From breach to recovery: a survival analysis of stock market responses to data breaches

Purpose Data breaches represent a growing threat to firms’ financial performance and investor confidence. This study aims to examine short- and long-term stock market reactions to data breach announcements using a comprehensive sample of 3,316 incidents involving publicly traded US firms between 2006 and 2024. Design/methodology/approach Using event study methodology and survival analysis, the authors document significant negative abnormal returns of −0.26% over a five-day window around the data breach announcement date, which dissipate within a month. Findings Industry-level heterogeneity is pronounced: health care, retail and telecommunications experience sharper and more persistent losses, while durable goods and manufacturing sectors show resilience or even positive responses. Regression results highlight firm size and R&D intensity as important determinants of market resilience. Survival analysis indicates that most firms recover abnormal returns within 7–10 trading days, although breaches involving sensitive financial or health data prolong recovery. Overall, these findings suggest that while markets have become more accustomed to data breach risks, breach type, industry and firm characteristics continue to shape investor responses. Originality/value This paper extends and updates breach–market reaction evidence by integrating event-study estimates with survival analysis to distinguish immediate price impacts from recovery dynamics, revealing strong heterogeneity by information type and sector. It also shows that firm attributes shape short-term abnormal returns and offers methodological guidance to move beyond average cumulative abnormal returns by explicitly modeling time-to-recovery.