Cyber risk under stress: Bank cyber shocks and systemic fragility

Cyber risk in banking is often studied as an operational or idiosyncratic shock, but it may also matter for financial stability and long-horizon asset pricing. We show that declines in a bank intermediation-capacity index predict a lower ten-year Treasury term premium three to four quarters ahead, with stronger effects when system-wide financial stress is elevated, whereas VIX responds mainly contemporaneously. Using quarterly U.S. data from 2001Q2 to 2025Q3 and incident-level cyber records, we further show that the delayed response is more clearly concentrated in intermediation-capacity disruptions than in theft/extortion events, and that it remains visible in medium-horizon block, innovation-based, and timing-falsification checks. We interpret the evidence as consistent with a gradual intermediation channel rather than as a point-identified structural mechanism. These findings suggest that incident-based bank cyber indicators may provide useful information for financial-stability monitoring and macroprudential surveillance.