Do data breaches damage reputation? Evidence from 45 companies between 2002 and 2018

Abstract

While data breaches have become more common, there is little evidence that companies that incur them experience a persistent decline in financial performance or security prices. Using new firm-level data between 2002 and 2018, this paper finds that firms experience a 26–29% increase in reputational intangible capital following an average data breach. However, the largest and most salient breaches are associated with a 5–9% decline in reputational intangible capital following a data breach. These effects are concentrated among firms in consumer-facing industries: smaller (larger) data breaches are associated with more positive (negative) effects. These results suggest that current regulatory guidance may not provide complete incentives for firms to invest in cybersecurity capabilities, particularly for small- to medium-sized breaches.