Market Reaction to Security Breach Announcements

Abstract

Event studies have been used to assess the financial impact of cyber incidents on firms since the methodology is believed to reflect tangible, intangible and potential gains/losses. While most prior studies examined the impact of security breach announcements on the United States? market reaction, our study examines the South Korean market's reaction to similar events. Investor protection theory suggests that different markets react differently to similar events. Specifically stronger investor protection leads to lower information asymmetry, which in turn results in a more efficient market valuation. Korea's investor protection index is lower than that of the U.S., suggesting higher information asymmetry and less efficient market valuation. Our study found that the Korean market reaction to cyber incidents was relatively slow, supporting the above assertion. In addition, regulated industries experienced significant negative abnormal returns post-2007 when privacy laws were enacted in South Korea. The study also found that Korea?s market reaction to security incident announcements varied over time as the nature of cyber attacks and attackers changed. For example, while the negative market reaction to denial-of-service and corruption of data events were significant pre-2007, the negative reaction to disclosure of private information was significant post-2007.