Sound and Fury, Signifying Nothing? Impact of Data Breach Disclosure Laws
Fuente:
arXiv
Saved in:
| Main Authors: | , , |
|---|---|
| Format: | Preprint |
| Published: |
2024
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866911928836685824 |
|---|---|
| author | Hydari, Muhammad Zia Liang, Yangfan Telang, Rahul |
| author_facet | Hydari, Muhammad Zia Liang, Yangfan Telang, Rahul |
| contents | Data breach disclosure (DBD) is presumed to improve firms' cybersecurity practices by inducing fear of subsequent revenue loss. This revenue loss, the theory goes, will occur if customers punish an offending firm by refusing to buy from them and is assumed to be the primary mechanism through which DBD laws will change firm behavior ex ante. However, our analysis of a large-scale data breach at a US retailer reveals no evidence of a decline in revenue. Using a difference-in-difference design on revenue data from 302 stores over a 20-week period around the breach disclosure, we found no evidence of a decline either across all stores or when sub-sampling by prior revenue size (to account for any heterogeneity in prior revenue size). Therefore, we posit that the presumed primary mechanism of DBD laws, and thus these laws may be ineffective and merely a lot of "sound and fury, signifying nothing." |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2406_15215 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | Sound and Fury, Signifying Nothing? Impact of Data Breach Disclosure Laws Hydari, Muhammad Zia Liang, Yangfan Telang, Rahul Cryptography and Security Computers and Society General Economics Economics K.4; K.5; K.6 Data breach disclosure (DBD) is presumed to improve firms' cybersecurity practices by inducing fear of subsequent revenue loss. This revenue loss, the theory goes, will occur if customers punish an offending firm by refusing to buy from them and is assumed to be the primary mechanism through which DBD laws will change firm behavior ex ante. However, our analysis of a large-scale data breach at a US retailer reveals no evidence of a decline in revenue. Using a difference-in-difference design on revenue data from 302 stores over a 20-week period around the breach disclosure, we found no evidence of a decline either across all stores or when sub-sampling by prior revenue size (to account for any heterogeneity in prior revenue size). Therefore, we posit that the presumed primary mechanism of DBD laws, and thus these laws may be ineffective and merely a lot of "sound and fury, signifying nothing." |
| title | Sound and Fury, Signifying Nothing? Impact of Data Breach Disclosure Laws |
| topic | Cryptography and Security Computers and Society General Economics Economics K.4; K.5; K.6 |
| url | https://arxiv.org/abs/2406.15215 |