Data breach notification laws and the cost of private debt

Abstract

We examine the effect of state-level data breach disclosure mandates (DBN laws) on the cost of private debt. Using the staggered passage of DBN laws across the U.S. states, we document an increase in the cost of private debt for firms affected by these laws. These findings suggest that DBN laws increase lenders’ anticipation of cash flow risk from potential future costs related to data breach disclosures. We further document that the increase in the cost of private debt is more pronounced for firms that (i) belong to industries that are susceptible to data breaches, (ii) report internal control weaknesses, or (iii) disclose cyber security risks in their risk factor disclosures. Additionally, we find that the increase in the cost of private debt is less pronounced in firms that focus on cyber security measures, such as investing in cyber security or appointing a technology officer on their board. We contribute to the debt contracting and disclosure literature by focusing on the proactive response of private lenders after the passage of DBN laws to mitigate ex-ante the risk resulting from potential future data breach disclosures while also shedding light on the cost (financing cost) associated with mandatory disclosure practices.