After the Disclosure: Measuring the Short-Term and Long-Term Impacts of Data Breaches on Firm Performance

Abstract

In this manuscript, I conducted a study utilizing matched sample comparison analysis to understand the short-term and long-term impacts of data breach events on firm performance. I take two approaches to theory development; the first approach extends the current literature on data breach events as negative, value declining events to the firm's performance; which I call the “traditional view”. The second view posits that a data breach event may actually be a catalyst for enhanced long-term firm performance; I call this the organizational sustainability and resiliency view. I introduce the analysis of two new variables ``intangible assets” and “extraordinary losses” to the discussion on the impact of data breaches on firm performance. Understanding changes to intangible assets allow us to gauge the impact of the data breach on firm brand reputation and intellectual capital reserves; among other intangible asset components. The measurement of extraordinary losses allows us to better understand if the focal firms considered data breaches truly detrimental to their operations that it rose to the level of “extraordinary” and not an event that could be incorporated into its usual operating expenses. I find that data breach events have some negative impacts to the firm's profitability more than likely leading to a depletion of the firm’s assets. However, firms do not perform better or worse in the short term or long term due to a data breach event; the firms can be considered financially sustainable in the 1-4 quarters following a data breach disclosure.