Data security breaches make a “significant” negative impact on companies’ market value, US academics have warned.
In a paper presented last week to the Fifth Workshop on the Economics of Information Security at Cambridge University, Allan Friedman of Harvard University and Alessandro Acquisti and Rahul Telang of Carnegie Mello University analysed 78 “privacy” breaches between 1999 and 2006, and the impact of these incidents on the firms’ stock market values.
They looked at the difference between the expected and actual gains or losses in value of each company’s stocks, and applied that difference to each firm’s stock market value.
This produced an estimated loss figure of nearly $10m (£5.4m) following the announcement of the privacy breach, with the worst of the impact concentrated on the day a breach was announced and the day after.
The study also found that retail firms suffered more and to a greater degree than others.
The academics added that anecdotal evidence showed some of the worst losses hit companies a few days after the breach was announced.
“This is possibly related to the fact that data breaches tend to be more confusing – their magnitude, implications, and nature are more complicated and often not immediately tractable - than ‘pure’ security breaches,” their paper says.