IDEAS home Printed from https://ideas.repec.org/a/eee/ijoais/v55y2024ics1467089524000472.html
   My bibliography  Save this article

Understanding cybersecurity breach contagion effects: The role of the loss heuristic and internal controls

Author

Listed:
  • Seaton Kelton, Andrea
  • Yang, Ya-Wen

Abstract

In this study, we seek to provide insights into the conflicting findings from prior research about whether the consequences of a cybersecurity breach spillover to non-breached bystander firms in the same industry − a phenomenon known as contagion effects. When considering the implications of a breach for a bystander firm, we suggest investors will rely on the loss heuristic and thus view loss (profit) bystander firms as more (less) likely to suffer a similar breach in the future. This will lead to greater cybersecurity breach contagion effects for loss firms than for profit firms. Furthermore, we propose that internal control quality will mitigate contagion effects and to a greater extent for loss firms than for profit firms. To test our hypotheses, we use a sample of cybersecurity breaches and identify a sample of non-breached bystander firms in the same subindustry as the breached firms. Our findings support our predictions and help explain the mixed findings from research on cybersecurity breach contagion effects. Results should also be informative to boards of directors and firm management considering ways to minimize costs associated with contagion effects.

Suggested Citation

  • Seaton Kelton, Andrea & Yang, Ya-Wen, 2024. "Understanding cybersecurity breach contagion effects: The role of the loss heuristic and internal controls," International Journal of Accounting Information Systems, Elsevier, vol. 55(C).
    • Handle: RePEc:eee:ijoais:v:55:y:2024:i:c:s1467089524000472
    DOI: 10.1016/j.accinf.2024.100714
    as

    Download full text from publisher

    File URL: http://www.sciencedirect.com/science/article/pii/S1467089524000472
    Download Restriction: Full text for ScienceDirect subscribers only
    File URL: https://libkey.io/10.1016/j.accinf.2024.100714?utm_source=ideas
    LibKey link: if access is restricted and if your library uses this service, LibKey will redirect you to where you can use your library subscription to access this item
    ---><---

    As the access to this document is restricted, you may want to search for a different version of it.

    References listed on IDEAS

    as
    1. Jeff L. McMullin & Brian P. Miller & Brady J. Twedt, 2019. "Increased mandated disclosure frequency and price formation: evidence from the 8-K expansion regulation," Review of Accounting Studies, Springer, vol. 24(1), pages 1-33, March.
    2. Ghosh, Aloke (Al) & Wang, Jun, 2019. "Accounting Losses as a Heuristic for Managerial Failure: Evidence from CEO Turnovers," Journal of Financial and Quantitative Analysis, Cambridge University Press, vol. 54(2), pages 877-906, April.
    3. Hollis Ashbaugh‐Skaife & Daniel W. Collins & William R. Kinney Jr & Ryan Lafond, 2009. "The Effect of SOX Internal Control Deficiencies on Firm Risk and Cost of Equity," Journal of Accounting Research, Wiley Blackwell, vol. 47(1), pages 1-43, March.
    4. Barber, Brad M. & Lyon, John D., 1997. "Detecting long-run abnormal stock returns: The empirical power and specification of test statistics," Journal of Financial Economics, Elsevier, vol. 43(3), pages 341-372, March.
    5. Pinnuck, Matt & Shekhar, Chander, 2013. "The profit versus loss heuristic and firm financing decisions," Accounting, Organizations and Society, Elsevier, vol. 38(6), pages 420-439.
    6. DeAngelo, Harry & DeAngelo, Linda & Skinner, Douglas J, 1992. "Dividends and Losses," Journal of Finance, American Finance Association, vol. 47(5), pages 1837-1863, December.
    7. Noh, Suzie & So, Eric C. & Weber, Joseph P., 2019. "Voluntary and mandatory disclosures: Do managers view them as substitutes?," Journal of Accounting and Economics, Elsevier, vol. 68(1).
    8. Edith Leung & David Veenman, 2018. "Non‐GAAP Earnings Disclosure in Loss Firms," Journal of Accounting Research, Wiley Blackwell, vol. 56(4), pages 1083-1137, September.
    9. repec:dar:wpaper:70422 is not listed on IDEAS
    10. Eli Amir & Shai Levi & Tsafrir Livne, 2018. "Do firms underreport information on cyber-attacks? Evidence from capital markets," Review of Accounting Studies, Springer, vol. 23(3), pages 1177-1206, September.
    11. Kelton, Andrea Seaton & Montague, Norma R., 2018. "The unintended consequences of uncertainty disclosures made by auditors and managers on nonprofessional investor judgments," Accounting, Organizations and Society, Elsevier, vol. 65(C), pages 44-55.
    12. Jens Foerderer & Sebastian W. Schuetz, 2022. "Data Breach Announcements and Stock Market Reactions: A Matter of Timing?," Management Science, INFORMS, vol. 68(10), pages 7298-7322, October.
    13. Hinz, Oliver & Nofer, Michael & Schiereck, D. & Trillig, J., 2015. "The Influence of Data Theft on Share Prices and Systematic Risk of Consumer Electronics Companies," Publications of Darmstadt Technical University, Institute for Business Studies (BWL) 76072, Darmstadt Technical University, Department of Business Administration, Economics and Law, Institute for Business Studies (BWL).
    14. Ritter, Jay R, 1991. "The Long-run Performance of Initial Public Offerings," Journal of Finance, American Finance Association, vol. 46(1), pages 3-27, March.
    15. Jacob Haislip & Jee-Hae Lim & Robert Pinsker, 2021. "The Impact of Executives’ IT Expertise on Reported Data Security Breaches," Information Systems Research, INFORMS, vol. 32(2), pages 318-334, June.
    16. Saim Kashmiri & Cameron Duncan Nicol & Liwu Hsu, 2017. "Birds of a feather: intra-industry spillover of the Target customer data breach and the shielding role of IT, marketing, and CSR," Journal of the Academy of Marketing Science, Springer, vol. 45(2), pages 208-228, March.
    17. Jing Chen & Elaine Henry & Xi Jiang, 2023. "Is Cybersecurity Risk Factor Disclosure Informative? Evidence from Disclosures Following a Data Breach," Journal of Business Ethics, Springer, vol. 187(1), pages 199-224, September.
    Full references (including those not matched with items on IDEAS)

