Impact of cyberattacks on stock performance: a comparative study

Abstract

The recent spate of cyberattacks against critical infrastructure systems have necessitated the quest to examine the impact of such events on stock values. The question is 'what is the impact of cyberattack on stock values'? To address the question, data on cyberattacks announcements from 96 firms that are listed on S&P 500 1 between January 03, 2013 and December 29, 2017 were reviewed to draw some conclusions. The empirical analysis was performed in two ways: cross-section and industry level. The study employs statistical tests that account for the effects of cross-section correlation in returns, returns series correlation, volatility changes, and skewness in the returns, indicating the following results: For cross-section analysis, the outcome shows that markets do not significantly react to cyberattacks for all the event windows except [-30, 30], while for the sector-level assessment, the analysis offers two main results. First, while some firms react to cyber-attacks for long event window for retail sector, there is no significant evidence of a cumulative firm reaction to cyberattacks for both short and long event windows for the industrial, information technology and health sectors. Second, there is a strong evidence of cumulative reaction to cyberattacks (i.e. for [-1, 1]) for the financial industry, and the reactions disappear for relatively longer event windows. These outcomes imply that (1) studying the cumulative effects of cyberattacks on prices of listed firms without grouping them into the various sectors may be non-informative, (2) the financial sector firms tend to react cumulatively to cyberattacks over a 3-day period than other sectors, (3) technology firms tend to be less reactive to the announcement of a data breach; possibly such firms could have the necessary tools and techniques to address large-scale cyberattacks.

Socio-Economic Factors On Sector-Wide Systematic Risk Of Information Security Breaches: Conceptual Framework

“…To study the special influence of a range of incidents, from corporate purchases to joint venture establishment to CEO progressions the method of 'event study' has been engaged comprehensively in the accounting, finance and information security literature (Bose & Leung, 2013;Cavusoglu et al, 2004;Hovav et al, 2017;Kannan et al, 2007;Rosati et al, 2017;Smith et al, 2018;Tweneboah-Kodua et al, 2018;Yayla & Hu, 2011). This statistical practise advocates that an unanticipated event is probable to influence (increase or decrease) the script price resulting an abnormal returns on script prices (MacKinlay, 1997).…”

“…While intangible costs are difficult to estimate, such as loss of trust, reputation, and confidence by business stakeholders for future transactions. Underpinned by the Efficient Market Hypothesis in its semi-strong form (Fama, 1991;Fama et al, 1969;Malkiel & Fama, 1970) researches have tried to examine the impact of IS breach announcements on stock prices for effected firms (Berkman et al, 2018;Bianchi & Tosun, 2018;Campbell et al, 2003;Cavusoglu et al, 2004;Ettredge & Richardson, 2001;Hovav & D'Arcy, 2004;Kannan et al, 2007;Malhotra & Kubowicz Malhotra, 2011;Pirounias et al, 2014;Sangvinatsos, 2017;Sinanaj & Muntermann, 2013;Smith et al, 2018;Tweneboah-Kodua et al, 2018). Most of these studies have concluded a negative impact on stock price by considering the effect of un-systematic risk factors surrounding the breach such as factors specific to that type of attack (Arcuri et al, 2017;Bose & Leung, 2014;Hovav & D'Arcy, 2003), type of firm (Cavusoglu et al, 2004;Goel & Shawky, 2009;Rosati et al, 2017) and type of industry (Pirounias et al, 2014;Yayla & Hu, 2011) as shown in Figure 01.…”

Cyber attacks on hospitality sector: stock market reaction

“…It is interesting to verify whether the results of research carried out on other sectors (Goel and Shawky, 2009) are confirmed for hospitality. In fact, literature has shown that the cumulative effects of cyber attacks on listed companies’ prices can be more informative if the data are grouped by economic sector (Tweneboah-Kodua et al , 2018). This is particularly relevant for the hospitality industry, where the risk of a cyber attack is not firm-specific, but it has a potentially systemic nature.…”

Digital Retail Challenges within the EU

“…Stealing Personally Identifiable Information (PII) contributes to more than 50% of all data breaches and has a significant effect on revenue and stock markets within the retail sector unlike other sectors. A lot of breaches are usually discovered way later after the attack has happened [48]. Article 31 of the GDPR requires Data Controllers to report data breaches to the supervisory authority within 72 hours of becoming aware of the breach.…”

“…In order to conform with the of Data Minimization where data collected is required to perform a specific purpose [13], tracking cookies which are essential in performing analytics is not possible. Data analytics is one of the major contributors of revenue streams for digital retailers [48]. This is a major challenge to digital retailers.…”