Slashdot Mirror
Security Breaches Don't Affect Stock Price, Study Suggests (schneier.com)
Computer security professional Bruce Schneier highlights the key findings of a study that suggests security breaches don't affect stock price. The study has been published in the Journal of Information Privacy and Security. From the report: -While the difference in stock price between the sampled breached companies and their peers was negative (1.13%) in the first 3 days following announcement of a breach, by the 14th day the return difference had rebounded to + 0.05%, and on average remained positive through the period assessed.
-For the differences in the breached companies' betas and the beta of their peer sets, the differences in the means of 8 months pre-breach versus post-breach was not meaningful at 90, 180, and 360 day post-breach periods.
-For the differences in the breached companies' beta correlations against the peer indices pre- and post-breach, the difference in the means of the rolling 60 day correlation 8 months pre- breach versus post-breach was not meaningful at 90, 180, and 360 day post-breach periods.
-In regression analysis, use of the number of accessed records, date, data sensitivity, and malicious versus accidental leak as variables failed to yield an R2 greater than 16.15% for response variables of 3, 14, 60, and 90 day return differential, excess beta differential, and rolling beta correlation differential, indicating that the financial impact on breached companies was highly idiosyncratic.
-Based on returns, the most impacted industries at the 3 day post-breach date were U.S. Financial Services, Transportation, and Global Telecom. At the 90 day post-breach date, the three most impacted industries were U.S. Financial Services, U.S. Healthcare, and Global Telecom.
-For the differences in the breached companies' betas and the beta of their peer sets, the differences in the means of 8 months pre-breach versus post-breach was not meaningful at 90, 180, and 360 day post-breach periods.
-For the differences in the breached companies' beta correlations against the peer indices pre- and post-breach, the difference in the means of the rolling 60 day correlation 8 months pre- breach versus post-breach was not meaningful at 90, 180, and 360 day post-breach periods.
-In regression analysis, use of the number of accessed records, date, data sensitivity, and malicious versus accidental leak as variables failed to yield an R2 greater than 16.15% for response variables of 3, 14, 60, and 90 day return differential, excess beta differential, and rolling beta correlation differential, indicating that the financial impact on breached companies was highly idiosyncratic.
-Based on returns, the most impacted industries at the 3 day post-breach date were U.S. Financial Services, Transportation, and Global Telecom. At the 90 day post-breach date, the three most impacted industries were U.S. Financial Services, U.S. Healthcare, and Global Telecom.
Imprecise name is why. It's a fucking looting.
There's no serious penalties in the US for allowing them, so why would the stock price change?
People are used to getting bent over and buttfucked by private businesses and public offices alike. It's hard to get worked up about somebody not being careful with your data and being the victim of a criminal stealing it. We're used to going to the DMV for chrissakes. Companies that get breached are way better.
That means executives responsible for IT budget aren't financially impacted by their security budgeting decisions. One could make their bonuses affected by security breaches, but then that might just lead to cover-ups of breaches rather than disclosure, particularly if the disclosure laws don't pierce the corporate veil.
I'd like to see how effect on stock price correlates to effect on profitability, particularly years down the road when the associated breach lawsuits play out.
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
What did the PRISM (surveillance program) https://en.wikipedia.org/wiki/... result in?
The buddy system to ensure contractors stayed loyal and domestic collect it all kept working?
The brands that failed to understand who was in their own internal networks?
Who else followed the security services into the big brand networks?
Did other random nations, groups get the encryption keys like the gov did? Plain text for everyone.
Domestic spying is now "Benign Information Gathering"
this study is already obsolete, it doesn't take GDPR into account, which will increase the level of fun and popcorn eating
Should we be surprised since profitability doesn't seem to affect stock prices either. A billion dollar company with almost no resources that doesn't make any money is absurd but people buy.
All the people who control the majority of the wealth have it all safely tucked away in offshore accounts that nobody is going to hack into (if not for reasons of technical insufficiency, then for reasons of knowing damned well they'll be found dead within 24 hours if they even try), and they don't give a damn about all of us peasants, the government, or anything else, so of course why should they care?
Please explain why it should?
There's zero consequences for these corporations and they operate as business as usual even after the most egregious data breaches. What's more, users don't seem to care one bit, in the slightest.
To me, that would not seem to be something that affects a stock price, but what do I know?
"We do find that, overall, all securities class action filings have a negative impact at the filing date, and there is a statistically significant decline in value before filing occurs." https://digitalcommons.law.msu.edu/cgi/viewcontent.cgi?article=1002&context=jbsl
Since markets are efficient, companies should stop worrying and forget about keeping secrets. Post everyone's information. The stock market mandates it!
- the timeframe studied is too short, there is not enough data available to draw his conclusions
- the study is done during the biggest bull market ever
- i wouldn't trust a computer security researcher with my money
I think they do influence the price but only make the price higher (look at the initial reaction on AMD stock) in this ridiculous melt-up we are witnessing #BTFD
It is because institutional investors don't trade frequently and they don't trade on news.
Retail investors holding loose stocks trade on news but they don't represent a large portion of shareholders of large cap stocks.
There is too much "news" to pay attention to every detail, so people tend to focus on the news that might be of interest to them. So, a technical weakness that was exploited doesn't really make it into the financial news of people that own the stock. Or if it does, the information is so watered down that there is no sense of the impending impact of the breach.
Really, only those of us that pay attention to computer security news are the ones that know about the breaches and the severity of them. How many of us own enough stock that when we move it, the price gets affected? Probably none of us. Try a poll with your neighbors and non-work friends and ask if they have heard of the latest breach. My findings is none of them, not even non-security software engineers have heard of the problem.
If security was valued, which it is obviously is not, then breaches would have an impact on stock price.
You can lose something that is loose, so tighten the loose item so you don't lose it.