Prioritizing Investments in Cybersecurity: Empirical Evidence from an Event Study on the Determinants of Cyberattack Costs

TL;DR

This study empirically examines the economic impact of cyber incidents on listed firms using an event study approach, revealing that data breaches and health sector firms suffer significant losses, but previous significance claims are challenged.

Contribution

It provides a rigorous empirical analysis of cyber incident impacts on firms, adjusting for statistical issues, and identifies sector-specific vulnerabilities and the effects of different incident types.

Findings

Data breaches cause an average loss of -1.3% or USD -1.9 billion.

Health sector firms experience an average loss of -5.21%.

Significance of abnormal returns diminishes after accounting for statistical adjustments.

Abstract

Along with the increasing frequency and severity of cyber incidents, understanding their economic implications is paramount. In this context, listed firms' reactions to cyber incidents are compelling to study since they (i) are a good proxy to estimate the costs borne by other organizations, (ii) have a critical position in the economy, and (iii) have their financial information publicly available. We extract listed firms' cyber incident dates and characteristics from newswire headlines. We use an event study over 2012--2022, using a three-day window around events and standard benchmarks. We find that the magnitude of abnormal returns around cyber incidents is on par with previous studies using newswire or alternative data to identify cyber incidents. Conversely, as we adjust the standard errors accounting for event-induced variance and residual cross-correlation, we find that the previously claimed significance of abnormal returns vanishes. Given these results, we run a horse race of specifications, in which we test for the marginal effects of type of cyber incidents, target firm sector, periods, and their interactions. Data breaches are the most detrimental incident type with an average loss of -1.3\% or (USD -1.9 billion) over the last decade. The health sector is the most sensitive to cyber incidents, with an average loss of -5.21\% (or USD -1.2 billion), and even more so when these are data breaches. Instead, we cannot show any time-varying effect of cyber incidents or a specific effect of the type of news as had previously been advocated.