The effect of cyber-attacks on stock returns

Abstract

A widely debated issue in recent years is cybercrime. Breaches in the security of accessibility, integrity and confidentiality of information involve potentially high explicit and implicit costs for firms. This paper investigates the impact of information security breaches on stock returns. Using event-study methodology, the study provides empirical evidence on the effect of announcements of cyber-attacks on the market value of firms from 1995 to 2015. Results show that substantial negative market returns occur following announcements of cyber-attacks. Financial entities often suffer greater negative effects than other companies and non-confidential cyber-attacks are the most dangerous, especially for the financial sector. Overall findings seem to show a link between cybercrime and insider trading

Do security breaches matter? The shareholder puzzle

“…Using the CAPM (Table , Panel A), the statistical results pertaining to each of the event windows in the proximity of the announcement date, namely (−1, 1), (−3, 1), (−2, 1), (−2, 0), (−2, −1), suggest that there is a statistically significant drop in value in anticipation of the breach announcement. These results differ from those described by Arcuri et al (), who find that substantial negative returns follow the announcement of breaches. Our observations are based on the results of the Patell test, the standardized cross‐sectional test, and the skewness corrected test.…”

“…Their analysis suggests that the effect of the breach on the attacked firm varies over time. Arcuri, Brogi, and Gandolfi () find that substantial negative returns follow the announcement of breaches, with financial firms incurring the greatest negative return. They also posit a link between cybercrime and insider trading.…”

Forecasting the Impact of Information Security Breaches on Stock Market Returns and VaR Backtest

“…[22] states that the nature of the breach influences Cumulative Abnormal Return (CAR), while [25] and [9] find that the nature of the attack is not a determinant of CAR. In general, there is a consensus that the announcement of a security breach leads to negative CAR [26]. [27] show that data breaches have a negative and statistically significant impact on a company's market value on the announcement day.…”