The Economic Impact of Information Security Breaches: Firm Value and Intra-industry Effects

IT managers often struggle to justify investments in information security. In addition to standard quantitative analyses such as Return on Security Investment (ROSI), executive management may also want to know what the effect of potential security breaches would be on the market value of a publicly-traded firm. This study attempts to shed light on the issue by examining the impact of information security breach announcements on shareholder value. This study also examines the effects of such announcements on a portfolio of the firm’s competitors in an effort to examine the contagion and competitive intra-industry effects. We find that the market value of an affected firm’s competitors increases following the announcement of a security breach, consistent with the competitive model of intra-industry effects. The magnitude of the competitive effect appears t