Empirical Analysis of Data Breach Litigation

Romanosky, Sasha; Hoffman, David A.; Acquisti, Alessandro

doi:10.2139/ssrn.1884499

Cited by 10 publications

(13 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Additionally, banks with breaches experience a significant decline in deposits, and non-banks experience significant declines in sales in the long run. Romanosky et al (2014) empirically investigate the impact of data breaches on litigation risk and the outcomes of data breach litigation. The authors show that federal lawsuits due to data breaches result in a high settlement rate of about 50%.…”

Section: Related Literaturementioning

confidence: 99%

See 1 more Smart Citation

Data breaches and corporate liquidity management

Boasiako

Keefe

2020

Euro Fin Management

View full text Add to dashboard Cite

This paper investigates the effects of data breach disclosure laws and the subsequent disclosure of data breaches on the cash policies of corporations in the United States. Exploiting a series of natural experiments regarding staggered state-level data breach disclosure laws, we find that the passage of mandatory disclosure laws leads to an increase in cash holdings.Our finding suggests that mandatory data breach disclosure laws increase the risks related to data breaches.Further, we find firms that suffer data breaches adjust their financial policies by holding more cash as well as decreasing external finance and investment.

show abstract

Section: Related Literaturementioning

confidence: 99%

“…See https://www.privacyrights.org/. PRC is the most cited source of information relating to data breaches (e.g.,Kamiya et al, 2020;Romanosky et al, 2014).…”

mentioning

confidence: 99%

Data breaches and corporate liquidity management

Boasiako

Keefe

2020

Euro Fin Management

View full text Add to dashboard Cite

show abstract

“…Our method can be combined with any approach for the quantification of impact. Several studies on the quantification of impact exist, including impact from direct losses, (84,85) technical impacts, (60) financial impacts, (86) and reputational and operational impacts. (87)…”

Section: 70mentioning

confidence: 99%

“…Whereas several studies on the quantification of impact exist, (60,(84)(85)(86)(87) current risk assessment methodologies lack a well-specified method for the measurement of attack likelihood. (23) As discussed in Section 2, in this work we specifically refer to untargeted attacks.…”

Section: A Quantitative Model For Likelihood Of Cyberattacksmentioning

confidence: 99%

Security Events and Vulnerability Data for Cybersecurity Risk Estimation

Allodi

Massacci

2017

Risk Analysis

View full text Add to dashboard Cite

Current industry standards for estimating cybersecurity risk are based on qualitative risk matrices as opposed to quantitative risk estimates. In contrast, risk assessment in most other industry sectors aims at deriving quantitative risk estimations (e.g., Basel II in Finance). This article presents a model and methodology to leverage on the large amount of data available from the IT infrastructure of an organization's security operation center to quantitatively estimate the probability of attack. Our methodology specifically addresses untargeted attacks delivered by automatic tools that make up the vast majority of attacks in the wild against users and organizations. We consider two-stage attacks whereby the attacker first breaches an Internet-facing system, and then escalates the attack to internal systems by exploiting local vulnerabilities in the target. Our methodology factors in the power of the attacker as the number of "weaponized" vulnerabilities he/she can exploit, and can be adjusted to match the risk appetite of the organization. We illustrate our methodology by using data from a large financial institution, and discuss the significant mismatch between traditional qualitative risk assessments and our quantitative approach.

show abstract

“…However, there are also underlying costs associated with each software vulnerability, as mentioned above, and those costs maybe invisible [10]. For example, Romanosky et al [11] studied software-related data breaches in the United States and found that 4% of them resulted in litigation in federal courts, out of which 50% (2% of the original studied cases) were won. Considering no impact of vulnerabilities on vendors, as shown by prior work, the vendors do not seem to face any immediate effect on themselves, unlike the end users.…”

Section: Introductionmentioning

confidence: 99%

Measuring the Cost of Software Vulnerabilities

Anwar¹,

Khormali²,

Choi³

et al. 2020

ICST Transactions on Security and Safety

View full text Add to dashboard Cite

Enterprises are increasingly considering security as an added cost, making it necessary for those enterprises to see a tangible incentive in adopting security measures. Despite data breach laws, prior studies have suggested that only 4% of reported data breach incidents have resulted in litigation in federal courts, showing the limited legal ramifications of security breaches and vulnerabilities. In this paper, we study the hidden cost of software vulnerabilities reported in the National Vulnerability Database (NVD) through stock price analysis. We perform a high-fidelity data augmentation to ensure data reliability and to estimate vulnerability disclosure dates as a baseline for estimating the implication of software vulnerabilities. We further build a model for stock price prediction using the nonlinear autoregressive neural network with exogenous factors (NARX) Neural Network model to estimate the effect of vulnerability disclosure on the stock price. Compared to prior work, which relies on linear regression models, our approach is shown to provide better prediction performance. Our analysis also shows that the effect of vulnerabilities on vendors varies, and greatly depends on the specific software industry. Whereas some industries are shown statistically to be affected negatively by the release of software vulnerabilities, even when those vulnerabilities are not broadly covered by the media, some others were not affected at all.

show abstract

Empirical Analysis of Data Breach Litigation

Cited by 10 publications

References 20 publications

Data breaches and corporate liquidity management

Data breaches and corporate liquidity management

Security Events and Vulnerability Data for Cybersecurity Risk Estimation

Measuring the Cost of Software Vulnerabilities

Contact Info

Product

Resources

About