HACKED: Understanding the stock market response to cyberattacks

Increasing levels of digitisation make firms more susceptible to cyberattacks and privacy violations. In this paper, we quantify the impact of cybercrime on company stock returns using a large international sample. On the day after the cyber event, stock returns are found to decrease by -0.24%, but the effect reverses in about two weeks. The magnitude of the decrease in the stock market is greatest for companies that have experienced reoccurring events and for breaches deemed to be most severe. We show that the extent of the stock market decline cannot be explained by national institutional and macroeconomic factors , and is related to company-specific characteristics, including size, volatility, credit ranking and asset volatility. The empirical results highlight important policy and regulatory issues , not least the need for cyber risk disclosure requirements . • Corporations exhibit strong negative reactions to cyberattacks • First corporate cyber incidents generate significantly more severe market reactions than repeat offenders • Larger firms face more pronounced stock declines post-cyberattack • Novel cyber events amplify negative market sentiment, causing more pronounced adverse reactions • Repeat offenders develop response strategies that moderate market responses to cyber incidents