Do Data Breaches Affect Company Value?

Posted on by Liviu Arsene

With malware growing more prevalent, possibly nearing 600 million samples in 2016, the average cost of a data breach has been estimated to reach $4 million. Gartner, which had estimated worldwide spending on information security reaching $75.4 billion in 2015, sees a 26 percent probability that a company will experience one or more data breaches within a 24-hour period.

While fixing a data breach has quantifiable costs that translate into increased security budgets and investing more in security technologies and personnel, a company’s value is rarely evaluated after such incidents. Studies often focus on how much a breach will cost the company, but few actually look at how much they impact the company’s value.

The Target Data Breach

In late 2013, Target was the victim of a massive data breach, estimated to have involved the loss of the personal information of almost 70 million individuals. Names, mailing addresses, phone numbers and email addresses were stolen, exposing customers to potential fraud.

Estimates of how much the data breach would cost the company reached $252 million. While the litigation fallout of that breach was not felt immediately, the company's stock market rating wasn’t affected for long.

Looking at Target’s stock prices, starting on November 19th 2013—the day the news hit the media—there’s an obvious drop in share value, but nothing they couldn’t recover from after a couple of months. Actually, stocks actually started picking up again in March 2014.

 target stock

Source: Source: Yahoo Finance

The Anthem Data Breach

One of the largest data breaches, that occurred in early February 2015, involved Anthem. A potential 37.5 million records containing personally identifiable information were stolen. However, that number quickly escalated to 78.8 million.

Looking at the stock market performance for Anthem, Inc., starting with February 4th—the day the breach was announced—does show a slight drop in share price, but it only lasted a couple of days. A sharp uptick actually followed in the months to come, with no serious drop until late 2015.

Anthem Stocks

Source: Yahoo Finance

Data Breach on Vtech Holdings

On November 14th 2015, Vtech Holdings, a “leading supplier of corded and cordless phones and electronic learning toys,” suffered a data breach that lead to accounts of 4.9 million parents potentially being accessed by cybercriminals, while profiles of 6.4 million children were also affected. While the financial impact of the data breach was not estimated, their stocks did plunge for a while.

Vtech Stocks 

Source: Yahoo Finance

They were actually already in a dive, but the data breach might have also helped to sustain the decline in the following months. The interesting fact is that, by late March, the stock price was slightly higher than before the breach, while continuing on the same descending trend.

The Adobe Data Breach

A data breach at Adobe ended up with 38 million customer accounts being accessed, exposing customers’ personal information—names, encrypted debit and credit card numbers, expiration dates and other sensitive data. Following the avalanche of lawsuits, Adobe agreed to pay $1.1 million in attorneys' fees and expenses and an undisclosed sum to affected users.

Adobe Stocks

Source: Yahoo Finance

However, stock prices for Adobe Systems Incorporated didn’t flinch in the slightest. While they’ve fluctuated from time to time, the ascending curve was sustained all the way through 2016, even after trials were settled and customers were compensated. 

Looking for Answers

Simply by looking at the stock market value for each company affected by a data breach seems to indicate that the correlation between security incidents and drop in share prices is marginal at best. One possible explanation for this could lie with insurance companies and policies that cover such incidents.

With 59 percent of companies purchasing some type of security insurance, it’s plausible that this plugs any negative effect data breaches might have on a company’s value. However, this might not be the case forever, as insurance companies might not be so inclined to back companies that experience constant security breaches.

Regardless of what measures a company takes to secure its stock market value, it may ultimately take a serious dive if security gaps are not quickly remedied and data breaches occur on a regular bases.

Liviu Arsene

Director of Threat Research and Reporting, CrowdStrike

Business Perspectives

Blogs posted to the website are intended for educational purposes only and do not replace independent professional judgment. Statements of fact and opinions expressed are those of the blog author individually and, unless expressly stated to the contrary, are not the opinion or position of RSA Conference™, or any other co-sponsors. RSA Conference does not endorse or approve, and assumes no responsibility for, the content, accuracy or completeness of the information presented in this blog.

Share With Your Community

Related Blogs