Disentangling the market reaction to corporate data breach events: a configurational approach

Purpose Due to the frequent occurrence of data breaches, managing the cost of these events has become one of the biggest challenges confronting modern businesses. Firms urgently require strong security and effective event response strategies to tackle data breaches. Design/methodology/approach This study first quantified the cost of 196 data breach events between 2016 and 2019 using the event study method and then utilized the crisp-set qualitative comparative analysis (csQCA) method to investigate the influencing mechanisms of the data breach cost from the configured perspectives of firm, event and response strategy. Findings The results of the event study revealed significant differences in the cost of data breaches and their influencing factors between traditional and Internet-based firms. While Internet-based firms tended to experience a negative market reaction following a data breach, traditional firms did not show the same pattern. Based on the configuration analysis, six different strategies for cost control were identified, including mitigation and apology strategies for internet-based firms and indifference, fact-statement, silence-keeping and reputation-building strategies for traditional firms. Originality/value The findings of this study can provide deeper insights into the market reaction to data breach events as well as their influencing mechanisms. Furthermore, this study offers practical suggestions for corporations to manage and control the strikes of data breach incidents.