Breach Announcements Research Articles

It pays to be forthcoming: timing of data breach announcement, trust violation, and trust restoration

PurposeThis research examines the relationship between the timeliness in announcing the discovery of a data breach and consumer trust in an e-commerce company, as well as later trust-rebuilding efforts taken by the company to compensate users impacted by the breach.Design/methodology/approachA survey experiment was used to examine the effect of both trust-reducing events (announced data breaches) and trust-enhancing events (provision of identity theft protection and credit monitoring) on consumer trust. The timeliness of the breach announcement by an e-commerce company was manipulated between two randomly assigned groups of subjects; one group viewed an announcement of the breach immediately upon its discovery, and the other viewed an announcement made two months after the breach was discovered. Consumer trust was measured before the breach, after the breach was announced, and finally, after the announcement of data protection.FindingsThe results suggest that companies that delay a data breach announcement are likely to suffer a larger drop in consumer trust than those that immediately disclose the data breach. The results also suggest that trust can be repaired by providing data protection. However, even after providing identity theft protection and credit monitoring, companies that fail to promptly disclose a breach have lower repaired trust than companies that promptly disclose.Originality/valueThis study contributes to the literature on e-commerce trust by examining how a company's forthrightness in reporting a data breach impacts user trust at the time of the disclosure of the data breach and after subsequent efforts to repair trust.

Making better IS security investment decisions: discovering the cost of data breach announcements during the COVID-19 pandemic

PurposeStock price reactions have often been used to evaluate the cost of data breaches in the current information systems (IS) security literature. To further this line of research, this study examines the impact of data breaches on stock returns, information asymmetry and unsystematic firm risk in the context of COVID-19.Design/methodology/approachThis paper employs an event study methodology and examines data breach events released in public databases, spanning pre- and post-COVID settings. This study investigated 283 data breaches of the US publicly traded firms, and the economic cost was measured by cumulative abnormal returns (CARs), trading volume, bid-ask spread and unsystematic risk.FindingsThe authors observe that data breaches during the COVID pandemic make investors react more negatively to data breach announcements, as reflected in the significantly negative difference in CARs between breached firms before COVID and those after COVID. The findings also indicate that, after the disclosure of data breach incidents, information asymmetry is reduced to a lesser extent compared with that in the pre-COVID setting. The authors also find that data breach events lead to an increase in the unsystematic risk of breached companies in the pre-COVID era but no change in the post-COVID era.Originality/valueThis study is the first effort to examine the economic consequences of data breaches by investigating the effects in the form of trading activities and risk measurement in the COVID setting.

The Shareholder Value Implications of Data Breaches

Digitalization in operations and supply chain management entails various opportunities for performance improvement. However, the increasing reliance on data introduces new risks for firms, such as data breaches. In this study, we assess the financial implications of data breaches and identify a set of factors influencing these implications. Based on a sample of 219 data breach announcements by publicly traded U.S. firms, we conduct an event study to examine the stock market reaction to data breaches. We further estimate a series of regression models to identify important influencing factors in the stakeholder environment of the firm, including several robustness checks and post-hoc analyses. We find a significantly negative stock market reaction to announcements of data breaches within a two-day event window. Our post-hoc analysis indicates a sustained negative impact on shareholder value. The negative stock market reaction is stronger when customer data is breached, the breach occurred along the supply chain, and the firm receives more media attention in general. This study adds to the emerging topics of cyber risk in operations and supply chain management, and to the literature on data breaches specifically.

A meta-analysis of the factors influencing the impact of security breach announcements on stock returns of firms

A meta-analysis of the factors influencing the impact of security breach announcements on stock returns of firms

Data Breach Announcements and Stock Market Reactions: A Matter of Timing?

