[BreachExchange] Do Data Breaches Affect Company Value?

[Audrey McNeil]

https://www.rsaconference.com/blogs/do-data-breaches-affect-company-value


With malware growing more prevalent, possibly nearing 600 million samples
in 2016, the average cost of a data breach has been estimated to reach $4
million. Gartner, which had estimated worldwide spending on information
security reaching $75.4 billion in 2015, sees a 26 percent probability that
a company will experience one or more data breaches within a 24-hour period.

While fixing a data breach has quantifiable costs that translate into
increased security budgets and investing more in security technologies and
personnel, a company’s value is rarely evaluated after such incidents.
Studies often focus on how much a breach will cost the company, but few
actually look at how much they impact the company’s value.

The Target Data Breach

In late 2013, Target was the victim of a massive data breach, estimated to
have involved the loss of the personal information of almost 70 million
individuals. Names, mailing addresses, phone numbers and email addresses
were stolen, exposing customers to potential fraud.

Estimates of how much the data breach would cost the company reached $252
million. While the litigation fallout of that breach was not felt
immediately, the company's stock market rating wasn’t affected for long.

Looking at Target’s stock prices, starting on November 19th 2013—the day
the news hit the media—there’s an obvious drop in share value, but nothing
they couldn’t recover from after a couple of months. Actually, stocks
actually started picking up again in March 2014.

 The Anthem Data Breach

One of the largest data breaches, that occurred in early February 2015,
involved Anthem. A potential 37.5 million records containing personally
identifiable information were stolen. However, that number quickly
escalated to 78.8 million.

Looking at the stock market performance for Anthem, Inc., starting with
February 4th—the day the breach was announced—does show a slight drop in
share price, but it only lasted a couple of days. A sharp uptick actually
followed in the months to come, with no serious drop until late 2015.

Data Breach on Vtech Holdings

On November 14th 2015, Vtech Holdings, a “leading supplier of corded and
cordless phones and electronic learning toys,” suffered a data breach that
lead to accounts of 4.9 million parents potentially being accessed by
cybercriminals, while profiles of 6.4 million children were also affected.
While the financial impact of the data breach was not estimated, their
stocks did plunge for a while.

They were actually already in a dive, but the data breach might have also
helped to sustain the decline in the following months. The interesting fact
is that, by late March, the stock price was slightly higher than before the
breach, while continuing on the same descending trend.

The Adobe Data Breach

A data breach at Adobe ended up with 38 million customer accounts being
accessed, exposing customers’ personal information—names, encrypted debit
and credit card numbers, expiration dates and other sensitive data.
Following the avalanche of lawsuits, Adobe agreed to pay $1.1 million in
attorneys' fees and expenses and an undisclosed sum to affected users.

However, stock prices for Adobe Systems Incorporated didn’t flinch in the
slightest. While they’ve fluctuated from time to time, the ascending curve
was sustained all the way through 2016, even after trials were settled and
customers were compensated. Looking for Answers

Simply by looking at the stock market value for each company affected by a
data breach seems to indicate that the correlation between security
incidents and drop in share prices is marginal at best. One possible
explanation for this could lie with insurance companies and policies that
cover such incidents.

With 59 percent of companies purchasing some type of security insurance,
it’s plausible that this plugs any negative effect data breaches might have
on a company’s value. However, this might not be the case forever, as
insurance companies might not be so inclined to back companies that
experience constant security breaches.

Regardless of what measures a company takes to secure its stock market
value, it may ultimately take a serious dive if security gaps are not
quickly remedied and data breaches occur on a regular bases.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20160811/f29b00c4/attachment.html>