Does privacy breach affect firm performance? An analysis incorporating event-induced changes and event clustering

Abstract

Previous studies have analyzed the impact of cybersecurity breaches on firm performance, but the impact of the privacy breach on firm performance is less explored. Needless to say, the privacy of the individual's personal information has been a rising concern for organizations over the years. Previous studies, primarily focused on cybersecurity breaches, have used a simple market model (MM) to observe the impact of these breaches on firm performance. Our study has used an advanced market model (AMM), which observes the event-induced changes in the variance of stock returns and changes in MM parameters, which are ignored by the MM. The ignorance of this may lead to a biased cumulative abnormal return (CAR) computation. We have also included the event clustering observation (events that are very close to each other) in our study and evaluated AMM with seemingly unrelated regression (SUR), i.e., AMM-SUR. We have used data of 193 privacy breaches related to the US firms listed on NYSE (USA), NASDAQ (USA) for the years 2012 (43 breaches), 2013 (37 breaches), 2014 (51 breaches), and 2018 (62 breaches). Abnormal returns for the firms are found negative due to these privacy breaches, but AMM consistently reports more negative abnormal returns than MM for all the years. The AMM-SUR, observing event clustering, consistently reports slightly lower negative abnormal returns than the AMM for all the years. We have also calculated the average financial loss due to a privacy breach for these years and for three different models, i.e., MM, AMM, and AMM-SUR.