With health care spending approaching 20% of U.S. GDP as of 2022, the health care sector is the largest in the U.S. economy. Therefore, it is not surprising that it is one of the most attacked by cyber criminals, according to cybersecurity specialist Guidewire.

Chart 1

A successful cyberattack can have both immediate and long-term effects on a company's credit quality. The first consequence of an attack could be operational disruption, with direct impact for the entity's liquidity and short-term financial performance.

An entity that fails to respond to, or recover from, a cyberattack could suffer more acute harm including meaningful financial underperformance, customer losses, and reduced access to debt markets. This could be a significant risk particularly for entities with low liquidity levels, and already limited access to capital markets. IBM Security notes that the U.S. health care sector has had the highest average cost of a data breach for 12 consecutive years, now averaging over $10 million per incident. Breach costs for pharmaceuticals trail only health care and financial companies, averaging over $5 million per breach.

Over the longer term, we consider the most significant risk to the health care industry to be reputational, regulation or litigation damages. These exposures could result in a meaningful increase in financial liabilities over the medium to long term and reduction in liquidity.

Despite the increasing frequency of the attacks, we believe U.S.-based health care companies' exposure to cyber risk is largely manageable, assuming they continue to invest in cybersecurity and proactively manage risk. Our view is supported by data from Guidewire's analysis of potential losses from cyber-incidents (based on tail-value-at-risk calculation that measures the average loss for the 40 most severe simulations in Guidewire's model). Based on this calculation, the estimated loss from cyber-incidents would be limited to less than 1% of the revenues in 94% of health care companies and less than 2% for 99% of them for a set of about 200 corporate health care issuers. In addition to the Guidewire estimates, our credit analysis considers the possible impacts a cyber incident may have on a company's reputation and business position.

Why Have Cyberattacks Had A Limited Credit Impact To Date?

We typically assess investment-grade credits as having sound risk management and, in most cases, they also have a sufficient cushion within their ratings to withstand potential losses. The only example of negative rating impact was in case of Princeton Community Hospital Inc. of West Virginia (BBB/Developing/--), which we downgraded to 'BBB' from 'BBB+' in 2019, after a 2017 cyberattack that contributed to operating and liquidity issues later exacerbated by several strategic investments. In other cases the companies were able to weather the impact. For example, although Merck & Co. Inc. suffered approximately $1.4 billion in damages resulting from the 2017 NotPetya attack, the impact was not material to the credit ratings relative to other factors such as acquisition spending, dividends, and share repurchases. In early 2022, Merck also won a legal dispute with its insurance providers, who had originally denied coverage for the NotPetya incident citing a policy exclusion for acts of war.

Companies at the lower end of the credit spectrum are typically assessed to have less fully developed risk management capabilities, but they are also generally less-attractive targets for cyber-criminals, particularly in the medical devices and pharmaceutical spaces where these companies are often less innovative than their higher-rated peers. However, even non-investment-grade health care credits often have sufficient scale and liquidity to absorb sizable cyber losses. For example, Tenet Healthcare Corp. (B+/Stable/--) absorbed a $100 million unfavorable EBITDA impact following a cyberattack in the second quarter of 2022 without a change to its ratings or outlook. We acknowledge, however, that given their increasing frequency and intensity, cyberattacks could have larger impact on the companies' financial performance going forward.

Why The Health Care Sector Is More Targeted By Cyberattacks

According to reports by Guidewire, cyberattacks on health care have risen rapidly in recent years. Cyber criminals are increasingly drawn to the sector for the following reasons:

High stakes

The potential life-and-death nature of cyber risks to hospitals is largely without parallel. An interruption to hospital IT systems can deny physicians access to necessary tools to provide care, and create operational backlogs, leading to delays and cancellations of necessary and recommended treatments. This puts health care companies in a position where they feel as though they must pay ransoms in order to bring systems back online, which in turn draws more cyber criminals to the sector.

Sensitive personal and financial data

Health care organizations typically process and retain vast amounts of personal and private data. The value of medical records on the black market, especially when records contain a social security number, is reportedly many times greater than that of a compromised credit card number. Additionally, HIPAA violations for the unauthorized disclosure of health data can result in substantial fines to health care companies, again increasing their perceived likelihood to pay ransoms to quickly resolve breaches.

Increasing connectivity

Through an increased reliance on wireless communication from patient beds to care teams and developments including telemedicine, remote patient monitoring, wearable devices and implants, the potential attack surface of health care organizations and medical device manufacturers has expanded significantly in recent years. These factors multiply the number of potential vulnerabilities for the sector and dramatically increase the number of potential attackers.

