Reaction of Stock Volatility to Data Breach: an Event Study

Authors

  • Samuel Tweneboah-Koduah Ghana Institute of Management and Public Administration, Accra, Ghana https://orcid.org/0000-0002-2473-2113
  • Francis Atsu Dept. of Accounting and Finance, GIMPA, Accra, Ghana https://orcid.org/0000-0001-7832-6826
  • Ramjee Prasad CTIF Global Capsule, Dept. of Business Development and Technology, Aarhus University, Herning, Denmark

DOI:

https://doi.org/10.13052/jcsm2245-1439.931

Keywords:

Cybersecurity, Stock Volatility, Data Breach, Time-Varying Volatility, Event Study Methodology

Abstract

The paper assesses how stock market volatility reacts to data breach disclosure. The paper applies Volatility Event Analysis and Kolmogorov-Smirnov Test to analyse how equity risk (stock volatility) of 96 firms listed on the S&P 500 index reacted to the announcement of a data breach using records from Breach Level Index (BLI ) over the period between January 2013 and December 2018. Two levels of empirical analysis were performed: cross-section level and industry level. We employ statistical tests that adjust for the effects of cross-section firm-specific mean and volatility. The analysis delivers the following results: Firstly, cross-sectional analysis shows that there is evidence of significant abnormal across the firms and significant difference between before and after cyberattacks announcements. Secondly, the industry level analysis reveals that the firms in the financial industry exhibit more abnormal volatility and returns than firms in other sectors. Additionally, there is significant evidence of the difference in pre and post cyberattacks or data breach announcements, however, this effect tends to be more pronounced after the announcement of a data breach. Implying that data breach announcements can significantly influence equity volatility. In conclusion, the paper posits, equity investors and other stakeholders should reconsider their approach to cybersecurity events when updating the risk measures of their stocks and portfolios.

Downloads

Download data is not yet available.

Author Biographies

Samuel Tweneboah-Koduah, Ghana Institute of Management and Public Administration, Accra, Ghana

Samuel Tweneboah-Koduah, PhD is a full-time Lecturer at the Computer Science Dept. School of Technology, GIMPA, Accra, Ghana. Samuel has also been a visiting Lecturer to the Centre of Media and Information Technology, Aalborg University, Copenhagen, Denmark, a visiting Scholar to the University of Washington, Seattle and Northern Kentucky University USA. He has a number of peer-reviewed journal publications to his credit and has presented a couple of papers at international conferences. As a lecturer and a scholar, Samuel has been involved in a number of projects, both at national and international levels. Currently, he is the Ministry of Health (Ghana) appointed Governing Chairperson of Twifu-Praso Nursing and Midwifery Training College. Samuel’s research interest is in the areas of Cybersecurity and Risk Assurance, Digital Forensics, Technology Innovation and Application, Data Mining, Cloud Computing, Internet of Things, Wireless and Mobile Networks.

Francis Atsu, Dept. of Accounting and Finance, GIMPA, Accra, Ghana

Francis Atsu is a consultant for the Ministry of Finance on Basel Accords under the Ghana Economic Management Strengthening Technical Assistance (GEMS-TA) project funded by the World Bank. He is the head of the enterprise risk management team of GIMPA, trustee of GIMPA provident fund and occupational pension scheme. Dr. Atsu research interests include risk modelling and management; economic and financial modelling and forecasting; behavioral finance, and survival analysis of corporate entities. He holds a PhD in Finance, MSc in Financial Mathematics and BSc (Hons) in Mathematics.

Ramjee Prasad, CTIF Global Capsule, Dept. of Business Development and Technology, Aarhus University, Herning, Denmark

Ramjee Prasad, a Fellow of IEEE, IET, IETE, and WWRF, is a Professor of Future Technologies for Business Ecosystem Innovation (FT4BI) in the Department of Business Development and Technology, Aarhus University, Herning, Denmark. He is the Founder President of the CTIF Global Capsule (CGC). He is also the Founder Chairman of the Global ICT Standardization Forum for India, established in 2009. He has been honored by the University of Rome “Tor Vergata”, Italy as a Distinguished Professor of the Department of Clinical Sciences and Translational Medicine on March 15, 2016. He is an Honorary Professor of the University of Cape Town, South Africa, and the University of KwaZulu-Natal, South Africa. He has received Ridderkorset of Dannebrogordenen (Knight of the Dannebrog) in 2010 from the Danish Queen for the internationalization of top-class telecommunication research and education awards such as IEEE Communications Society Wireless Communications within the field of wireless and personal communication, 2014 IEEE AESS. He has received several international Technical Committee Recognition Award in 2003 for making contribution in the field of “Personal, Wireless and Mobile Systems and Networks”, Telenor’s Research Award in 2005 for impressive merits, both academic and organizational, Outstanding Organizational Leadership Award for: “Organizational Leadership in developing and globalizing the CTIF (Center for TeleInFrastruktur) Research Network”, and so on. He has been the Project Coordinator of several EC projects namely, MAGNET, MAGNET Beyond, eWALL. He has published more than 50 books, 1000 plus journal and conference publications, more than 15 patents, over 140 Ph.D. Graduates and a larger number of Masters (over 250). Several of his students are today worldwide telecommunication leaders themselves.

