The financial impact of cyberattacks: Comparative study of the manufacturing and service industry

This paper utilises event study methodology to better understand the economic implications from disruptions to critical supply chain infrastructure resulting from targeted cyberattacks. More specifically, the paper examines in depth the financial impact on an organisation’s stock market value stemming from cyber security breach incidents to organisational assets. While supply chain attacks have the potential to disrupt critical supply networks, compromise product integrity and negatively affect critical infrastructure, these attacks continue to occur with increasing frequency. One main reason is a lack of accountability to organisations tasked with implementing embedded cyber security controls to thwart attacks. Financial analysis was conducted on supply chain security breach events and attacks during a five-year period, January 2017–December 2023, using event study analysis. As this research investigation extends previous work, this paper focuses specifically on comparing new security breach events from the two most targeted Standard Industrial Classification (SIC) divisions as identified by Security Exchange Commission (SEC) classification — Division I (Services) and Division D (Manufacturing). Once identified, the collected previously not studied data was then compared to assess the individual organisational economic impact relative to the overall sample identified. Results indicating the realised economic impact on corporations are presented using both parametric and non-parametric statistical testing and showcase in numerical values the financial results of the security breach. Results from this study contribute to the extant body of literature across multiple disciplines, including cyber security, supply chain, critical infrastructure and event study methodology. The updated research investigation assesses the financial impact from data and cyber security breach events on additional industries not examined in previous research. This new resultant data yields not only contributes to advancing our understanding of the financial impact from security breach events, but better provides more information about why companies in specific industries and domains are, or are not, investing in cyber security defensive strategies.