Is Cybersecurity Risk Factor Disclosure Informative? Evidence from Disclosures Following a Data Breach

Abstract By examining managers’ decisions about disclosing updated assessments of firms’ risks, we present evidence that the risk factor disclosures are informative. We use setting cybersecurity after a data breach because breaches, especially severe serve as natural experiment where an exogenous shock to assessment their firm’s risks occurs. analyze topic from perspective two different theoretical lenses: economic lens optimal exposure and ethical stakeholder theory. Using sample firms experiencing find increase amount compared matched with no breach. Further investigation reveals severity breaches affects results; only breaches. While there is significant market reaction if breached subsequent annual reports include increased disclosures, negative occurs decrease regardless breach, implying anticipates