Time-varying effects of cyberattacks on firm value
Tóm tắt
This paper adds to research on the effect of cyber events on the attacked firm’s value in light of conflicting results from previous studies. Using 536 cyberattack announcements that occurred during the 2007–2016 period, the main goal is to investigate for changes in investor reaction over time as cyberattacks have become more frequent. Empirical evidence shows that cumulative abnormal returns of attacked firms were volatile earlier in the period, became increasingly negative, but have moderated recently. This paper proposes and discusses potential explanations for this observed U-shaped pattern over the 10-year period. The relation between stock market reaction and type of attack, type of data affected, type of perpetrator and various firm level characteristics is also examined.
Tài liệu tham khảo
Accenture. 2017. Cost of Cyber Crime Study. https://www.accenture.com/_acnmedia/PDF-62/Accenture-2017CostCybercrime-US-FINAL.pdf#zoom=50, Last accessed on 06/20/2018.
Acquisti, A., A. Friedman, and R. Telang. 2006. Is There A Cost to Privacy Breaches? An Event Study, ICIS 2006 Proceedings, 94. https://www.semanticscholar.org/paper/Is-There-a-Cost-to-Privacy-Breaches-An-Event-Study-Acquisti-Friedman/1a5d719687a6a0bdea269f54f25b121d509172d0.
Akey, P., S. Lewellen, and I. Liskovich. 2018. Hacking Corporate Reputations, Rotman School of Management Working Paper. https://ssrn.com/abstract=3143740.
Akey, P., V. Gregoire, and C. Martineau. 2020. Price Revelation from Insider Trading: Evidence from Hacked Earnings News, Rotman School of Management Working Paper. https://ssrn.com/abstract=3365024.
Amir, E., S. Levi, and T. Livne. 2018. Do Firms Underreport Information on Cyber-attacks? Evidence from Capital Markets. Review of Accounting Studies 23: 1177–1206.
Andriosopoulos, D., and S. Yang. 2015. The Impact Of Institutional Investors on Mergers and Acquisitions in The United Kingdom. Journal of Banking & Finance 50: 547–561.
Arcuri, M.C., M. Brogi, and G. Gandolfi. 2014. The Effect of Information Security Breaches on Stock Returns: Is the Cyber Crime a Threat to Firms? European Financial Management Meeting.
Ashby, S., T. Buck, S. Nöth-Zahn, and T. Peisl. 2018. Emerging IT Risks: Insights from German Banking. The Geneva Papers on Risk and Insurance: Issues and Practice 43 (2): 180–207.
Biener, C., M. Eling, and J.H. Wirfs. 2015. Insurability of Cyber Risk: An Empirical Analysis. The Geneva Papers on Risk and Insurance: Issues and Practice 40 (1): 131–158.
Böhme, R. 2005. Cyber-Insurance Revisited, WEIS. https://infosecon.net/workshop/pdf/15.pdf.
Bose, I., and A.C.M. Leung. 2014. Do Phishing Alerts Impact Global Corporations? A Firm Value Analysis. Decision Support Systems 64: 67–78.
Campbell, K., L.A. Gordon, M.P. Loeb, and L. Zhou. 2003. The Economic Cost of Publicly Announced Information Security Breaches: Empirical Evidence from the Stock Market. Journal of Computer Security 11 (3): 431–448.
Carhart, M. 1997. On Persistence in Mutual Fund Performance. The Journal of Finance 52 (1): 57–82.
Cavusoglu, H., B. Mishra, and S. Raghunathan. 2004. The Effect of Internet Security Breach Announcements on Market Value: Capital Market Reactions for Breached Firms and Internet Security Developers. International Journal of Electronic Commerce 9 (1): 70–104.
Chen, X., I. Bose, A.C.M. Leung, and C. Guo. 2011. Assessing the Severity of Phishing Attacks: A Hybrid Data Mining Approach. Decision Support Systems 50 (4): 662–672.
Das, S., A. Mukhopadhyay, and M. Anand. 2012. Stock Market Response to Information Security Breach: A Study Using Firm and Attack Characteristics. Journal of Information Privacy and Security 8 (4): 27–55.
