Abstract

This thesis explores the financial impact of cyber-attacks on publicly traded companies as determined by equity market investors, and attempts to identify the significant determinants of this impact. A hand collected sample of 313 events is analyzed using an event study methodology. The average (median) cumulative abnormal return when a company experiences a cyber-attack is -0.69% (-0.37%), which translates into an average (median) $134,604,868 ($30,506,757) destruction of firm value. Smaller firms are hit harder than larger firms, and the number of cyber-attacks in a trailing 30-day period is negatively related to average cumulative abnormal returns. Attacks on technology and telecom companies have become less frequent and less damaging, while attacks on Finance and Retail companies have become more frequent. Retail damages have become significantly worse, and Finance companies have experienced some of the most damaging attacks ever revealed. Hacktivism and State Sponsored attacks are relatively inexpensive to firm value over the studied period, as are breaches of proprietary and identity information.