Although firms’ announcement of data breaches can lead to reputational or operational damages, extant research suggests that stock markets are relatively unresponsive to such announcements. We investigate whether markets’ unresponsiveness can be explained by firms strategically timing the announcement to coincide with busy days in the media, thereby reducing attention and, ultimately, attenuating market reactions. We leverage novel data on data breach announcements in the United States between 2008 and 2018 and create a measure of busyness in the trade press—news pressure—based on the Wall Street Journal. To investigate, we conduct two complementary studies. In Study 1, we employ an instrumental variable approach to assess whether announcements coincide with days of predictably high news pressure. We find that this is the case. On days with a one-standard-deviation-higher predictable news pressure, 4.44% more data breaches are announced (or approximately 19.024 data records). Strategic timing is more prevalent for breaches that are severe, that have firm-internal causes, and that leak healthcare data or credentials. In Study 2, we utilize a stock market event study to assess market reactions conditional on news pressure on the announcement day. We find that data breach announcements are associated with negative market reactions, yet these are attenuated by higher news pressure on the announcement day. If news pressure is on its empirical mean (respectively, one standard deviation above), we estimate a median decline in market capitalization of $347 (respectively, $85) million. We conclude that firms’ strategic timing might explain inconsistent findings in prior work. This paper was accepted by Chris Forman, information systems.

Pricing Cyber Security Insurance

Cybersecurity breaches may be correlated due to geography, similar infrastructure, or use of a third-party contractor. We show how a logistic regression may be used to estimate the probability of an attack where breaches may be correlated among firms up and down the supply chain. We also show how a Poisson regression may be used to estimate the number of records breached. Losses arising from cybersecurity breaches have an unknown distribution. We propose the stock price reaction to a breach as an objective measure of the loss in wealth sustained by the firm due to a breach. This loss measure reflects the immediate and long-term effects of a breach, including reputational effects and other intangible impacts that are otherwise more difficult to quantify. We examine stock returns for 258 cybersecurity breach announcements over 2011-2016 in order to obtain the empirical loss distribution. We find a five-day abnormal return of -1.44%. Seventy-one percent of these 258 announcements result in a negative abnormal return, and a gamma distribution provides an excellent fit to these losses. In addition to introducing a predictive model for correlated losses, our study shows how insurers can use either the empirical stock return distribution of losses or the per record cost of a breach in the pricing of cyberinsurance.

The Effects of Service Crises and Recovery Resources on Market Reactions: An Event Study Analysis on Data Breach Announcements

Building on the literatures on service failure and crisis seriousness, we develop a framework to understand the effects of a specific type of service crisis (i.e., data breaches) and organizational recovery resources on the reactions of the stock market. To do so, we conduct an event study analysis with a sample of 217 data breach announcements, as our empirical context. Our analyses reveal that a firm suffers from negative abnormal stock returns when either the outcome of the breach (e.g., the breach of financial data) or its causal process (e.g., hacker attack) indicates a high level of seriousness. Moreover, considering organizational recovery resources, we find that in the case of financial data breaches, age, size, profitability, liquidity, and brand familiarity are the primary resources that can help a firm’s recovery. For hacker attacks, these organizational recovery resources include size, profitability, and liquidity.

Cyber-attacks and stock market activity

I study how financial markets react to unexpected corporate security breaches in the short and the long-term. The main results show that daily excess returns drop, trading volume increases due to selling pressure, and liquidity improves upon the public disclosure of first-time corporate hacking events. The evidence from the search frequency in Google suggests that such short-lived market reaction is due to increasing investors' attention. Cyber-attacks affect firms' policies in the long run, up to five years after the security breach announcement. These results are consistent with the hypothesis that security breaches represent unexpected negative shocks to firms' reputations.

