Market reactions to information security breach announcements: An empirical analysis

International Journal of Electronic Commerce

Volumn 12, Issue 1, 2007, Pages 69-91

  Kannan, Karthik ^a,b   Rees, Jackie ^a,b   Sridhar, Sanjay ^c  

^a PURDUE UNIVERSITY   (United States)

^b PURDUE UNIVERSITY   (United States)

^c Merrill Lynch   (United States)

Author keywords

Abnormal return; Event study; Information security; IT management; Policy

Indexed keywords

EID: 35948938098     PISSN: 10864415     EISSN: None     Source Type: Journal    
DOI: 10.2753/JEC1086-4415120103     Document Type: Article

References (27)

1. Applegate, L.M.; Austin, R.D.; and McFarlan, F.W. Creating Business Advantage in the Information Age. New York: McGraw-Hill Irwin, 2001.
2. Barber, B.M., and Lyon, J.D. Detecting long-run abnormal stock returns: The empirical power and specification of test statistics. Journal of Financial Economics, 43, 3 (1997), 341-372.
3. Brown, S.J., and Warner, J.B. Using daily stock returns: The case of event studies. Journal of Financial Economics, 14, 1 (1985), 3-31.
4. California Senate Bill 1386 (http://info.sen.ca.gov/pub/01-02/bill/sen/ sb_1351-1400/sb_1386_bill_20020926_chaptered.html).
5. Campbell, K.; Gordon, L.A.; Loeb, M.P.; and Zhou, L. The economic cost of publicly announced information security breaches: Empirical evidence from the stock market. Journal of Computer Security, 11, 3 (March 2003), 431-448.
6. Cavusoglu, H.; Mishra, B.; and Raghunathan, S. The effect of Internet security breach announcements on market value of breached firms and Internet security developers. International Journal of Electronic Commerce, 9, 1, (2004), 69-104.
7. Chatterjee, D.; Richardson, V.R.; and Zmud, R.W. Examining the shareholder wealth effects of announcements of newly created CIO positions. MIS Quarterly, 25, 1, (2001), 43-70.
8. Cooper, M.J.; Dimitrov, O.; and Rau, P.R. A rose.com by any other name. Journal of Finance, 56, 6 (2001), 2371-2388.
9. Dos Santos, B.L.; Peffers, K.; and Mauer, D.C. The impact of information technology investment announcements on the market value of the firm. Information Systems Research, 4, 1 (1993), 1-23.
10. D'Amico, A.D. What does a computer security breach really cost? Northport, NY: Secure Decisions, a Division of Applied Visions, September 7, 2000.
11. Fama, E., and French, K. The cross-section of expected stock returns. Journal of Finance, 47, 2 (1992), 427-465.
12. Fama, E.; Fisher, L.; Jensen, M.C.; and Roll, R. The adjustment of stock prices to new information. International Economic Review, 10, 1 (1969), 1-21.
13. Greene, W.H. Econometric Analysis, 5th ed. Upper Saddle River, NJ: Prentice Hall, 2002.
14. Hoovers. Hoover's Online - The Business Information Authority (www.hoovers.com).
15. Hovav, A., and D'Arcy, J. The impact of denial-of-service attack announcements on the market value of firms. Risk Management and Insurance Review, 6, 2 (2003), 97-121.
16. Ip, G.; Pulliman, S.; Thurm, S.; and Simon, R. The Internet bubble broke records, rules and bank accounts. Wall Street Journal, July 14, 2000, A8.
17. Karpoff, J.M., and Rankime, G. In search of a signaling effect: The wealth effects of corporate name changes. Journal of Banking and Finance, 18, 6, (1994), 1027-1046.
18. Kothari, S.P., and Warner, J.B. Measuring long-horizon security price performance. Journal of Financial Economics, 43, 3, (1997), 301-339.
19. Lyon, J. D., and Barber, B. M. Improved methods for tests of long-run abnormal stock returns. Journal of Finance, 54, 1, (1999), 165-202.
20. Mercurri, R.T. Analyzing security costs. Communications of the ACM, 46, 6 (2003), 15-18.
21. Mikhail, M.; Walther, B.; and Willis, R. Do security analysts improve their performance with experience? Journal of Accounting Research, 35 (Suppl.) (1997), 131-157.
22. Pfleeger, C.P. Security in Computing. Upper Saddle River, NJ: Prentice Hall, 1989.
23. PriceWaterhouseCoopers. Information Security Breaches Survey 2002: A Technical Report. Prepared by PriceWaterhouseCoopers for the Department of Trade and Industry, 2002.
24. Rees, J., and Allen, J.P. The state of risk assessment practices in information security: An exploratory investigation. Working Paper, Purdue University, 2007.
25. Research Triangle Institute. The economic impacts of inadequate infrastructure for software testing: Final report. National Institute of Standards and Technology, Gaithersburg, MD, 2002 (www.rti.org/pubs/ software-testing.pdf).
26. Small and Mid-Cap Funds (www.aigvalic.com/valic2003/aigvalic.nsf/ contents/edu_type-smallmid#l).
27. Subramani, M., and Walden, E. The impact of e-commerce announcements on the market value of firms. Information Systems Research, 12, 2 (2001), 135-154.