What is the Impact of Successful Cyberattacks on Target Firms

Abstract

We examine which firms are targets of successful cyberattacks and how they are affected. We find that cyberattacks are more likely to occur at larger and more visible firms, more highly valued firms, firms with more intangible assets, and firms with less board attention to risk management. These attacks affect firms adversely when consumer financial information is appropriated, but seem to have little impact otherwise. Attacks where consumer financial information is appropriated are associated with a significant negative stock market reaction, an increase in leverage following greater debt issuance, a deterioration in credit ratings, and an increase in cash flow volatility. These attacks also affect sales growth adversely for large firms and firms in retail industries, and there is evidence that they decrease investment in the short run. Affected firms respond to such attacks by cutting the CEO's bonus as a fraction of total compensation, by reducing the risk-taking incentives of management, and by taking actions to strengthen their risk management. The evidence is consistent with cyberattacks increasing boards' assessment of target firm risk exposures and decreasing their risk appetite.