Edinburgh Napier University

  The study uses cyberattacks announcements on 96 firms that are listed on S&P 500 over the period January 03, 2013 and December 29, 2017.
The empirical analysis was performed in two ways: cross-section and industry level. We employ statistical tests that account for the effects of cross-section correlation in returns, returns series correlation, volatility changes, and skewness in the returns and the results show the following.
These imply that (1) studying the cumulative effects of cyberattacks on prices of listed firms without grouping them into the various sectors may be non-informative, (1) the financial sector firms tend to react cumulatively to cyberattacks over a 3-day period than other sectors, (3) technology firms tend to be less reactive to the announcement of a data breach, possibly such firms may have the necessary tools and techniques to address large-scale cyberattacks.
For cross-section analysis, the outcome shows that the market does not significantly react to cyberattacks for all the event windows except [-30, 30], while for the sector-level analysis, the analysis offers two main results.
First, while there is a firm reaction to cyber-attacks for long event window for retail sector, there is no evidence of a cumulative firm reaction to cyberattacks for both short and long event windows for the industrial, information technology and health sectors. Second, the firms in the financial sector, there is a strong evidence of cumulative reaction to cyberattacks for [-1, 1] for the financial industry, and the reactions disappear for relatively longer event windows.
These imply that (1) studying the cumulative effects of cyberattacks on prices of listed firms without grouping them into the various sectors may be non-informative, (1) the financial sector firms tend to react cumulatively to cyberattacks over a 3-day period than other sectors, (3) technology firms tend to be less reactive to the announcement of a data breach, possibly such firms may have the necessary tools and techniques to address large-scale cyberattacks.
The work provides new insights into the effect of cyber security on stock prices.