Time-varying effects of cyberattacks on firm value

Abstract

This paper adds to research on the effect of cyber events on the attacked firm's value in light of conflicting results from previous studies. Using 536 cyberattack announcements that occurred during the 2007-2016 period, the main goal is to investigate for changes in investor reaction over time as cyberattacks have become more frequent. Empirical evidence shows that cumulative abnormal returns of attacked firms were volatile earlier in the period, became increasingly negative, but have moderated recently. This paper proposes and discusses potential explanations for this observed U-shaped pattern over the 10-year period. The relation between stock market reaction and type of attack, type of data affected, type of perpetrator and various firm level characteristics is also examined.

Cyber risk management: History and future research directions

“…One way to classify and identify cyberattacks is whether they affect the “confidentiality, availability or integrity of information or information systems” (Biener et al, 2015). For example, data breach mainly affects confidentiality, denial of service and ransomware attacks involve availability of information, and website defacement reduces integrity, whereas phishing attacks might affect both confidentiality and integrity (McShane & Nguyen, 2020). Generally, an item is considered an identifiable asset when there are significantly negative consequences if the breached data are made publicly available, falsified, or no longer accessible.…”

“…Some event studies document significant negative shareholder reactions to cyber‐related incidents (e.g., Bose & Leung, 2014; Cavusoglu et al, 2004; Gatzlaff & McCullough, 2010; Higgs et al, 2016; Modi et al, 2015; Yayla & Hu, 2011), whereas others find insignificant evidence (e.g., Amir et al, 2018; Das et al, 2012; Hovav & D'Arcy, 2003; McShane & Nguyen, 2020). In addition, there is inconsistency with respect to the reported average market value loss (if any).…”

“…In particular, Gatzlaff and McCullough (2010) find that more recent cyber‐related incidents result in more negative shareholder reactions than attacks in an earlier period. In contrast, analyzing a comprehensive sample of cyberattacks over the 2007–2016 period, McShane and Nguyen (2020) report that the impact of cyberattacks on short‐term shareholder reactions over time follows a U‐shape curve. Possible explanations for the observed pattern include increased cybersecurity investments and cyber insurance usage, and/or investors becoming accustomed to the frequent occurrence of these cyber‐related events.…”

“…Compared with the substantial number of studies examining the impact of cybersecurity breaches on shareholder value in the short‐run, less attention has been devoted to their effect on firm long‐term performance (Kamiya et al, 2020; Ko & Dorantes, 2006; Lending et al, 2018; McShane & Nguyen, 2020; Morse et al, 2011). In general, there is some agreement among the mentioned papers that cyberattacks incur additional costs for targeted firms, which lowers their long‐term performance on average.…”

“…As discussed previously, risk analysis is an important step of the risk management process. There has been substantial work on determining the impact of cyberattacks on stock prices as described by McShane and Nguyen (2020) and Poyraz et al (2020) but not on the interaction of the risk analysis step with other parts of the ERM process. An interesting avenue for physical supply chain risk management researchers is to investigate if their work can be applied to the cyber supply chain risk, meaning the cyber risk that organizations face from their suppliers and vendors and termed interdependent security by Böhme and Schwartz (2010).…”