De Smidt, G., and W. Botzen. 2018. Perceptions of Corporate Cyber Risks and Insurance Decision-Making. The Geneva Papers on Risk and Insurance: Issues and Practice 43 (2): 239–274.
Della Vigna, S., and J.M. Pollet. 2009. Investor Inattention and Friday Earnings Announcements. The Journal of Finance 64 (2): 709–749.
DeLong, G.L. 2001. Stockholder Gains from Focusing Versus Diversifying Bank Mergers. Journal of Financial Economics 59 (2): 221–252.
Eling, M. 2018. Cyber Risk and Cyber Risk Insurance: Status Quo and Future Research. The Geneva Papers on Risk and Insurance: Issues and Practice 43 (2): 175–179.
Eling, M., and N. Loperfido. 2017. Data Breaches: Goodness of Fit, Pricing, and Risk Measurement. Insurance: Mathematics and Economics 75: 126–136.
Fama, E.F., and K.R. French. 1996. Multifactor Explanations of Asset Pricing Anomalies. The Journal of Finance 51 (1): 55–84.
Finra. 2018. Report on Cybersecurirty Practices. https://www.finra.org/sites/default/files/p602363%20Report%20on%20Cybersecurity%20Practices_0.pdf, last accessed on 02/03/2020.
Forbes. 2014. Target Profit Falls 46% on Credit Card Breach and the Hits Could Keep on Coming. www.forbes.com/sites/maggiemcgrath/2014/02/26/target-profit-falls-46-on-credit-card-breach-and-says-the-hits-could-keep-on-coming/#4a0411827326, last accessed on 06/20/2018.
Garg, A., J. Curtis, and H. Halper. 2003. Quantifying the Financial Impact of IT Security Breaches. Information Management & Computer Security 11 (2): 74–83.
Gatzlaff, K.M., and K.A. McCullough. 2010. The Effect of Data Breaches on Shareholder Wealth. Risk Management and Insurance Review 13 (1): 61–83.
Gordon, L.A., M.P. Loeb, and L. Zhou. 2011. The Impact of Information Security Breaches: Has There Been a Downward Shift in Costs? Journal of Computer Security 19 (1): 33–56.
Greenwald, J. 2018. Stand-Alone, Package Cyber Premiums Jump: Fitch. https://www.businessinsurance.com/article/20180509/NEWS06/912321167/Stand-alone-package-cyber-premiums-jump-Fitch-Ratings#, last accessed on 06/20/2018.
Hinz, O., M. Nofer, D. Schiereck, and J. Trillig. 2015. The Influence of Data Theft on The Share Prices and Systematic Risk of Consumer Electronics Companies. Information & Management 52 (3): 337–347.
Hirshleifer, D., S.S. Lim, and S.H. Teoh. 2009. Driven to Distraction: Extraneous Events and Underreaction to Earnings News. The Journal of Finance 64 (5): 2289–2325.
Hovav, A., and J. D'Arcy. 2003. The Impact of Denial-of-Service Attack Announcements on The Market Value of Firms. Risk Management and Insurance Review 6 (2): 97–121.
Kamiya, S., J. Kang, J. Kim, A. Milidonis, and R. M. Stulz. 2018. What is the Impact of Successful Cyberattacks on Target Firms? Discussion paper, National Bureau of Economic Research. https://www.nber.org/papers/w24409.
Kannan, K., J. Rees, and S. Sridhar. 2007. Market Reactions to Information Security Breach Announcements: An Empirical Analysis. International Journal of Electronic Commerce 12 (1): 69–91.
Kvochko, E., and R. Pant. 2015. Why Data Breaches Don’t Hurt Stock Prices. Harvard Business Review 5: 2–5.
Luo, Y. 2005. Do Insiders Learn from Outsiders? Evidence from Mergers and Acquisitions. The Journal of Finance 60 (4): 1951–1982.
Makridis, C., and B. Dean. 2018. Measuring the Economic Effects of Data Breaches on Firm Outcomes: Challenges and Opportunities. Journal of Economic and Social Measurement 43: 59–83.
Malhotra, A., and C. Kubowicz Malhotra. 2011. Evaluating Customer Information Breaches as Service Failures: An Event Study Approach. Journal of Service Research 14 (1): 44–59.
