Cybersecurity exposure and stock price crash risk

Heightened cybersecurity threats and opaque risk disclosure practices pose a growing challenge to capital markets, as investors lack timely signals to identify firms exposed to extreme downside risk. This study examines whether analyst disclosure of cybersecurity risk serves as an early warning indicator of future stock price crash risk. Using a comprehensive sample of Chinese A-share listed firms from 2007 to 2023, we construct a firm-level measure of cybersecurity risk based on textual analysis of analyst reports. We find that firms identified by analysts as high cybersecurity risk are significantly more likely to experience subsequent stock price crashes. Mechanism analyses show that this effect operates through reduced stock liquidity, reflected in wider bid-ask spreads, and increased managerial bad-news hoarding, proxied by discretionary accruals. The effect is more pronounced in information-sensitive industries. Addressing endogeneity with a Bartik-style instrumental variable based on the 2017 Cybersecurity Law and firms’ pre-existing digital infrastructure, the results remain robust. Overall, our findings highlight a paradoxical role of analyst disclosure: rather than mitigating information asymmetry, it may exacerbate market fragility by triggering managerial concealment and amplifying tail risk.