Much Ado about Nothing: The (Lack of) Economic Impact of Data Privacy Breaches

Abstract

In this paper, we examine the consequences of data breaches for a breached company. We find the economic consequences are, on average, very small for breached companies. On average, breaches result in less than −0.3 percent cumulative abnormal returns in the short window around the breach disclosure. Except for a few catastrophic breaches, the nominal difference in cumulative abnormal returns between breach companies and the matched companies disappears within days after the breach. We also test whether data breaches affect future accounting measures of performance, audit and other fees, and future Sarbanes-Oxley Section 404 reports of material internal control weaknesses, but find no differences between breach and matched companies. Our results address the question why companies are not spending more to reduce breaches. We conclude by providing a few explanations of why there appears to be an effect at the economy-wide level, but no noticeable effect on individual company performance.

The Effect of Auditor Cybersecurity Expertise on Audit Fees and Cyber Incidents.

“…Despite the above arguments that would suggest a positive association between cybersecurity experience and audit fees of non-breached clients, Richardson et al (2019) pointed out that these risks have long been known and thus have already been priced into audit fees regardless of cybersecurity experience. Furthermore, Yen et al (2018) argues that industry expertise can help auditors better assess cybersecurity risks and evaluate cybersecurity management processes with less effort, which implies that we would expect a negative association.…”

“…Supporting the argument, both Li et al (2020) and Smith et al (2019) It is arguable that audit fees are not solely determined by auditors but reflect a negotiation between the management and the auditor (Abbott et al 2003). In fact, anecdotal evidence suggests that auditors have difficulty raising audit fees due to intense completion for new clients (Richardson et al 2019). However, as SEC has repeatedly emphasized cybersecurity (SEC 2011, 2018b, 2018a), firms are under greater pressure complying with SEC's cybersecurity disclosure guidance and also urgently demand assistance in evaluating cybersecurity controls 2 .…”

“…Share prices of firms in the same industry or similar firms are also negatively influenced. However, some research work fails to find such association (e.g., Hilary et al 2016;Richardson et al 2019). Both Gordon et al (2011) and Richardson et al (2019) argue that the inconsistent results can be explained by difference in sample, selection criteria, and research method.…”

“…However, some research work fails to find such association (e.g., Hilary et al 2016;Richardson et al 2019). Both Gordon et al (2011) and Richardson et al (2019) argue that the inconsistent results can be explained by difference in sample, selection criteria, and research method. In addition to examining market valuation, a limited but growing number of studies are investigating the impact of cyber incidents on audit engagement.…”

Academic Research on the Role of Corporate Governance and IT Expertise in Addressing Cybersecurity Breaches: Implications for Practice, Policy, and Research

“…To date, cyber-attacks continue to increase and the success of governing bodies in addressing cybersecurity risks and security breaches is relatively unknown. 1 Although there are studies related to cybersecurity that provide research summaries in the areas of (1) cybersecurity disclosures, (2) cybersecurity investment, (3) economic consequences to cybersecurity incidents, and (4) manager and auditor responses to cybersecurity risks (Haapama¨ki and Sihvonen 2019;Richardson, Smith, and Weidenmier Watson 2019;Walton, Wheeler, Zhang, and Zhao 2021;Wilkin and Chenhall 2020), the role of IT as a governance tool to combat cyber-attacks has not been fully explored. With the aim of understanding the current and future role of governance mechanisms in managing cybersecurity risks, this paper reviews the existing cybersecurity guidelines and regulations, and summarizes the empirical research related to corporate governance, security breaches, and IT expertise in overseeing cyber risks, using a combination of words to search for relevant studies published in top peer-reviewed journals.…”