Understanding cybersecurity breach contagion effects: The role of the loss heuristic and internal controls

In this study, we seek to provide insights into the conflicting findings from prior research about whether the consequences of a cybersecurity breach spillover to non-breached bystander firms in the same industry − a phenomenon known as contagion effects. When considering the implications of a breach for a bystander firm, we suggest investors will rely on the loss heuristic and thus view loss (profit) bystander firms as more (less) likely to suffer a similar breach in the future. This will lead to greater cybersecurity breach contagion effects for loss firms than for profit firms. Furthermore, we propose that internal control quality will mitigate contagion effects and to a greater extent for loss firms than for profit firms. To test our hypotheses, we use a sample of cybersecurity breaches and identify a sample of non-breached bystander firms in the same subindustry as the breached firms. Our findings support our predictions and help explain the mixed findings from research on cybersecurity breach contagion effects. Results should also be informative to boards of directors and firm management considering ways to minimize costs associated with contagion effects.