Abstract

Cyber-attacks are a global concern, escalating in frequency. Our study explores whether and how cyber-attacks affect the financial performance of the targeted firms. Unlike previous research, we examine not only attack incidence but also the financial consequences, considering attack and firm characteristics. In addition, our study is the first to explore whether the time frame over which an attack affects a targeted firm varies depending on the type of attack. While the former is reasonably well documented, the latter is not. Market responses are diverse and sometimes delayed, influenced by breach disclosure laws. Our study further examines whether market responses differ when the affected entity is a parent or a subsidiary. Our results suggest that — because each cyber-attack has its own distinct characteristics — an aggregation of instances produces diminished or no results because markets respond within different time frames and in different directions. Our findings disentangle these effects and thus make an important contribution: contrary to the often insignificant findings presented by prior studies, we find that cyber-attacks have, on average, severe financial repercussions for the target firms. Parent firms appear more adept at handling these repercussions and may benefit from their size and diversification, allowing them to mitigate negative stock price effects, while subsidiary firms are hit harder. Finally, we estimate the probability of a cybersecurity incident: we report a convex relationship between a firm’s asset size and its susceptibility to (successful) cyber-attacks and a concave relationship between a firm’s net income and its cybersecurity risk.