Increasing levels of digitisation make firms more susceptible to cyberattacks and privacy violations. In this paper, we quantify the impact of cybercrime on company stock returns using a large international sample. On the day after the cyber event, stock returns are found to decrease by -0.24%, but the effect reverses in about two weeks. The magnitude of the decrease in the stock market is greatest for companies that have experienced reoccurring events and for breaches deemed to be most severe. We show that the extent of the stock market decline cannot be explained by national institutional and macroeconomic factors, and is related to company-specific characteristics, including size, volatility, credit ranking and asset volatility. The empirical results highlight important policy and regulatory issues, not least the need for cyber risk disclosure requirements.
Read full abstract