Do security breaches matter? The shareholder puzzle

Abstract

This article analyzes the effect of computer breaches on publicly traded equities from 2005 to 2017. An event study is performed and breaches analyzed conditioned on whether the breach announcement has been made in the mainstream media or through other channels. We find that in the period prior to the announcement date in the media, the mean abnormal return is negative, reflecting a likely leakage of information. In the period following the announcement date, the mean abnormal return is positive, often more than offsetting the previous declines. The findings have important implications for analysts, portfolio managers, institutional investors, and regulators.