Chart 1

Stakeholders seem to be taking an out-of-sight, out-of-mind attitude toward cyberattacks in Asia. A lack of public disclosure requirements is likely to result in an under-reporting of cyber incidents in the region. S&P Global Ratings views vulnerability to cyberattacks as a credit risk.

We believe further that limited disclosure can create a degree of complacency among investors and corporate managers. Cyber risks for Asia-Pacific issuers are as high as those for rated issuers in the U.S. or Europe, according to data provided by Guidewire, a third-party research entity (see chart 1).

The threat of attacks is rising globally, with occasionally damaging consequences for firms' operations. Recent examples in the U.S. from September include MGM Resorts International and Clorox Co., which each disclosed unrelated and serious cyberattacks (see box, and "What We've Learned About Cybersecurity Risk Following Recent Attacks In The U.S. Gaming Sector," Nov. 9, 2023).

Asia-Pacific has its own risk characteristics. A high concentration of rated entities are in manufacturing, which exposes them to attacks on suppliers and key infrastructure. Moreover, more industrial production is moving online, to make use of technologies such as artificial intelligence (AI). For example, at a recent policy-setting event in China known as the Two Sessions, officials vowed to integrate much more AI into manufacturing.

Guidewire data reveals that, on average, the industrial control systems of more Asia-Pacific issuers were detectable online, compared with global issuers. Industrial control systems are software used to manage key manufacturing functions. If such systems are detectable online, they are vulnerable to an attack by hackers.

As a sign of the dangers, Rockwell Automation Inc. recently warned its customers to disconnect industrial control systems from the internet if they were not specifically designed to be publicly facing. Rockwell is a provider of industrial automation services.

Chart 2

Chart 3

Cyberattacks Are Underreported In Asia-Pacific

Tracking and measuring cyberattacks is difficult in the best of circumstances. It's particularly difficult in Asia, with its patchwork of rules and regulators, and generally low disclosure requirements on companies.

A lack of disclosure can make it more difficult to assess cyber risks. Moreover, attacks may be direct or indirect, targeting service providers, suppliers, logistic networks, or critical infrastructure (ports, utilities, telecommunication, financial networks, and the like; see chart 3).

In the wake of a growing number of cyberattacks globally, Asia-Pacific regulators and legislators are starting to address this risk. Countries such as China, South Korea, Japan, India, Singapore, and Australia have all rolled out rules requiring companies to provide more disclosure of attacks, and more details on their level of preparedness.

Regulators are scrutinizing firms that provide critical infrastructure. Recently, Singapore, in the first amendment of its Cybersecurity Act, proposed expanding the reporting requirements for critical infrastructure owners to include incidents affecting entities in their supply chain.

However, most of these new rules do not require public disclosures of cyber incidents. They typically require timely reports of attacks to regulators, or perhaps just set higher standards for cybersecurity (see table 1).

Table 1

While some Asian jurisdictions require public notification of data breaches, most do not. Some regulators seek transparency on cyberattacks using stock-exchange rules requiring disclosure of material events.

Yet, materiality is an imprecise and ambiguous measure, particularly for cyber incidents. For example, do leaks of customer data meet the materiality threshold if the immediate cost of the breach is small or difficult to measure?

Moreover, most exchanges and regulators in the region don't have strict requirements that firms report their incidents. Companies may delay or even omit such disclosures. Finally, such rules would only apply to listed entities.

By contrast, the U.S. is toughening its reporting rules on cyber incidents (see "Cyber Risk Insights: New Regulations Will Increase Resilience, At A Cost," Aug. 3, 2023.) The Securities and Exchange Commission has set standards for public disclosure of cyberattacks on registered companies. These include reporting incursions within four days after the determination of their materiality.

Europe has also taken a tough approach in requiring companies to carefully safeguard user data, and to protect consumers using products with digital elements.

