The Economic Impact of Information Security Breaches: Firm Value and Intra-industry Effects

IT managers often struggle to justify investments in information security. In addition to standard quantitative analyses such as Return on Security Investment (ROSI), executive management may also want to know what the effect of potential security breaches would be on the market value of a publicly-traded firm. This study attempts to shed light on the issue by examining the impact of information security breach announcements on shareholder value. This study also examines the effects of such announcements on a portfolio of the firm’s competitors in an effort to examine the contagion and competitive intra-industry effects. We find that the market value of an affected firm’s competitors increases following the announcement of a security breach, consistent with the competitive model of intra-industry effects. The magnitude of the competitive effect appears to depend on the nature of the security breach. The increase in competitor value is higher when the security breach involves non-confidential firm and customer information. When the security breach involves confidential data, the announcement return is negative and significant (both economically and statistically), providing IT management with additional support for seeking funds to avoid such security events.