Underlying and consequential costs of cyber security breaches: Changes in systematic risk

Severe security breaches can be costly for publicly listed firms. In order to deploy scarce resources in the most efficient way, decision makers in such firms need to be aware of all cost types associated with security breaches. In addition to obvious direct costs following the discovery of, response to, and mitigation of security breaches, there are also multiple underlying and consequential costs introduced or elevated by security breaches. One cost factor that is prone to be overlooked is systematic risk in the form of cost of equity. We present the results of an analysis of security breach-induced changes in regular, downside, and upside betas that contribute to increases in cost of equity. Analysing a US-centric sample of 202 severe security breaches between 2005 and 2019, we find that severe security breaches are associated with significantly positive increases of systematic risk and systematic downside risk in terms of regular and downside beta, respectively. Given the absence of similar effects for systematic upside risk in terms of upside beta, the analysis also reveals the unsymmetrical nature of the effect of security breaches on systematic risk. The implications of these findings and their relevance for firms’ costs of capital are discussed