The Impact of Information Security Events on the Stock Value of Firms: The Effect of Contingency Factors

Abstract

The stock market reactions to information technology (IT)-related events have often been used as proxies to the value or cost of these events in the information systems literature. In this paper, we study the stock market reactions to information-security-related events using the event analysis methodology with consideration of the effects of a number of contingency factors, including business type, industry, type of breach, event year, and length of event window. We found that pure e-commerce firms experienced higher negative market reactions than traditional bricks-and-mortar firms in the event of security breach. We also found that denial of service attacks had higher negative impact than other types of security breaches. Finally, security events occurred in recent years were found to have less significant impact than those occurred earlier, suggesting that investors may have become less sensitive to the security events. Most interestingly, our analyses showed that the magnitude and longevity of security breaches vary with time across sub-samples. This raises some serious questions regarding the validity of analyzing only short-term stock market reactions as an indicator of the cost of security breaches, and in general, an indicator of the value of IT-related events. The implications of these results are discussed and potential future research directions are proposed.

The impact of repeated data breach events on organisations’ market value

“…The application of event studies in this form is well documented in academic research covering corporate events like earning announcements, stock splits (Fama et al, 1969) and mergers and acquisitions (Duso et al, 2010). Previous studies leveraging event study methodology to investigate the effect of information security incident events on market value include work by Kannan et al (2007), Yayla andHu (2011), Cavusoglu et al (2004), Campbell et al (2003), Gatzlaff and McCullough (2010) and Garg et al (2003). Wang et al (2007) take a different approach and apply event study methodology to financial reporting data rather than public breach announcements.…”

Institutional Drivers of Assimilation of Information Security Policies and Procedures in U.S. Firms: Test of an Empirical Model

“…Despite the fact that a number of studies have explored types of security threats [21], research shows that the nature of such threats is dynamic and evolving. As such, our research addresses an important aspect of IT-information security policies and the assimilation of such policies.…”

“…A number of studies conducted in recent years have sought to understand the types of threats that companies experience and their efforts to address them [21]. Yet, as the measures that organizations may undertake evolve, so too do the nature of threats they must address.…”

Analysis of the Impact of Data Breaches on the Market Value of Companies in the Period 2008 - 2012

“…"Vzhledem k obtížnostem při odhalování skutečných nákladů různých bezpečnostních incidentů je dobré hledat alternativní ukazatele k přímým nákladům." (Yayla, Hu, 2011) Jedním z alternativních způsobů určení výše nákladů bezpečnostních incidentů je sledování změn tržní hodnoty postižených firem. Jelikož tržní hodnota firem odráží jejich skutečnou hodnotu a je určovaná na základě všech informací a faktů, které jsou veřejně známé v daný okamžik, tak jakýkoliv incident, který firma zažije, by se měl na její tržní hodnotě projevit.…”

“…Zde se tedy pracuje s předpokladem, že velikost reakce akciového trhu na specifický incident představuje očekávanou cenu daného incidentu. (Yayla, Hu, 2011) Na základě výše zmíněného vzniklo několik studií, které se snaží zjistit, jaký mají bezpečnostní incidenty dopad na tržní hodnotu postižených firem. Studie se samozřejmě zabývají pouze firmami, které jsou veřejně obchodované na akciové burze.…”