The Effects of Service Crises and Recovery Resources on Market Reactions: An Event Study Analysis on Data Breach Announcements

Shahin Rasoulian,Sylvain Sénécal,Yany Grégoire,Renaud Legoux

doi:10.1177/10946705211036944

Abstract

Building on the literatures on service failure and crisis seriousness, we develop a framework to understand the effects of a specific type of service crisis (i.e., data breaches) and organizational recovery resources on the reactions of the stock market. To do so, we conduct an event study analysis with a sample of 217 data breach announcements, as our empirical context. Our analyses reveal that a firm suffers from negative abnormal stock returns when either the outcome of the breach (e.g., the breach of financial data) or its causal process (e.g., hacker attack) indicates a high level of seriousness. Moreover, considering organizational recovery resources, we find that in the case of financial data breaches, age, size, profitability, liquidity, and brand familiarity are the primary resources that can help a firm’s recovery. For hacker attacks, these organizational recovery resources include size, profitability, and liquidity.

Highlights

The rapid expansion of the information age and growing firms’ tendency to invest in data-driven services has increased managers’ concerns about data breach incidents (Belanger and Crossler 2011; Smith, Dinev, and Xu 2011)
In order to further verify the appropriateness of our event window, we examined the cumulative average abnormal return (CAAR) for several possible windows around the event date
The results show that the window [0, 3] is significant with the highest amount of CAAR

Summary

Introduction

The rapid expansion of the information age and growing firms’ tendency to invest in data-driven services has increased managers’ concerns about data breach incidents (Belanger and Crossler 2011; Smith, Dinev, and Xu 2011). Data breaches have been described as major service crises needing managers’ attention (Malhotra and Malhotra 2011; Rasoulian et al 2017) Such incidents constitute a poor service performance in which firms fail to satisfy the basic requirements about data protection of a large group of customers and employees (Malhotra and Malhotra 2011). Such incidents could receive major media coverage and attract public attention (Rasoulian et al 2017). Data breaches are among managers’ key concerns—and a large body of research has highlighted the importance of information protection (Culnan and Armstrong 1999; Rifon, LaRose, and Choi 2005; Sheehan and Hoy 2000)—the literature has not yet provided a comprehensive framework to evaluate the market-level effects of different types of breaches and to assess the role of organizational resources in attenuating these effects

Objectives

Results

Conclusion