S&P warns over more frequent cyberattacks in the sector

Furthermore, social landlords already under financial stress might find themselves hard-pressed to improve IT systems and would become more vulnerable to cyber incidents, unable to absorb the resulting potential losses.

S&P added that major cyber incidents could cause serious reputational damage as well as hitting providers financially.

The agency said that regaining tenants’ trust will take a long time after their personal information is compromised. It said that this could result in a potential loss of investor trust in a social landlord’s operations.

S&P said cyberattacks could damage a landlord’s reputation and cast doubt on its social role, which would put off investors looking at new issuances.

S&P said in its report: “In our view, cyber security has become a growing concern to social housing regulators. In England, [the Regulator of Social Housing] has stressed that cyber is a key sector risk. Its introduction of tenant satisfaction measures from April 2023 could further stress providers in handling customer satisfaction if there are any disrupting security incidents.”

S&P said the sector is gearing up to tackle this growing threat of cyber security.

It said that many providers are working on stepping up their IT security. The credit rating agency said some have gone beyond business continuity planning and penetration testing by setting up 24/7 monitoring systems, conducting third-party reviews or more training to employees to raise awareness.

S&P said that the Cyber Essentials accreditation, a government-backed scheme that certifies a company’s defence against cyberattacks, is becoming more popular in the sector.

It added that some providers are further pursuing standards, including the Cyber Essentials Plus accreditation and ISO/IEC 27001, which covers information security management systems.

“We consider the sector’s increasing effort to strengthen IT infrastructure credit positive that would somewhat mitigate the rising risk,” S&P said in the report.

“While it is difficult to quantify the financial impact, some providers account for cyber security breaches in stress-testing.

“We understand that cyber insurance is common in the sector, but it’s getting more expensive. Globally, much of the increase in price has followed a supply and demand mismatch and insurers’ cautiousness in taking on new risk.”

S&P said it embeds issuers’ cyber risk preparedness in its assessment of social landlords’ management and governance, and also considers the financial impacts of cyber risk in its financial risk profile assessment.

It said that providers should have a comprehensive cyber strategy to mitigate risks with sufficient monitoring and IT infrastructure. A lack of strategy could imply weak risk management, S&P added.

The report said: “Although we understand that the sector is increasing efforts in IT infrastructure, cyberattacks are becoming more sophisticated, constantly seeking ways to exploit system or human vulnerabilities.

“As we expect that financial and reputational consequences could be more significant for cyberattacks, we think that cyber security will be increasingly important in [social housing providers’] risk management. Those that do not manage the risk well, via strong planning and management, could see significant negative credit implications.”

S&P mentioned the example of Clarion. The UK’s largest housing association suffered from what it called a “cyber security incident” in June, which targeted its IT infrastructure.

It also mentioned Red Kite Community Housing, which lost almost £1m after cyber criminals mimicked the domain and emailed details of the group’s suppliers in 2019.

S&P said that Clarion’s half-year operating surplus fell partly due to the fall-out from a major cyberattack, and that its operating surplus is likely to weaken as a result of additional provisions against rent arrears linked to the incident. However the agency does not see “the financial impact as being an immediate credit risk”.

Meanwhile, Red Kite had its governance rating downgraded from G1 to G2.

S&P said that partners with the sector are not immune to the issue. For instance, Plentific – a company that runs a repairs platform for large London providers including L&Q, Notting Hill Genesis and Peabody – experienced a cyberattack in 2021 that indirectly affected providers’ operations.

Local authorities, which manage housing benefits and planning, are also targets, S&P added.