Study on the Impact of Data Breaches on Firm Value and Information Security Risk Disclosures

The dissertation explores the financial and managerial impacts of data breaches on healthcare companies in the U.S., a sector increasingly significant given its growing proportion of the GDP and superior performance compared to the S&P 500. The study assesses the financial repercussions of data breaches and investigates the changes in disclosure practices over time. The research is divided into three parts. The first part employs an event study methodology to evaluate the stock price impacts of data breaches, revealing that while such incidents typically result in negative market reactions, these effects have diminished over time. This suggests an evolving investor sensitivity, influenced by historical market events and changes in the regulatory environment such as the implementation of breach notification laws. The second part of the thesis expands on these findings by analyzing the textual content of company disclosures following data breaches. It examines how management's response strategies affect investor reactions. The results indicate that companies can mitigate the losses in firm value typically associated with data breaches by disclosing information security risks in more detail. The third section delves deeper into the impacts of the 2018 SEC guidance on disclosure practices. It uses cosine similarity to assess changes in the textuality of disclosures post-guidance, highlighting a trend towards an industry specific convergence of information security risk disclosures following the guidance from the SEC.