Hacking Corporate Reputations

We exploit unexpected corporate data breaches to study how firms respond to negative reputation events. Data breaches negatively affect firm profitability, value, and reputation for years following the event, but are not triggered by high or low reputations. In response, firms increase their investment in corporate social responsibility (CSR) by 0.4-0.5 standard deviations. Firms respond similarly after other negative shocks to their reputation. Our paper represents the first empirical study to link CSR investment to firm reputation building and is the first to document how firms respond to the destruction of corporate reputations.