Cyber shocks: The financial impact of cyber events

This research examines the impact of exploitive, disruptive, and mixed cyber events by analyzing cyber event data of U.S. publicly traded entities to understand the financial implications of cyber events and enable decision-making for cyber resilience. Based on the primary objective of the malicious actor responsible for the event, three distinct event categories are included in the analysis: the disruption of the operational capabilities of an entity, the appropriation of data from the entity through exploitation, or a mixture of both. A research sample of 295 entities that collectively experienced 405 cyber events between 2014 and 2023 is obtained from the CISSM Cyber Event Database. This study gauges the financial impact of specific events by assessing fluctuations in share prices through event study methodology. The findings suggest that significantly negative share price fluctuations can be observed after the event has taken place. Additionally, for exploitive and mixed events significantly negative share price fluctuations can be observed for both the short- and long-term analyses.