Disclosure requirements in Asia-Pacific are often more relaxed than in the U.S. and Europe. Tellingly, the cyberattacks that our rated Japanese firms disclosed in the past year largely occurred at overseas subsidiaries, or affected overseas users. This was likely because offshore regulations required disclosure, whereas Japan did not. We assume as such that there were other attacks on Japanese issuers last year that were not disclosed (see table 2).

The upshot is that Asia-Pacific incidents are underreported. We believe this breeds under-preparedness among issuers, and an inability for investors to assess the full risk of such breaches.

Table 2

How Do We Account For Cyber Risks Within Our Credit Rating?

Our credit rating reflects an issuer's cyber preparedness, governance, and concentration risks. This gives us a sense of how disruptive a cyberattack might be.

By including cyber risk in our discussions with management, we rely on entities to share information. For this reason, we examine not just what the issuers tell us, but also our assessment of their defenses and planning.

Slow or ineffective remedial actions in response to contingent risks, such as severe cyberattacks, would prompt us to question the robustness of a company's management and governance.

We consider whether the issuer has formally documented its cybersecurity strategy, and whether it routinely measures the effectiveness of the strategy. We also try to understand who is ultimately responsible for the company's cybersecurity, how the company allocates its budget toward cybersecurity, and the level of cyber expertise on its board. We assess whether companies maintain adequate means to respond and recover from a cyber event without materially compromising financials, through cyber insurance or other means.

In addition, we updated our management and governance criteria to more directly assess cyber-preparedness. In particular, whether an incident exposes deficiencies in risk-management standards and tolerances, board effectiveness, or other governance factors (see "Methodology: Management And Governance Credit Factors For Corporate Entities," Jan. 8, 2024).

Cyber risks may amplify vulnerabilities presented by supplier, distributor, or geographical concentrations. We would reflect that in an issuer's business risk assessment and, ultimately, our rating.

The Stealthy, Surprise Credit Events Can Sting The Most

With all that said, we acknowledge the difficulty of assessing the risk of cyberattacks in Asia-Pacific. We don't believe this is because such incursions are rare, but that they are underreported. It is notable that the record of attacks picks up in markets such as Australia, where the regulations are tighter and disclosure standards higher.

We assume rated corporates in Asia-Pacific are at least as vulnerable as entities in the U.S. and Europe. Cyber incursions pose a meaningful ongoing credit risk in those markets, and so they should for entities in Asia-Pacific. Risks are also increasing for Asia-Pacific financial institutions as they increasingly rely on cloud and third-party service providers (see "Asia-Pacific Banks' Digital Opening Raises Cyber Risks," Sept. 27, 2022).

Investors should be mindful that cyberattacks may strike quickly and randomly, with possibly devastating effects.

Writer: Jasper Moiseiwitsch

Digital Designer: Evy Cheung

Related Research

• Methodology: Management And Governance Credit Factors For Corporate Entities, Jan. 8, 2024
• Clorox Co. Outlook Revised To Negative From Stable On Materially Lower Guidance; Ratings Affirmed," Nov. 16, 2023.
• Cyber Attack On ICBC Financial Services Highlights Risk Management Challenges Overseas, Nov. 14, 2023
• What We've Learned About Cybersecurity Risk Following Recent Attacks In The U.S. Gaming Sector, Nov. 9, 2023
• Australian Mutual Lenders: Path Of Least Resistance May Lead To Higher Cyber Risk, Aug. 29, 2023
• Cyber Risk Insights: New Regulations Will Increase Resilience, At A Cost, Aug. 3, 2023
• How Cyber Risk Affects Credit Analysis For Global Corporate Issuers, March 30, 2022
• Perspectives On Cyber Risk Across Corporates: The Potential Impact Of Cyber Threats Is Growing, Nov. 7, 2022
• Asia-Pacific Banks' Digital Opening Raises Cyber Risks, Sept. 27, 2022
• How Cyber Risk Affects Credit Analysis For Global Corporate Issuers, March 30, 2022