The economic cost of publicly announced information security breaches: empirical evidence from the stock market^*

Article type: Research Article

Authors: Campbell, Katherine | Gordon, Lawrence A. | Loeb, Martin P. | Zhou, Lei

Affiliations: Accounting and Information Assurance, Robert H. Smith School of Business, University of Maryland, College Park, MD 20742, USA

Note: [*] The study reported in this paper was partially supported by the DOD, Laboratory for Telecommunications Sciences, through a contract with the University of Maryland Institute for Advanced Computer Studies (UMIACS). Preliminary results of some data analyses reported in this paper were included in a working paper by Gordon et al. [21] and presented at the LTS May 2001 workshop.

Abstract: This study examines the economic effect of information security breaches reported in newspapers on publicly traded US corporations. We find limited evidence of an overall negative stock market reaction to public announcements of information security breaches. However, further investigation reveals that the nature of the breach affects this result. We find a highly significant negative market reaction for information security breaches involving unauthorized access to confidential data, but no significant reaction when the breach does not involve confidential information. Thus, stock market participants appear to discriminate across types of breaches when assessing their economic impact on affected firms. These findings are consistent with the argument that the economic consequences of information security breaches vary according to the nature of the underlying assets affected by the breach.

DOI: 10.3233/JCS-2003-11308

Journal: Journal of Computer Security, vol. 11, no. 3, pp. 431-448, 2003