References

A. Hovav and J. D’Arcy, “The impact of denial-of-service attack announcements on the market value of firms,” Risk Manag. Insur. Rev., vol. 6, no. 2, pp. 97–121, 2003.

H. Cavusoglu, B. Mishra, and S. Raghunathan, “The effect of internet security breach announcements on market value: Capital market reactions for breached firms and internet security developers,” Int. J. Electron. Commer., vol. 9, no. 1, pp. 70–104, 2004.

M. Ko and C. Dorantes, “The impact of information security breaches on the financial performance of the breached firms: an empirical investigation,” J. Inf. Technol. Manag., vol. 17, no. 2, pp. 13–22, 2006.

S. Tweneboah-Koduah, F. Atsu, and W. Buchanan, “Impact of Cyberattacks on Stock Performance: A Comparative Study,” Inf. Comput. Secur., no. 5, Oct. 2018.

W. F. Sharpe, “Capital asset prices: A theory of market equilibrium under conditions of risk,” J. Finance, vol. 19, no. 3, pp. 425–442, 1964.

J. Lintner, “The aggregation of investor’s diverse judgments and preferences in purely competitive security markets,” J. Financ. Quant. Anal., vol. 4, no. 4, pp. 347–400, 1969.

J. Y. Campbell and L. M. Viceira, “The term structure of the risk–return trade-off,” Financ. Anal. J., vol. 61, no. 1, pp. 34–44, 2005.

E. Balaban and C. T. Constantinou, “Volatility clustering and event-induced volatility: Evidence from UK mergers and acquisitions,” Eur. J. Finance, vol. 12, no. 5, pp. 449–453, 2006.

R. Schimmer, K. K. Geschuhn, and A. Vogler, “Disrupting the subscription journals’ business model for the necessary large-scale transformation to open access,” 2015.

M. Cruz, R. Coleman, and G. Salkin, “Modeling and measuring operational risk,” J. Risk, vol. 1, no. 1, pp. 63–72, 1998.

F. S. Khan, J. H. Kim, R. L. Moore, and L. Mathiassen, “Data Breach Risks and Resolutions: A Literature Synthesis,” 2019.

D. Hopkins and L. Mooney, “Caring about the notifiable data breach: The human impact on victims,” Gov. Dir., vol. 71, no. 8, p. 433, 2019.

X. Chen, G. Hilary, and X. S. Tian, “Data Breach Disclosure and Insider Trading,” 2019.

H. Copes, K. R. Kerley, R. Huff, and J. Kane, “Differentiating identity theft: An exploratory study of victims using a national victimization survey,” J. Crim. Justice, vol. 38, no. 5, pp. 1045–1052, 2010.

A. Acquisti, A. Friedman, and R. Telang, “Is there a cost to privacy breaches? An event study,” ICIS 2006 Proc., p. 94, 2006.

“Cost of a Data Breach Study | IBM.” [Online]. Available: https://www.ibm.com/security/data-breach?cm_mc_uid=32364261289715675090710&cm_mc_sid_50200000=90151091567509071047&cm_mc_sid_52640000=29709811567509071049. [Accessed: 03-Sep-2019].

J. R. Veltsos, “An analysis of data breach notifications as negative news,” Bus. Commun. Q., vol. 75, no. 2, pp. 192–207, 2012.

P. A. Argenti, “How technology has influenced the field of corporate communication,” J. Bus. Tech. Commun., vol. 20, no. 3, pp. 357–370, 2006.

S. Romanosky, R. Telang, and A. Acquisti, “Do data breach disclosure laws reduce identity theft?,” J. Policy Anal. Manage., vol. 30, no. 2, pp. 256–286, 2011.

S. Romanosky, R. Telang, and A. Acquisti, “Do data breach disclosure laws reduce identity theft?,” J. Policy Anal. Manage., vol. 30, no. 2, pp. 256–286, 2011.

G. W. Schwert, “Stock volatility in the new millennium: how wacky is Nasdaq?,” J. Monet. Econ., vol. 49, no. 1, pp. 3–26, 2002.

K. M. Gatzlaff and K. A. McCullough, “The effect of data breaches on shareholder wealth,” Risk Manag. Insur. Rev., vol. 13, no. 1, pp. 61–83, 2010.

E. A. Morse, V. Raval, and J. R. Wingender Jr, “Market price effects of data security breaches,” Inf. Secur. J. Glob. Perspect., vol. 20, no. 6, pp. 263–273, 2011.

T. G. Andersen, T. Bollerslev, F. X. Diebold, and H. Ebens, “The distribution of realized stock return volatility,” J. Financ. Econ., vol. 61, no. 1, pp. 43–76, 2001.

