Financial market reaction to cyberattacks

Abstract Drawing upon an extensive dataset comprising 3,680 cyberattacks on firms listed in 5 stock markets, our main objective is to ascertain the financial market reaction based on a hybrid valuation inspired by the event study methodology and a counterfactual analysis. Analyses concern three dates that are specific to cyberattacks: 1) the accident date; 2) the first notice date; and 3) the original loss start date. Results indicate that there is a negative abnormal return for the NASDAQ after the accident date. The reactions of the NASDAQ and NYSE are similar, and negative for the first notice date but positive after the original loss start date. In the European context, cumulative abnormal returns are negative for French and German companies after the first notice date.

[1]  J. Lintner.  SECURITY PRICES, RISK, AND MAXIMAL GAINS FROM DIVERSIFICATION , 1965 .

[2]  J. Lintner.  THE VALUATION OF RISK ASSETS AND THE SELECTION OF RISKY INVESTMENTS IN STOCK PORTFOLIOS AND CAPITAL BUDGETS , 1965 .

[3]  J. Mossin.  EQUILIBRIUM IN A CAPITAL ASSET MARKET , 1966 .

[4]  R. Ball,et al.  An empirical evaluation of accounting income numbers , 1968 .

[5]  E. Fama,et al.  The Adjustment of Stock Prices to New Information , 1969 .

[6]  D. Rubin,et al.  The central role of the propensity score in observational studies for causal effects , 1983 .

[7]  M. E. Gordon,et al.  Direct Mail Privacy-Efficiency Trade-offs within an Implied Social Contract Framework , 1993 .

[8]  Ravi Bhushan,et al.  An informational efficiency perspective on the post-earnings announcement drift , 1994 .

[9]  H. Jeff Smith,et al.  Information Privacy: Measuring Individuals' Concerns About Organizational Practices , 1996, MIS Q..

[10]  James H. Moor,et al.  Towards a theory of privacy in the information age , 1997, CSOC.

[11]  A. Mackinlay,et al.  Event Studies in Economics and Finance , 1997 .

[12]  John J. Binder.  The Event Study Methodology Since 1969 , 1997 .

[13]  J. Gajewski,et al.  Seasoned Equity Issues in a Closely Held Market: Evidence from France , 1998 .

[14]  Erik Stafford,et al.  New Evidence and Perspectives on Mergers , 2001 .

[15]  Rajeev Dehejia,et al.  Propensity Score-Matching Methods for Nonexperimental Causal Studies , 2002, Review of Economics and Statistics.

[16]  Albert H. Segars,et al.  An Empirical Examination of the Concern for Information Privacy Instrument , 2002, Inf. Syst. Res..

[17]  Lei Zhou,et al.  The Economic Cost of Publicly Announced Information Security Breaches: Empirical Evidence from the Stock Market , 2003, J. Comput. Secur..

[18]  Ashish Garg,et al.  Quantifying the financial impact of IT security breaches , 2003, Inf. Manag. Comput. Secur..

[19]  Ephraim R. McLean,et al.  Key Issues for IT Executives , 2004, MIS Q. Executive.

[20]  Andrew H. Chen,et al.  The effects of terrorism on global capital markets , 2004 .

[21]  Huseyin Cavusoglu,et al.  The Effect of Internet Security Breach Announcements on Market Value: Capital Market Reactions for Breached Firms and Internet Security Developers , 2004, Int. J. Electron. Commer..

[22]  Anat Hovav,et al.  The Impact of Virus Attack Announcements on the Market Value of Firms , 2004, Inf. Secur. J. A Glob. Perspect..

[23]  Heiko Gewald,et al.  The impact of perceived risk on the capital market’s reaction to outsourcing announcements , 2007, Inf. Technol. Manag..

[24]  Jerry N. Luftman.  Key Issues for IT Executives 2004 , 2005, MIS Q. Executive.

[25]  Carol V. Brown,et al.  Five Mindsets for Retaining IT Staff , 2006, MIS Q. Executive.

[26]  Alessandro Acquisti,et al.  Is There a Cost to Privacy Breaches? An Event Study , 2006, WEIS.

[27]  William Yurcik,et al.  A statistical analysis of disclosed storage security breaches , 2006, StorageSS '06.

[28]  Mooweon Rhee,et al.  The Liability of Good Reputation: A Study of Product Recalls in the U.S. Automobile Industry , 2006, Organ. Sci..

[29]  W. Sharpe,et al.  Capital Asset Prices: A Theory of Market Equilibrium under Conditions of Risk , 2007 .

[30]  Jackie Rees Ulmer,et al.  Market Reactions to Information Security Breach Announcements: An Empirical Analysis , 2007, Int. J. Electron. Commer..

[31]  Wen-Hsien Tsai,et al.  Will eChannel additions increase the financial performance of the firm?—The evidence from Taiwan , 2007 .

[32]  Kevin M. Gatzlaff,et al.  The Effect of Data Breaches on Shareholder Wealth , 2008 .

[33]  Kenneth R. Ahern,et al.  Sample Selection and Event Study Estimation , 2008 .

[34]  Narcyz Roztocki,et al.  Information Technology Investments: Does Activity Based Costing Matter? , 2009, J. Comput. Inf. Syst..

[35]  Sudden CEO vacancy and the long-run economic consequences , 2009 .

[36]  Bryan Mase.  The impact of name changes on company value , 2009 .

[37]  Qing Hu,et al.  The impact of information security events on the stock value of firms: the effect of contingency factors , 2011, J. Inf. Technol..

[38]  Lei Zhou,et al.  The impact of information security breaches: Has there been a downward shift in costs? , 2011, J. Comput. Secur..

[39]  Jack L. Treynor.  Toward a Theory of Market Value of Risky Assets , 2012 .

[40]  Treynor on Institutional Investing: Treynor/Treynor , 2012 .

[41]  Katerina Berezina,et al.  The impact of information security breach on hotel guest perception of service quality, satisfaction, revisit intentions and word‐of‐mouth , 2012 .

[42]  M. King.  The Contagion and Competition Effects of Bank Bailouts Announced in October 2008 , 2013 .

[43]  Constantinos Patsakis,et al.  The relation between information security events and firm market value, empirical evidence on recent disclosures: An extension of the GLZ study , 2014, J. Inf. Secur. Appl..

[44]  Jan Muntermann,et al.  How Data Breaches Ruin Firm Reputation on Social Media! - Insights from a Sentiment-based Event Study , 2015, Wirtschaftsinformatik.

[45]  Pamela P. Peterson,et al.  A Review of Issues and Methodology , 2016 .

[46]  Sasha Romanosky,et al.  Examining the costs and causes of cyber incidents , 2016, J. Cybersecur..

[47]  O. Tosun,et al.  Cyber Attacks and Stock Market Activity , 2019, International Review of Financial Analysis.

[48]  Cyber-attacks and stock market activity , 2021, International Review of Financial Analysis.