Cyberwarfare has, to general surprise, provided just a handful of notable skirmishes in the Russia-Ukraine conflict. But fears linger that the scale and frequency of digital attacks on financial, industrial, and state targets in Ukraine, and among its allies, could escalate. It was with this threat in mind that S&P Global Ratings analysts and in-house cyber experts, met on Thursday, April 28, for the "Cyber Risk Seminar: Learning from the Russia-Ukraine Conflict." A link to the replay is available here.

"There is a rising likelihood of a prolonged stalemate, or an escalation in military attacks, and with that we see heightened risk of cyberattacks on public and financial entities," said Zahabia Gupta, S&P Global Ratings' associate director in the Sovereign and International Public Finance team. "We are monitoring whether any cyberattacks on Ukraine could cause disruptions to payment systems or critical infrastructure that could affect its ability to service debt. This risk is incorporated into our 'B-/B' sovereign ratings on Ukraine, which remain on CreditWatch negative."

History suggests there is good reason to be wary. Russia is often cited for hacking Ukrainian targets, though it denies the allegations. A 2015 attack temporarily turned off power for about 230,000 Ukrainians. Two years later, hackers, reputed to be linked to Russia's military, knocked government agencies offline, shut transport systems, closed banks, and cost U.S. and European companies that were inadvertently caught in the attack about $10 billion (see "Cyber Threat Brief: How Worried Should We Be About Cyber Attacks On Ukraine?," published on Feb. 22, 2022).

"We also see an increased risk that Russia could use cyberattacks to target entities from countries that are allied with Ukraine as a means to gain an advantage in the conflict," said Ms. Gupta.

For the time being, cyberattacks have been less severe than we expected. Of the about 201 rating actions we have taken as a result of direct or indirect consequences of the war, none have been due to cyber-related issues (see chart 1).

Chart 1

"Cyberattacks are something we are closely watching, [but] they haven't thus far been a major contributor to any of these rating actions," Tiffany Tribbitt, S&P Global Ratings director and lead analyst for U.S. public finance, told the seminar.

NotPetya Warning

The conflict hasn't been without a cyber element. The Ukrainian defense ministry and two banks were hit with distributed denial-of-service (DDoS) attacks, which seek to take down websites by overloading them with fake queries, in the days before the invasion began. Other Ukrainian government sites have suffered "web defacement," a form of digital vandalism, said Paul Alvarez, a cyber risk expert within our Analytical Innovation team.

There have also been accounts of more destructive, though largely unsuccessful, activity, including the use of wipers, malicious programs that seek to destroy IT systems by erasing data. "We have seen several wipers in play recently, some created before the hostilities occurred and some during," said Mr. Alvarez. "It demonstrates how quickly these threat groups can retool."

Wipers have a notorious history in Ukraine. It was a wiper malware, called NotPetya, that in 2017 exploited two historical weaknesses in Microsoft's operating systems to disable Ukrainian airports, railways, and banks."NotPetya was actually the culmination of a three-year campaign of targeted disruption against Ukrainian infrastructure…banks, nuclear plants, and electricity suppliers," Martin Whitworth, another cyber risk expert told the seminar. "It wasn't a well-controlled campaign in that it may have been targeted at Ukraine, but a number of really large organizations got hit by NotPetya, even though it wasn't designed to actually attack them."

Among the collateral damage was drug maker Merck & Co. Inc. and transportation group FedEx Corp., which suffered about $695 million and $400 million of losses, respectively, making them significant corporate contributors to a total of about $10 billion of losses caused by the attack. Still, this did not lead to any rating actions, since analysts assessed the credit implications as manageable within the current rating thresholds.

The shockwaves of NotPetya also reverberated through the insurance sector, which found itself on the hook for about $3 billion of damage claims (the remaining $7 billion was uninsured). Worse, for the insurers, about $2.7 billion of those claims were likely unforeseen, since they came via traditional property and casualty (P&C) polices that neither explicitly included nor excluded losses from cyberattacks.

This exposure, known as silent cyber, or non-affirmative cyber, remains a contentious issue (see "Cyber Risk In A New Era: Let's Not Be Quiet About Insurers' Exposure To Silent Cyber," published March 2, 2021, on RatingsDirect).

"Businesses are still over reliant on their traditional policies [to cover cyber exposure]," said Manuel Adam, associate director within the Insurance Ratings team. "A lack of clarity leads to disputes, with policyholders arguing for a more generous and broader interpretation of the wording [in P&C policies], and insurers doing the opposite.

"This is leading to dissatisfaction for policyholders," he added. "And it leaves the scope of coverage uncertain, particularly in the case of large scale cyberattacks like NotPetya, and potentially in the case of the current Russia-Ukraine conflict."

At best, silent cyber risks hurt insurers' profitability by exposing them to payouts for risks for which they never collected premiums. At worst, warns Mr. Adam, it "could harm their profitability and solvency levels."

The extent of those risks was made explicit in January, when a court ruled that an all-risk property policy held by Merck entitled it to claim against damages resulting from NotPetya. Merck's insurer, Ace American Insurance Co., had argued that the cyberattack was an act of war, which would typically be excluded from a P&C policy. A New Jersey Superior Court disagreed, ruling that Merck had "every right to anticipate that the exclusion applied only to traditional forms of warfare."

It is unclear to what extent that ruling will set a precedent. Yet cyberattacks emanating from the Russia-Ukraine conflict could once again test the arguments used in the case, including the extent to which insurers must prove that a cyberattack is directly linked to a conflict, and thus an act of war. That could prove a difficult task, particularly when belligerents are unlikely to claim responsibility.

Mr. Adam said that insurers are, either way, coming to terms with the need to identify, quantify, and manage silent cyber risks. Progress has been made in moving clients to affirmative cyber coverage, but it has been hampered by a mismatch between strong demand for such policies and supply that is constrained by insurers' caution, due to the relative infancy of cyber as an insured risk. That imbalance has contributed to a sharp increase in cyber protection prices since mid-2020, though the increase isn't likely to have been sufficient to protect profit margins that were in place before the COVID-19 pandemic (see chart 2).

Chart 2

Spotlight On Cyber Governance

There seems little doubt that demand for cyber insurance will grow, as the financial effects of cyberattacks increase. And there is the important question of how cyber insurance fits into overall cyber risk management?

"Risk management, including cyber risks, is considered within our ratings process," Ms. Tribbitt told the seminar, adding that weak governance protocols can lead to a lower rating than pure financials might otherwise indicate. "That is the reason why you don't always see rating changes after an attack, governance risks are already baked into our ratings."

A replay of S&P Global Ratings' Cyber Risk Seminar: Learning From the Russia-Ukraine Conflict is available here.

S&P Global Ratings U.S. Public Finance team will hold a special "Credit Spotlight" event focusing on Cyber Risk on Thursday, May 12, 2022 from 1p.m. to 3p.m. Eastern Time. Information and registration for the event are available at this link.

Writer: Paul Whitfield