Affiliations: [a] Department of Economics and Department of Management Science and Engineering, Huang Engineering Center, Stanford, CA, USA | [b] Columbia University, New York, NY, USA
Correspondence:
[*]
Corresponding author: Christos Makridis, Stanford University, Palo Alto, CA, USA. E-mail: [email protected].
Abstract: We introduce a new dataset that links publicly reported data breaches and financial outcomes at the firm-level. First, we document three new facts about the incidence of data breaches: (i) heavy skewness in the distribution of the scale of data breaches, (ii) heterogeneity in records breached by sector, and (iii) differences in records breached between publicly traded and private firms. Second, while we find some evidence, using cross-sectional variation and controlling for time-varying observable firm inputs, that a 10% rise in breaches is associated with approximately a 0.2% decline in firm productivity, the result is sensitive to different specifications and datasets. Third, we show that the absence of more reliable estimates is driven by non-classical measurement error arising from sample selection problems in publicly reported breach data. We conclude by discussing the importance of developing reliable measurement approaches for answering policy questions in cyber security.
Keywords: Cyber crime, data breaches, productivity, information securityJEL: D80, H40, L10, L86
