Narrative resilience: abnormal disclosure tone after cyberattacks

Purpose This study aims to examine the impact of data breach incidents on the tone of corporate disclosures among US publicly listed firms. As digital infrastructure becomes increasingly vital for businesses, cybersecurity breaches present significant risks not only financially but also in shaping corporate narratives. Design/methodology/approach The authors collect data breaches of US-listed firms from the Privacy Rights Clearinghouse database for the period 2005–2023. After combining with our financial and textual data sets, the final sample comprises 17,816 firm-year observations. This study use two complementary approaches to estimate abnormal disclosure tone; a dictionary-based method and a machine learning–based method (FinBERT). Findings Results show that in the aftermath of a breach, companies tend to adopt abnormal tone in their disclosures, likely to reassure investors, uphold credibility or mitigate reputational damage. The effect is more pronounced among firms that incur substantial financial losses, face a higher likelihood of cyberattacks and possess elevated visibility. Drawing on impression management theory, it appears that companies may engage in opportunistic behavior regarding their disclosure tone, projecting signals of robust future growth to influence investor perceptions. Originality/value By documenting systematic shifts toward abnormal tone following data breaches, and by measuring these shifts using both dictionary-based and machine-learning approaches, this study offers novel evidence on how firms strategically manage narrative sentiment in response to cybersecurity crises. In doing so, it complements and extends prior work on cybersecurity disclosure informativeness by revealing a previously underexplored linguistic mechanism through which firms may influence stakeholder perceptions after adverse events.