Too Good to Be True: Firm Social Performance and the Risk of Data Breach

Abstract

Data breaches are now a daily occurrence. What corporate leaders may not realize is that certain actions they are taking in the social responsibility space may, in fact, be placing a proverbial target on their backs. Indeed, there is evidence that the hacking community is not homogeneous, and at least some hackers from both internal and external sources appear to be motivated by what they dislike as opposed to solely financial gain. Recent hacks against the World Health Organization, as a result of its actions (or supposed inactions) related to the COVID-19 pandemic, are a case in point. In this paper, we put forth the idea that espoused positive social performance in areas that are peripheral to core business operations (e.g., philanthropy, recycling programs) can be a detriment to information security, particularly when firms have simultaneous high levels of social concerns (e.g., poor employee relations, product safety concerns, involvement in an environmental controversy). Our results support this outcome. It appears that some perpetrators can “sniff out” firm social actions that attempt to give the appearance of social responsibility and possibly mask poor social performance, and consequently, these firms are victimized by a malicious data breach more often.