Security breaches and modifications on cybersecurity disclosures

Abstract

Research Question: How do firms approach their cybersecurity disclosure obligations, especially for those who experienced a cyber-attack? Prior research has found that year-after-year modification on textual disclosures adds more appreciable information that makes it more relevant. But do firms provide meaningful disclosures to promote market transparency? Motivation: Because of growing cybersecurity threats in recent years, the U.S. Securities and Exchange Commission (SEC) has issued several regulations and guidance that emphasized on the disclosure of material information on cybersecurity. Given that the mandatory risk factor disclosures in SEC Form 10-K is the first place firms are encouraged to disclose cybersecurity-related assessment, it is important to examine how firms approach their disclosure expectations. Idea: To examine whether firms respond to cyber-attacks with meaningful disclosures, we use the Vector Space Model (VSM) to calculate disclosure modifications before and after major cyber-attack incident. Data: We extracted cybersecurity breach incidents from the Data Breach Database, a centralized and global database of data breaches maintained by a leading security company. In addition, we use the SEC data depository to find firms’ 10-K disclosures. Findings: We find that firms modify their cybersecurity disclosures by increasing the quantity of disclosures, but not necessarily the quality of disclosures as measured by document similarity. Furthermore, we find partial evidence that the degree of modification is positively associated with the severity of cyber-attacks. Contribution: Our evidence suggests that firms tend to use boilerplate language to disclose cybersecurity-related issues. This finding is consistent with prior research. That is, consistent with prior literature, the information content in public company 10-Ks is limited. We find that this seems to be the case as well when it comes to cybersecurity disclosures.