S&P may downgrade banks with lax cyber security

New York

BANKS with weak cybersecurity controls could be downgraded even if they haven't been attacked, Standard & Poor's said on Monday in a report.

While it hasn't yet downgraded a bank based on its computer security, the ratings company said it would consider doing so if it determined the lender was ill-prepared to withstand a data breach. It would also drop a bank's rating if an attack caused reputational harm or resulted in losses that hurt profit, S&P said.