Ordeal by Innocence? Mandatory Data Breach Revelation and Strategic Manipulation of Real Business Activities

Abstract

In this paper, we demonstrate that the mandatory disclosure of data breaches may have an unintended consequence: the distortion of firms’ real business activities. We employ the staggered adoption of data breach disclosure laws across various U.S. states to show that such mandatory disclosure exacerbates firms’ real earnings manipulation multidimensional through twisting production costs, discretionary expenses, and cash flow from operations. The main effect is more pronounced for firms of which the outbreak of data breaches is more of a concern and under stronger short-term market pressures. Furthermore, the adoption of such laws is associated with higher stock price crash risk and fewer patenting activities. Overall, our findings reveal possible unintended real effects of certain laws oriented at protecting customers through mitigating information opacity.