Prioritizing Investments in Cybersecurity: Empirical Evidence from an Event Study on the Determinants of Cyberattack Costs

Paper: arXiv 2402.04773

Authors: Daniel Celeny, Loïc Maréchal, Evgueni Rousselot, Alain Mermoud, Mathias Humbert

Abstract

Along with the increasing frequency and severity of cyber incidents, understanding their economic implications is paramount. In this context, listed firms’ reactions to cyber incidents are compelling to study since they (i) are a good proxy to estimate the costs borne by other organizations, (ii) have a critical position in the economy, and (iii) have their financial information publicly available. We extract listed firms’ cyber incident dates and characteristics from newswire headlines. We use an event study over 2012–2022, using a three-day window around events and standard benchmarks. We find that the magnitude of abnormal returns around cyber incidents is on par with previous studies using newswire or alternative data to identify cyber incidents. Conversely, as we adjust the standard errors accounting for event-induced variance and residual cross-correlation, we find that the previously claimed significance of abnormal returns vanishes. Given these results, we run a horse race of specifications, in which we test for the marginal effects of type of cyber incidents, target firm sector, periods, and their interactions. Data breaches are the most detrimental incident type with an average loss of -1.3% or (USD -1.9 billion) over the last decade. The health sector is the most sensitive to cyber incidents, with an average loss of -5.21% (or USD -1.2 billion), and even more so when these are data breaches. Instead, we cannot show any time-varying effect of cyber incidents or a specific effect of the type of news as had previously been advocated.

Complexity vs Empirical Score

• Math Complexity: 3.5/10
• Empirical Rigor: 7.5/10
• Quadrant: Street Traders — practical and empirical, lighter on theory

Why this score: The paper relies on standard statistical event study methodology rather than complex mathematical modeling, but demonstrates strong empirical rigor by correcting for event-induced variance and cross-correlation. It delivers valuable practical insights into the economic impacts of cyberattacks across different sectors and incident types while challenging existing literature findings.

Research Flowchart

  flowchart TD
    A[Goal: Quantify Economic Impact & Costs of Cyberattacks on Listed Firms] --> B[(Data: Headline Text Mining 2012-2022 & Financial Data)]
    B --> C[Method: Event Study with 3-Day Window & Adjusted Standard Errors]
    C --> D[Initial Findings: Standard Abnormal Returns Match Literature]
    C --> E[Horse Race Regressions: Marginal Effects & Interaction Models]
    
    D --> F[Key Outcome 1: Account for Variance/Correlation -> Overall Significance Vanishes]
    E --> G[Key Outcome 2: Data Breaches -1.3% / -$1.9B & Health Sector -5.21% / -$1.2B Most Vulnerable]
    E --> H[Key Outcome 3: No Significant Time-Varying or News-Type Effects]

Cited References (602)

1. The limits of the limits of arbitrage (2010)
2. Uniformly least powerful tests of market efficiency (2000)
3. Returns to buying winners and selling losers: Implications for stock market efficiency (1993)
4. Payout policy in the 21st century (2005)
5. Is the abnormal return following equity issuances anomalous? (2000)
6. Actual share reacquisitions in open-market repurchase programs (1998)
7. Limits to arbitrage and hedging: Evidence from commodity markets (2013)
8. Seasoned public offerings: Resolution of the ’new issues puzzle’ (2000)

1 of 602 cited works are in the corpus; resolved via arXiv source bundles, Semantic Scholar and OpenAlex. Corpus-wide: 2518 linked papers.