Marketwatch. 2020. Cybersecurity Market Global Growth, Opportunities, Industry Analysis & Forecast to 2024. https://www.marketwatch.com/press-release/cybersecurity-market-global-growth-opportunities-industry-analysis-forecast-to-2024-2020-04-23?tesla=y, last accessed on 04/29/2020.
Marotta, A., and M. McShane. 2018. Integrating a Proactive Technique into a Holistic Cyber Risk Management Approach. Risk Management and Insurance Review 21 (3): 435–452.
McAfee. 2018. The Economic Impact of Cybercrime—No Slowing Down. www.mcafee.com/us/resources/reports/rp-economic-impact-cybercrime-summary.pdf, last accessed on 06/20/2018.
Modi, S.B., M.A. Wiles, and S. Mishra. 2015. Shareholder Value Implications of Service Failures in Triads: The Case of Customer Information Security Breaches. Journal of Operations Management 35: 21–39.
Morse, E.A., V. Raval, and J.R. Wingender Jr. 2011. Market Price Effects of Data Security Breaches. Information Security Journal: A Global Perspective 20 (6): 263–273.
Ogut, H., N. Menon, and S. Raghunathan. 2005. Cyber Insurance and IT Security Investment: Impact of Interdependence Risk, WEIS. https://www.semanticscholar.org/paper/Cyber-Insurance-and-IT-Security-Investment%3A-Impact-Ogut-Menon/7780a75c68604ca979d0fe8896ebc998ae6a02fc.
Patel, N. 2010. The Effect of IT Hack Announcements on the Market Value of Publicly Traded Corporations. Duke Journal of Economics 22: 10.
Pirounias, S., D. Mermigas, and C. Patsakis. 2014. The Relation Between Information Security Events and Firm Market Value Empirical Evidence on Recent Disclosures: An Extension of the GLZ Study. Journal of Information Security and Applications 19 (4–5): 257–271.
Pooser, D.M., M.J. Browne, and O. Arkhangelska. 2018. Growth in the Perception of Cyber Risk: Evidence from US P&C Insurers. The Geneva Papers on Risk and Insurance: Issues and Practice 43 (2): 208–223.
Ricci, O. 2015. The Impact of Monetary Policy Announcements on the Stock Price of Large European Banks During the Financial Crisis. Journal of Banking & Finance 52: 245–255.
Rosati, P., M. Cummins, P. Deeney, F. Gogolin, L. van der Werff, and T. Lynn. 2017. The Effect of Data Breach Announcements Beyond the Stock Price: Empirical Evidence on Market Activity. International Review of Financial Analysis 49: 146–154.
Sharpe, W.F. 1964. Capital Asset Prices: A Theory of Market Equilibrium under Conditions of Risk. The Journal of Finance 19 (3): 425–442.
Shetty, S., M. McShane, L. Zhang, J.P. Kesan, C.A. Kamhoua, K. Kwiat, and L.L. Njilla. 2018. Reducing Informational Disadvantages to Improve Cyber Risk Management. The Geneva Papers on Risk and Insurance: Issues and Practice 43 (2): 224–238.
Spanos, G., and L. Angelis. 2016. The Impact of Information Security Events to the Stock Market: A Systematic Literature Review. Computers & Security 58: 216–229.
Statista, 2019, Share of organizations with cyber liability insurance worldwide 2011–2018. https://www.statista.com/statistics/422463/ownership-of-cyber-liability-insurance/#statisticContainer, last accessed on 02/03/2020.
Tabuchi, H., 2018, 2017 Set a Record for Losses From Natural Disasters. It Could Get Worse. https://www.nytimes.com/2018/01/04/climate/losses-natural-disasters-insurance.html, last accessed on 06/20/2018.
The Geneva Association. 2016. Ten Key Questions on Cyber Risk and Cyber Risk Insurance. Authors: Martin Eling, Werner Schnell and Fabian Sommerrock. December. https://www.genevaassociation.org/media/954708/cyber-risk-10-key-questions.pdf.
Yayla, A.A., and Q. Hu. 2011. The Impact of Information Security Events on the Stock Value of Firms: The Effect of Contingency Factors. Journal of Information Technology 26 (1): 60–77.