Market reactions to information security breach announcements: An empirical analysis

Losses due to information security breaches are notoriously difficult to measure. An event study of the effect of such breaches on financial performance found that they do not earn significantly negative abnormal returns. To verify whether this finding resulted from the aggregation of data across different characteristics (e.g., the nature of the breaches, the types of firms, the time periods of the study) the impact of each characteristic was analyzed. Again the results were not significantly negative. The study found that a negative bias followed the events of September 11, 2001. It also found that there was a difference in investor reactions to events during the dot-com era, when firms earned higher negative abnormal returns, and after the dot-com era. The implications are discussed.