How Health Care Subsectors Fare Regarding Cyber Risk

Health services

Cyberattacks targeting hospitals have increased by nearly 50% since 2020 according to the U.S. Department of Health and Human Services. In addition to volume increases, cyberattacks have also become more sophisticated. Nearly half of all U.S. hospitals have had to disconnect their networks due to escalating ransomware attacks according to Philips/Cyber MDX study. Larger hospitals reported an average shutdown of 6.2 hours at a cost of $21,500 per hour, while midsize hospitals reported an average shutdown of 10 hours at more than double the cost or $45,700 per hour. As such, affected hospitals have been forced to resort to manual processes and procedures due to the disruptions to their IT systems, forcing them to scale back the number of patients that can be served until the event is mitigated, and consequently affecting their bottom line.

While many for-profit and not-for-profit hospitals have thus far had sound reserves to absorb the one-time higher expenses related to cyberattacks, pressures from the current operating environment (e.g., labor shortages, inflation, supply chain disruption) for health care providers (including large health care systems) could be exacerbated by operational disruption or increased costs of a cyberattack. This could further constrain cash flow and liquidity and put downward pressure on ratings, particularly for those entities already in a weaker credit position.

Medical devices

Medical devices are increasingly connected to the internet, with notable examples including wearable devices that send patient data to the cloud or monitoring systems and injection devices that grant caregivers remote-access capabilities. The amplified connectivity has expanded the sector's exposure to cyber risks, with vulnerabilities reported by the FDA that include risks that certain medical devices could be made unavailable, and the potential for unauthorized users to access sensitive information, modify settings, or even tamper with the device's functionality. For example, infusion pumps are particularly susceptible to cyberattacks. A study published earlier this year by Palo Alto Networks, a cybersecurity provider, found that as many as 75% of the devices that are connected to hospital networks contain known cybersecurity flaws, possibly giving a malicious actor access to the device's controls or to any unencrypted data that passes to or from a pump.

We also believe legacy devices, servicing beyond their intended lifecycles present a special challenge to both hospitals and original equipment manufacturers (OEMs). In its 2021 discussion paper, the FDA warned that these unpatched medical devices will become increasingly vulnerable to cyberattacks over time and has called for more communication from OEMs when they can no longer support software upgrades and patches needed to address their devices' cybersecurity risks.

The vulnerabilities mentioned in the FDA cybersecurity safety communications and other alerts were self-identified and the agency has not received reports of these vulnerabilities being abused. The estimated remediation costs for the reported vulnerabilities fell below a threshold that would change our assessments of companies' financial positions. Subsequently, the sector has heretofore not had any credit rating actions related to cybersecurity.

Pharmaceuticals

The pharmaceutical industry is susceptible to cyberattacks as well, albeit often indirectly, and at times attacks of a different nature than other health care subsectors. Given its dependence on global supply chains for raw materials and widespread outsourcing of noncore functions to contract development and manufacturing organizations (CDMOs), including contract research organizations (CROs), third-party risk can extend the attackable surface of even the most conservative and cybersecurity-conscientious pharmaceutical companies and expose them to meaningful cyber risks.

Patient data is generally only an indirect risk, as pharma companies typically don't gather information on the ultimate users (except for pharmacovigilance reporting to regulators) and because clinical trials which involve gathering personal health data are often outsourced. Accordingly, cyberattacks on pharmaceutical companies often focus on the theft of intellectual property, or to inflict reputational harm.

In recent years, the pharmaceutical industry has been a magnet for sophisticated attacks from criminal and state-sponsored attackers. The industry attracts such attention given its highly valuable intellectual property concerning drug development, drug composition, and manufacturing processes.

Selected Attacks And Vulnerabilities

We've provided examples of the selected attacks and reported vulnerabilities from the three subsectors below. In all cases, except Princeton Community Hospital Inc., the company absorbed the financial impacts without affecting the rating.

Related Research

• Perspectives On Cyber Risk Across Corporates: The Potential Impact Of Cyber Threats Is Growing, Nov. 7, 2022
• Cyber Risk Management Is Credit Risk Management, Says Seminar, Nov. 1, 2022
• Cyber Security Is Integral To Credit Risk Management, Says Report, Oct. 25, 2022
• Cyber Trends and Credit Risks, Oct. 25, 2022
• Cyber Risk In A New Era: The Rocky Road To A Mature Cyber Insurance Market, July 26, 2022
• ESG Brief: Cyber Risk Management In USPF, June 28, 2021