The Long-Run Impact of Information Security Breach Announcements on Investors’ Confidence: The Context of Efficient Market Hypothesis

Information and communication technologies (ICTs) are the cornerstone for sustainable development, but if they are not appropriately managed, they will impede progress towards the United Nations Global Sustainable Development Goals. Among undesirable impacts, emphasis must be put on the risk of information security (ISec) breaches, as they pose a potential threat to businesses there. Especially for publicly traded firms, they could create a long-lasting influence on their financial performance and, thus, stock investors’ confidence. Following the efficient market hypothesis’s footsteps, previous studies have examined only the short-run impact on investors’ confidence ensuing to ISec breach announcements. Therefore, this study investigates the long-run impact of ISec breach announcements on investors’ confidence. Based on a sample of 73 ISec breach announcements during 2011–2019, this paper examines the impact on investors’ confidence, as demonstrated by long-run abnormal returns and equity risk of those firms. Using a one-to-one matched sampling approach, each firm’s performance is analyzed with its control firm over eighteen months, starting six months before the announcement, through twelve months after the announcement. Firms experienced a significant negative abnormal return of 15% to 18% during the twelve months following the breach announcement. In comparison, equity risk increased by 11% within six months before and after an announcement. This study can help investors, managers, and researchers better understand a long-term relationship between ISec breaches and investor confidence in the context of efficient market hypothesis.

Financial Loss due to a Data Privacy Breach: An Empirical Analysis

ABSTRACT Previous studies have explored the impact of the cybersecurity breach on the market value of the firm, but the impact of the data privacy breach on the firm performance is less explored. The terms cybersecurity breach and data privacy breach are sometimes used interchangeably, but they are two different things. In this study, we have used the event study methodology and standard market model (MM) to observe the effect of the data privacy breach on the firm performance. We have also observed the impact of firm-specific characteristics (such as firm size and firm type) and attack-specific characteristics (such as attack type and damage potency) on the cumulative abnormal return (CAR) due to privacy breaches. We have used data of 131 data privacy breaches related to US firms for the years 2012 (43 breaches), 2013 (37 breaches), and 2014 (51 breaches). We have selected the period 2012-2014 for study as we have observed the major data privacy breaches occurred during this period. The results of this study demonstrate that the data privacy breach announcement negatively affects the market value of the firm. Another interesting finding of this study is that the market values of larger firms are less adversely affected by the data privacy breach event than the smaller firms. We have also calculated the average financial loss, which comes out to be $ 229 million, $ 241 million, and $ 108 million in the year 2012, 2013, and 2014, respectively, due to these data privacy breaches.

Reaction of Stock Volatility to Data Breach: an Event Study

The paper assesses how stock market volatility reacts to data breach disclosure. The paper applies Volatility Event Analysis and Kolmogorov-Smirnov Test to analyse how equity risk (stock volatility) of 96 firms listed on the S&P 500 index reacted to the announcement of a data breach using records from Breach Level Index (BLI ) over the period between January 2013 and December 2018. Two levels of empirical analysis were performed: cross-section level and industry level. We employ statistical tests that adjust for the effects of cross-section firm-specific mean and volatility. The analysis delivers the following results: Firstly, cross-sectional analysis shows that there is evidence of significant abnormal across the firms and significant difference between before and after cyberattacks announcements. Secondly, the industry level analysis reveals that the firms in the financial industry exhibit more abnormal volatility and returns than firms in other sectors. Additionally, there is significant evidence of the difference in pre and post cyberattacks or data breach announcements, however, this effect tends to be more pronounced after the announcement of a data breach. Implying that data breach announcements can significantly influence equity volatility. In conclusion, the paper posits, equity investors and other stakeholders should reconsider their approach to cybersecurity events when updating the risk measures of their stocks and portfolios.

