Purpose The purpose of this paper is to determine the effects of data breach announcements on a firm’s valuation, as well as to identify which firm-specific actions contained in the breach announcement may ameliorate negative abnormal returns (ARs). External factors affecting investor behavior including market volatility, attack vector and preannouncement data leakage were also evaluated. Design/methodology/approach An event study was used to identify ARs associated with the breach announcement, followed by a regression analysis, including additional variables surrounding the firm’s breach response as well as external factors including attack vector and market volatility. Findings Negative ARs were identified in two short-term event windows, with preannouncement data leakage noted in the (−3,3) event window. Regression analysis found that periods of high market volatility caused ARs to be more negative, and that firm-specific post-breach activities did not mitigate negative ARs. While not hypothesized, more contemporary breach announcements were associated with less negative ARs and phishing-based attacks were viewed less negatively by investors. Practical implications Provides firms with additional understanding of how firm-specific and external factors surrounding a breach announcement impact firm valuation. Contributes to the existing body of scholarly knowledge by forming the basis for future research on correlations between breach type, investor sentiment and post-breach ARs. Originality/value This research focused on data breaches where nonpublic personal information was compromised, applied four AR models across four short and moderate-term event windows, and most notably focused on the impact of both firm-specific and external factors on ARs.
Viancourt et al. (2025) studied this question.