The Influence of Data Breach Disclosures on R&D: Firm Strategies at Play

Abstract R&D expenditure is crucial for firms to drive innovation, preserve competitive advantage, and guarantee long-term growth. Nevertheless, such long-term investments are susceptible to interruptions from unforeseen circumstances like mandatory disclosure of data breaches. The U.S. Government mandates all firms to publicly disclose data breach incidents, which invariably erodes stakeholder trust in a company’s governance and security procedures. For the purpose of achieving immediate stability and damage management, firms tend to frequently reallocate resources away from long-term expenditures, including R&D. Based on the signalling theory and the resource-based view, we investigate the impact on firms’ R&D expenditure after the mandatory disclosure of data breach incidents and identify firm-related characteristics that can affect the relationship between the post-breach disclosure phase and R&D investment. We use a unique dataset from the Audit Analytics Cybersecurity database, combined with Compustat from 2004 to 2024 for U.S. publicly traded firms, to empirically test our hypotheses. Our findings contribute to a deeper understanding of how firms navigate the tension between short-term crisis management and long-term innovation strategies in the aftermath of a data breach.