The effect of data breaches on company performance

PurposeThis paper aims to analyze the effect of data breaches – whose concerns and implications can be legal, social and economic – on companies’ overall performance.Design/methodology/approachInformation on data breaches was collected from online compilations, and financial data on breached companies was collected from the Mergent Online database. The financial variables used were related to profitability, liquidity, solvency and company size to analyze the financial performance of the breached companies before and after the data breach event. Nonfinancial data, such as the type and the size of the breaches, was also collected. The data was analyzed using multiple regression.FindingsThe results confirm that nonmandatory information related to announcements of data breaches is a signal of companies’ overall performance, as measured by profitability ratios, return on assets and return on equity. The study does not confirm a relationship between data breaches and stock market reaction when measuring quarterly changes in share prices.Research limitations/implicationsThe main limitation of the study relates to ratio and trend analyses. Such analyses are commonly used when researching accounting information. However, they do not directly reflect the companies’ conditions and realities, and they rely on companies’ released financial reports. Another limitation concerns the confounding factors. The major confounding factors around the data breaches’ dates were identified; however, this was not enough to assure that other factors were not affecting the companies’ financial performance. Because of the nature of such events, this study needs to be replicated to include specific information about the companies using case studies. Therefore, the authors recommend replicating the research to validate the article’s findings when each industry makes more announcements available.Practical implicationsTo remediate the risks and losses associated with data breaches, companies may use their reserved funds.Social implicationsCompany data breach announcements signal internal deficiencies. Therefore, the affected companies become liable to their employees, customers and investors.Originality/valueThe paper contributes to both theory and practice in the areas of accounting finance, and information management.

A global comparison of corporate value adjustments to news of cyber-attacks

The growing threat of cyber breach has become one of the most feared risks corporations around the world are currently dealing with. This paper uses a methodology similar to Hogan, Olson, and Angelina (2020) to analyze global shareholder value effects of cyber breaches from 1990 to 2019 for five major non-US countries. Cumulative Average Returns (CARs) are calculated using the first notice date to periods of up to 90 days post-announcement to compare short-term and long-term effects of cyber breaches on the stock price. Results for this data set show significant negative returns for US corporations in all windows. Unlike its US counterparts, short-term results for non-US countries show no significant changes to price as a result of cyber breach announcements. Long-term results for the aggregate non-US sample show significance only at the (0,30) window. Individual country long-term analysis shows some significance depending on the event windows, but no common patterns are seen among countries. These results point to differences in how news of a cyber breach, by country, is perceived in the market. The results help explain some of the patterns insurance companies have seen in the reticent buying habits of global companies with respect to cyber insurance.

Insider trading ahead of cyber breach announcements

Stock market reactions to cybersecurity breach announcements are generally negative. We find significant evidence of opportunistic insider trading, with insiders saving an average of $35,009 due to timely selling in the three months before the announcement of a cybersecurity breach. Late filing violations by insiders are more likely to occur near the announcement of a cyber breach. The bulk of opportunistic trading tends to occur 55–72 days before the public announcement. The results lend support to the U.S. Security and Exchange Commission’s recently announced goal of tightening restrictions on insider trading ahead of cyber breach announcements.

Do Voluntary Disclosures Mitigate the Cybersecurity Breach Contagion Effect?

ABSTRACTIn this study, we investigate the negative impact of a cybersecurity breach on a bystander (i.e., non-breached) firm in the same industry, referred to as investment contagion effects, and whether voluntary cybersecurity disclosures mitigate these effects. Using an experiment with nonprofessional investors, we provide strong evidence of investment contagion effects. However, we also find a portion of investor participants perceive the breach as positive news for the bystander firm, a phenomenon known as competition effects. Our evidence suggests contagion effects are dominant over competition effects, and cybersecurity disclosures provided prior to the breach announcement attenuate contagion effects. Additionally, we find cybersecurity disclosures provided subsequent to the breach announcement can reduce the magnitude of investment contagion effects. Our study informs standard setters and firms as we find some evidence that voluntary disclosures are effective in lessening investment contagion effects.

Do security breaches matter? The shareholder puzzle

AbstractThis article analyzes the effect of computer breaches on publicly traded equities from 2005 to 2017. An event study is performed and breaches analyzed conditioned on whether the breach announcement has been made in the mainstream media or through other channels. We find that in the period prior to the announcement date in the media, the mean abnormal return is negative, reflecting a likely leakage of information. In the period following the announcement date, the mean abnormal return is positive, often more than offsetting the previous declines. The findings have important implications for analysts, portfolio managers, institutional investors, and regulators.

