduce a new framework to cyber war exclusions, applying different levels of exclusions. This differentiation may allow for greater flexibility and transparency and could help insurers to assume different levels of risk. Challenges will likely arise as cyber war is not clearly defined and attribution of attacks to nation states could also be difficult. While demand for cyber insurance has been increasing dramatically, policies that do not provide adequate coverage could dampen their effectiveness for customers and lead to long and costly legal battles.

Thanks to the development of more sophisticated analytical tools over the past two years, we have seen insurers gradually moving from silent cyber to affirmative cyber risk policies by using clear and transparent inclusions or exclusions, which we see as positive.

Related Research

• Global Credit Conditions Special Update: Geopolitical, Inflation, And Rate Risks Rise, Feb. 8, 2022
• Possible Credit Consequences Of Escalating Russia-West Tensions Over Ukraine And Further Sanctions Against Russia, Feb. 8, 2022
• Ukraine Full Analysis, Sept. 13, 2021
• Cyber Risk In A New Era: The Increasing Credit Relevance Of Cybersecurity, July 14, 2021
• Let's Not Be Quiet About Insurers' Exposure To Silent Cyber, March 2, 2021