Estimating the market impact of security breach announcements on firm values

Security breaches can have a significant economic impact on a firm. With public disclosure laws passed, security breaches involving disclosure of private client information can both damage the firms’ reputation and lead to fines by US government agencies. We examined the impact of security breaches of US firms, as measured by their impact on the firm's market value. Data on security breaches were collected over the period 2004–2008. Reports and news articles corresponding to these breaches were obtained from public sources. Using event-study methodology, we estimate the impact of security breaches on the market value of publicly traded firms. Daily stock returns for firms impacted were obtained. Our results indicated that, on average, the announcement of a corporate security breach had a negative impact of about 1% of the market value of the firm during the days surrounding the event.