    Most related items

    These are the items that most often cite the same works as this one and are cited by the same works as this one.
    1. Syed Emad Azhar Ali & Fong-Woon Lai & Rohail Hassan & Muhammad Kashif Shad, 2021. "The Long-Run Impact of Information Security Breach Announcements on Investors’ Confidence: The Context of Efficient Market Hypothesis," Sustainability, MDPI, vol. 13(3), pages 1-27, January.
    2. Zhang, Yimei & Smith, Thomas, 2023. "The impact of customer firm data breaches on the audit fees of their suppliers," International Journal of Accounting Information Systems, Elsevier, vol. 50(C).
    3. Kuo-Chung Chang & Yu-Kai Gao & Shih-Cheng Lee, 2020. "The Effect of Data Theft on a Firm’s Short-Term and Long-Term Market Value," Mathematics, MDPI, vol. 8(5), pages 1-21, May.
    4. Kettunen, Jukka & Martikainen, Minna & Voulgaris, Georgios, 2021. "Employment policies in private loss firms: Return to profitability and the role of family CEOs," Journal of Business Research, Elsevier, vol. 135(C), pages 373-390.
    5. Sian Owen & Jo-Ann Suchard, 2013. "The impact of venture capital/private equity investment on the performance of IPOs in Australia," Chapters, in: Mario Levis & Silvio Vismara (ed.), Handbook of Research on IPOs, chapter 19, pages 400-420, Edward Elgar Publishing.
    6. Tsukioka, Yasutomo & Yanagi, Junya & Takada, Teruko, 2018. "Investor sentiment extracted from internet stock message boards and IPO puzzles," International Review of Economics & Finance, Elsevier, vol. 56(C), pages 205-217.
    7. Otchere, Isaac & Chan, Janus, 2003. "Intra-industry effects of bank privatization: A clinical analysis of the privatization of the Commonwealth Bank of Australia," Journal of Banking & Finance, Elsevier, vol. 27(5), pages 949-975, May.
    8. Krishnamurthy, Srinivasan & Spindt, Paul & Subramaniam, Venkat & Woidtke, Tracie, 2005. "Does investor identity matter in equity issues? Evidence from private placements," Journal of Financial Intermediation, Elsevier, vol. 14(2), pages 210-238, April.
    9. David J. Brophy & Paige P. Ouimet & Clemens Sialm, 2004. "PIPE Dreams? The Performance of Companies Issuing Equity Privately," NBER Working Papers 11011, National Bureau of Economic Research, Inc.
    10. Shao‐Chi Chang & Tsai‐Yen Chung & Wen‐Chun Lin, 2010. "Underwriter reputation, earnings management and the long‐run performance of initial public offerings," Accounting and Finance, Accounting and Finance Association of Australia and New Zealand, vol. 50(1), pages 53-78, March.
    11. Brav, Alon & Geczy, Christopher & Gompers, Paul A., 2000. "Is the abnormal return following equity issuances anomalous?," Journal of Financial Economics, Elsevier, vol. 56(2), pages 209-249, May.
    12. Wang, Xiaoming & Cao, Jerry & Liu, Qigui & Tang, Jinghua & Tian, Gary Gang, 2015. "Disproportionate ownership structure and IPO long-run performance of non-SOEs in China," China Economic Review, Elsevier, vol. 32(C), pages 27-42.
    13. da Silva Rosa, Ray & Velayuthen, Gerard & Walter, Terry, 2003. "The sharemarket performance of Australian venture capital-backed and non-venture capital-backed IPOs," Pacific-Basin Finance Journal, Elsevier, vol. 11(2), pages 197-218, April.