B. J. Bushee and C. F. Noe, “Corporate disclosure practices, institutional investors, and stock return volatility,” J. Account. Res., pp. 171–202, 2000.

F. Zhang, “High-frequency trading, stock volatility, and price discovery,” 2010.

R. C. Merton, “On estimating the expected return on the market: An exploratory investigation,” J. Financ. Econ., vol. 8, no. 4, pp. 323–361, 1980.

S. Baiman and R. E. Verrecchia, “Earnings and price-based compensation contracts in the presence of discretionary trading and incomplete contracting,” J. Account. Econ., vol. 20, no. 1, pp. 93–121, 1995.

J. Francis, D. Philbrick, and K. Schipper, “Shareholder litigation and corporate disclosures,” J. Account. Res., pp. 137–164, 1994.

N. Nonejad, “Forecasting aggregate stock market volatility using financial and macroeconomic predictors: Which models forecast best, when and why?,” J. Empir. Finance, vol. 42, pp. 131–154, 2017.

V. Corradi, W. Distaso, and A. Mele, “Macroeconomic determinants of stock volatility and volatility premiums,” J. Monet. Econ., vol. 60, no. 2, pp. 203–220, 2013.

A. C. MacKinlay, “Event studies in economics and finance,” J. Econ. Lit., vol. 35, no. 1, pp. 13–39, 1997.

A. Garg, J. Curtis, and H. Halper, “Quantifying the financial impact of IT security breaches,” Inf. Manag. Comput. Secur., vol. 11, no. 2, pp. 74–83, 2003.

C. Martin, A. Kadry, and G. Abu-Shady, “Quantifying the financial impact of it security breaches on business processes,” in Privacy, Security and Trust (PST), 2014 Twelfth Annual International Conference on, 2014, pp. 149–155.

R. Telang and S. Wattal, “An empirical analysis of the impact of software vulnerability announcements on firm stock price,” IEEE Trans. Softw. Eng., vol. 33, no. 8, pp. 544–557, 2007.

A. A. Yayla and Q. Hu, “The impact of information security events on the stock value of firms: The effect of contingency factors,” J. Inf. Technol., vol. 26, no. 1, pp. 60–77, 2011.

K. Kannan, J. Rees, and S. Sridhar, “Market reactions to information security breach announcements: An empirical analysis,” Int. J. Electron. Commer., vol. 12, no. 1, pp. 69–91, 2007.

N. Gupta, “Partial privatization and firm performance,” J. Finance, vol. 60, no. 2, pp. 987–1015, 2005.

S. D. Friedman and H. Singh, “CEO succession and stockholder reaction: The influence of organizational context and event content,” Acad. Manage. J., vol. 32, no. 4, pp. 718–744, 1989.

A. Pajuste, “Corporate governance and stock market performance in Central and Eastern Europe: A study of nine countries, 1994-2001,” Available SSRN 310419, 2002.

M. Ko and C. Dorantes, “The impact of information security breaches on financial performance of the breached firms: an empirical investigation,” J. Inf. Technol. Manag., vol. 17, no. 2, pp. 13–22, 2006.

B. L. Dos Santos, K. Peffers, and D. C. Mauer, “The impact of information technology investment announcements on the market value of the firm,” Inf. Syst. Res., vol. 4, no. 1, pp. 1–23, 1993.

K. S. Im, K. E. Dow, and V. Grover, “A reexamination of IT investment and the market value of the firm—An event study methodology,” Inf. Syst. Res., vol. 12, no. 1, pp. 103–117, 2001.

A. Hovav and J. D’Arcy, “The impact of denial-of-service attack announcements on the market value of firms,” Risk Manag. Insur. Rev., vol. 6, no. 2, pp. 97–121, 2003.

T. Bollerslev, “Generalized autoregressive conditional heteroskedasticity,” J. Econom., vol. 31, no. 3, pp. 307–327, 1986.

S. J. Brown and J. B. Warner, “Measuring security price performance,” J. Financ. Econ., vol. 8, no. 3, pp. 205–258, 1980.

R. Savickas, “Event-induced volatility and tests for abnormal performance,” J. Financ. Res., vol. 26, no. 2, pp. 165–178, 2003.

S. Armitage, “Event study methods and evidence on their performance,” J. Econ. Surv., vol. 9, no. 1, pp. 25–52, 1995.

D. Krivin, R. Patton, E. Rose, and D. Tabak, “Determination of the appropriate event window length in individual stock event studies,” Available SSRN 466161, 2003.

Downloads

Published

2020-04-27

How to Cite

1.
Tweneboah-Koduah S, Atsu F, Prasad R. Reaction of Stock Volatility to Data Breach: an Event Study . JCSANDM [Internet]. 2020 Apr. 27 [cited 2024 May 7];9(3):355-84. Available from: https://journals.riverpublishers.com/index.php/JCSANDM/article/view/1169

Issue

2020: Vol 9 Iss 3

Section

Articles

Most read articles by the same author(s)