Do Voluntary Disclosures Mitigate the Cybersecurity Breach Contagion Effect?

Abstract

ABSTRACTIn this study, we investigate the negative impact of a cybersecurity breach on a bystander (i.e., non-breached) firm in the same industry, referred to as investment contagion effects, and whether voluntary cybersecurity disclosures mitigate these effects. Using an experiment with nonprofessional investors, we provide strong evidence of investment contagion effects. However, we also find a portion of investor participants perceive the breach as positive news for the bystander firm, a phenomenon known as competition effects. Our evidence suggests contagion effects are dominant over competition effects, and cybersecurity disclosures provided prior to the breach announcement attenuate contagion effects. Additionally, we find cybersecurity disclosures provided subsequent to the breach announcement can reduce the magnitude of investment contagion effects. Our study informs standard setters and firms as we find some evidence that voluntary disclosures are effective in lessening investment contagion effects.