Data Breach Announcements and Stock Market Reactions: A Matter of Timing?

Although firms' announcement of data breaches can lead to reputational or operational damages, extant research suggests that stock markets are relatively unresponsive to such announcements. We investigate whether markets' unresponsiveness can be explained by firms strategically timing the announcement to coincide with busy days in the media, thereby reducing attention and, ultimately, attenuating market reactions. We leverage novel data on data breach announcements in the United States between 2008 and 2018 and create a measure of busyness in the trade press-news pressure-based on the Wall Street Journal. To investigate, we conduct two complementary studies. In Study 1, we employ an instrumental variable approach to assess whether announcements coincide with days of predictably high news pressure. We find that this is the case. On days with a one-standard-deviation-higher predictable news pressure, 4.44% more data breaches are announced (or approximately 19.024 data records). Strategic timing is more prevalent for breaches that are severe, that have firm-internal causes, and that leak healthcare data or credentials. In Study 2, we utilize a stock market event study to assess market reactions conditional on news pressure on the announcement day. We find that data breach announcements are associated with negative market reactions, yet these are attenuated by higher news pressure on the announcement day. If news pressure is on its empirical mean (respectively, one standard deviation above), we estimate a median decline in market capitalization of $347 (respectively, $85) million. We conclude that firms' strategic timing might explain inconsistent findings in prior work.