The stock market effect of Cybercriminals : an empirical study of the price effects on US listed companies targeted by a data breach

Abstract

This study investigates the effect of a data breach with more than 30 000 records stolen on publicly US listed companies' share price. Utilizing the market model, we examine abnormal returns after an announcement of a data breach in the period between 2010 and 2019. Further, the study focuses exclusively on data breaches that either was officially confirmed by the targeted company through a press release, statements to the media or confirmed through independent media reports. We find a negative and statistically significant average reduction in the share price on the day of and following the announcement of a data breach. The cumulative effect of a data breach on the share price stabilizes at day six in the event window after the announcement of the data breach. Our findings are consistent over the analyzed event windows, indicating a negative abnormal return following a data breach. Furthermore, we find a considerable variance in the reduction in share price within the sample. Hence, we are looking closer into the heterogeneity of the data breaches. First, we investigate the differences between industries and find that the finance industry experiences the most severe decline. Secondly, in line with the increased media attention we explore the average market reaction of a data breach in the two periods 2010 to 2014 and 2015 to 2019. Our findings indicate a greater reduction in the market value in the period 2015 to 2019. Furthermore, we run a regression that accounts for firm-specific traits and variables that attempt to capture the individual data breaches' characteristics. The regression finds that the data sensitivity, number of records stolen, customer segment and firm size influence the market reaction. Lastly, a data breach can have large consequences for the management team as job losses are relatively common.