Internalizing the Harm of Privacy Breaches: Do Firms Have an Incentive to Improve Data Protection? An Event Study

Big data, combined with machine learning and artificial intelligence, is expected to increase the bulk of personal data in the hands of private and public entities, presenting a unique challenge to policymakers. Therefore, the question of how to incentivise firms to protect personal information is more relevant today than ever before. This study attempts to associate privacy breach announcements with the drop in share price using an event study. The results show that firms suffer a significant and immediate share price depreciation over a short window, and this is sustained over the entire forecast window after the event. Furthermore, this effect is greater when a larger number of customers are affected and the information exposed is financially sensitive. This represents a departure from previous studies, which found only a mild negative and temporary market reaction following a breach. These findings, using data from 2014-2018, will encourage policymakers to consider strict disclosure policies, thereby encouraging firms to invest in best data security practices.

When the Data Are Out: Measuring Behavioral Changes Following a Data Breach

As the quantity and value of data increase, so do the severity of data breaches and customer privacy invasions. While firms typically publicize their post-breach protective actions, little is known about the social, behavioral, and economic aftereffects of major breaches. Specifically, do individual customers alter their interactions with the firm, or do they continue with “business as usual”? We address this general issue via data stemming from a matchmaking website, one for those seeking an extramarital affair, that was breached. The data include de-identified profiles of paying male users from the United States, and their activities on the website since joining, and up to 3 weeks after, the disclosure of the data breach. A challenge in making causal inference(s) in the setting of a massive and highly publicized data breach is that all users were informed of the breach at the same time. In such cases of “information shock”, there is no obvious control group. To resolve this problem, we propose Temporal Causal Inference: for each group of users who joined in a specific time period, we create an appropriate control group from the set of all users who had joined in prior ones. This procedure helps control for, among other elements, potential trends in both individual and temporal site usage that broadly fall under the rubric of “normal” usage trajectories. Following construction of suitable control groups, we apply and extend several causal inference approaches. In particular, we adapt Athey, Tibshirani and Wager’s (2019) Causal Forests (among other forest-based methods) into Temporal Causal Forests, to better align ‘temporal’ inference settings. The combination of Temporal Causal Inference and Temporal Causal Forests methods allows us to extract insights regarding the homogenous (average) treatment effect, along with nontrivial heterogeneity in responses to the data breach. Our analyses reveal that there is a decrease in the probability of being active in searching or messaging on the website, and a notable increase in the probability of deleting photos, ostensibly to avoid personal identification. We investigate several potential sources of heterogeneity in response to the breach announcement, and conclude with a discussion of both managerial consequences and policy considerations.

Do Security Breaches Matter? The Shareholder Puzzle

This article analyzes the effect of computer breaches on publicly traded equities from 2005 to 2017. An event study is performed and breaches analyzed conditioned on whether the breach announcement has been made in the mainstream media or through other channels. We find that in the period prior to the announcement date in the media, the mean abnormal return is negative, reflecting a likely leakage of information. In the period following the announcement date, the mean abnormal return is positive, often more than offsetting the previous declines. The findings have important implications for analysts, portfolio managers, institutional investors, and regulators.

Pricing Cyber Security Insurance: A Copula Model Using an Objective, Verifiable, Loss Measure

Cybersecurity breaches may be correlated due to geography, similar infrastructure, or use of a third-party contractor. We show how a copula model may be used to estimate the probability of an attack where breaches may be correlated among firms. Losses arising from cybersecurity breaches have an unknown distribution. We propose the stock price reaction to a breach as an objective measure of the loss in wealth sustained by the firm due to a breach, a loss that can be modeled and that insurers can use to price cyberinsurance products. This loss measure reflects the immediate and long-term effects of a breach, including reputational effects and other intangible impacts that are otherwise more difficult to quantify. We examine stock returns for 258 cybersecurity breach announcements over 2011-2016 in order to obtain the empirical loss distribution. We find a five-day abnormal return of -1.44%. Seventy-one percent of these 258 announcements result in a negative abnormal return, and a gamma distribution provides an excellent fit to these losses. In addition to introducing a copula model for correlated losses, our study shows that insurers can use either the empirical stock market distribution of losses or the theoretical (gamma) distribution in the pricing of cyberinsurance.