Do Nonprofessional Investors Care About How and When Data Breaches are Disclosed?

Abstract

While prior research suggests that the market responds negatively to data breach disclosures, how nonprofessional investors assess factors surrounding these disclosures has only been assessed anecdotally. We examine whether investor judgments are influenced by whether a breached company is the first to disclose a data breach and whether a significant amount of time has lapsed between the breach and disclosure. We find evidence that investors respond to a company originating disclosure with lower investment judgments than if disclosure comes from an external source, without consistent regard to the timing of disclosure. We also find that investors make the least favorable investment judgments when the breached company initiates the data breach disclosure and when there is a significant delay between the data breach and initial public disclosure. Our study provides a greater understanding of one consequence of data breaches, that is, how timing and disclosure initiative influence nonprofessional investors' judgments. JEL Classifications: G41; M41.

A proposed Framework for Studying the Impact of Cybersecurity on Accounting Information to Increase Trust in The Financial Reports in the Context of Industry 4.0: An Event, Impact and Response Approach

“…Further, issuing an independent cybersecurity assurance report may increase a company's ability to attract investments. Finally, (Cheng & Walton, 2019) explore whether the timing and source of data breaches impact investors' reactions to the data breaches. By using an experimental setting, the authors demonstrate that investors are less likely to invest in a company if the breach is announced by the company itself, as compared to an outside source.…”

أثر الإفصاح عن تقریر إدارة مخاطر الأمن السیبرانی على قرار الاستثمار بأسهم الشركات المقیدة بالبورصة المصریة: دراسة تجریبیة

“…‫يجرلنللث‬ ‫هلبح‬ ‫لا‬ ‫ل‬ ‫أ‬ (Frank et al, 2019;Cheng & Walton, 2019;Kelton & Pennington, 2020;Yang et al, 2020;Badawy, 2021…”

أثر جودة ومستوى التوکید على برنامج إدارة مخاطر الأمن السیبرانی على قرارات المستثمرین المصریین غیر المحترفین: دراسة تجریبیة (باللغة الانجلیزیة)

“…Based on a sample of 9,677 firm year observations from 2,264 firms in US, Berkman et al (2018) tested the impact of cybersecurity awareness, measured by the disclosure of information security, on the market value and found a positive and significant relationship. In the same context, Cheng & Walton (2019) investigated the impact of data breach disclosure initiative and timing on investors' valuations. Based on a sample of 107 non-professional investors from 32 states in US, the authors found that investors' valuation was negative in case the company is the first one to disclose the data breach and when there is a significant delay between the time of data breach and the time of public disclosure.…”

“…After excluding the participants who failed to answer the first manipulation check question (1 participant) and the second manipulation check question (15 question), the final number of participants is 64 (See Figure 1), distributed as follows: Group 1 (Big4 X Reasonable) = 17, Group 2 (non-Big4 X Reasonable) = 16, Group 3 (Big4 X Limited) = 16, and Group 4 (non-Big4 X Limited) = 15 participants (Hodge et al, 2009;Perols & Murthy, 2021). The researcher selected non-professional investors, as a stakeholder group, because they represent a considerable portion of the stock market (Cheng & Walton, 2019)…”