Security events can impact trust and reputation, but they can also have financial consequences. In this article, we discuss to what extent security events impact stock market prices of businesses.
Cybersecurity events affect stock market prices
In previous articles, we discussed evidence that shows that data breaches can be detrimental to customers’ trust and could have a positive or negative impact on the reputation of businesses. Yes, reputation can be improved when companies use the increased media attention that follows a data breach and demonstrate that they meet customers’ needs.
But to what extent do data breaches impact stock market prices? A systemic literature review (2016) based on 45 studies shows that security events are affecting significantly the stock price of businesses. The study indicates that positive events, such as investments in IT security, have a positive and significant impact on the stock price of the firms that invest in IT security. On the other hand, negative information security events, such as security breaches, have a significant negative impact on the stock price of the breached firms. However, this applies to the majority of companies, but not to all.
Impact on stock prices is sector-dependent
Furthermore, a more recent study (2018) argues that the impact is sector-specific and provides two key findings. First, the study reports a small impact on stock prices of cyber-attacks for the retail sector within 20 days after the attack is disclosed. Second, for firms in the financial sector, stock prices change immediately after the cyber-attack is disclosed, but normalize in the longer term.
Another research by Comparitech on breached companies listed on the NASDAQ shows that share prices of breached companies hit a low point approximately 110 market days following a breach. According to the authors, share prices fall -3.5% on average and underperform the NASDAQ by -3.5%. Interestingly, the study finds that Tech and finance companies were most impacted by a breach, while e-commerce and social media companies were least affected. In addition, the authors note that the impact of cyber events on stock prices diminishes over time.
Do cybersecurity events affect stock prices?
To sum, the available evidence suggests that stock prices are impacted by security events, but the impact might not be as big as expected and there have been some exceptions. This is also highlighted in a Harvard Business Review article that states that cyber breaches do not have to sink stock prices. As stated by the authors:
Getting hacked doesn’t have to be a disaster, however. The JP Morgan Chase breach in 2014, for instance, didn’t impact its stock growth negatively, in fact, its stock actually rose slightly. These counterintuitive outcomes indicate that many factors determine the fallout from data breach incidents.”
Hence, more research is needed to understand what factors influence the stock prices after a cybersecurity event.