    14. Ying Xiao & Chris Yung, 2015. "Extrapolation Errors in IPOs," Financial Management, Financial Management Association International, vol. 44(4), pages 713-751, October.
    15. Michael McShane & Trung Nguyen, 2020. "Time-varying effects of cyberattacks on firm value," The Geneva Papers on Risk and Insurance - Issues and Practice, Palgrave Macmillan;The Geneva Association, vol. 45(4), pages 580-615, October.
    16. Kim, Oksana, 2013. "The global recognition strategy of blue chips of the Russian and Commonwealth of Independent States (CIS) markets," Journal of Contemporary Accounting and Economics, Elsevier, vol. 9(2), pages 151-169.
    17. Eckbo, B. Espen & Norli, Oyvind, 2005. "Liquidity risk, leverage and long-run IPO returns," Journal of Corporate Finance, Elsevier, vol. 11(1-2), pages 1-35, March.
    18. Hatem Mansali & Florence Labégorre, 2010. "Les performances économiques et boursières à long terme des sociétés introduites en bourse:le cas du marché français (1990-2003)," Revue Finance Contrôle Stratégie, revues.org, vol. 13(2), pages 67-106., June.
    19. Carla Vieira & Ana Paula Serra, 2006. "Abnormal Returns in Privatization Public Offerings: The case of Portuguese firms," Notas Económicas, Faculty of Economics, University of Coimbra, issue 23, pages 6-34, June.
    20. Katharine D. Drake & Ellen Engel & Melissa A. Martin, 2023. "Investigating discretion in executive contracting: extracting private information from valuation allowance decisions," Review of Accounting Studies, Springer, vol. 28(2), pages 533-569, June.

    Corrections

    All material on this site has been provided by the respective publishers and authors. You can help correct errors and omissions. When requesting a correction, please mention this item's handle: RePEc:eee:ijoais:v:55:y:2024:i:c:s1467089524000472. See general information about how to correct material in RePEc.

    If you have authored this item and are not yet registered with RePEc, we encourage you to do it here. This allows to link your profile to this item. It also allows you to accept potential citations to this item that we are uncertain about.

    If CitEc recognized a bibliographic reference but did not link an item in RePEc to it, you can help with this form .

    If you know of missing items citing this one, you can help us creating those links by adding the relevant references in the same way as above, for each refering item. If you are a registered author of this item, you may also want to check the "citations" tab in your RePEc Author Service profile, as there may be some citations waiting for confirmation.

    For technical questions regarding this item, or to correct its authors, title, abstract, bibliographic or download information, contact: Catherine Liu (email available below). General contact details of provider: https://www.journals.elsevier.com/international-journal-of-accounting-information-systems/ .

    Please note that corrections may take a couple of weeks to filter through the various RePEc services.

    IDEAS is a RePEc service. RePEc uses bibliographic data supplied by the respective publishers.