Data breaches negatively affect a company's ability to do business, public perception of the company and, new research shows, its stock prices. According to a recent study by Comparitech, such cyberattacks can drive a stock's performance down on the day of the announcement, and they can slow future growth of a stock for years. Also the sensitivity of the data leaked—credit card numbers versus email addresses, for instance—directly affects Wall Street's reaction.
For the study, Comparitech, a consumer tech product review and comparison site, examined 24 companies listed on the New York Stock Exchange and other public markets, studying each company's share prices before and after a data breach was publicly announced. The team used the Nasdaq's overall performance as a baseline to compare results. For instance, if the Nasdaq performed poorly overall on a certain day, it could frame a single company's stock drop in a wider context.
The companies studied included Apple Inc., Adobe Systems Inc., eBay Inc., The Home Depot, JPMorgan Chase & Co., LinkedIn Corp., Sony Electronics Inc., Target and Yahoo Inc.
A data breach has more of a lingering effect than an immediate one, the study revealed. On the day a breach is announced, stock prices of the 24 companies fell, on average, about half of a percentage point. But that drop is within the standard deviation for daily volatility, the researchers said in the study, meaning that, such fluctuation is not unusual and can be seen on days without breaches, too.
Long-term growth, however, is a different story.
The 24 companies experienced a stock growth rate of 45.6 percent in the three years before reporting a data breach, the study said, but in the three years after a data breach, that growth rate dropped to 14.6 percent.
Compared to the Nasdaq's overall performance, the numbers get worse. Relative to the Nasdaq, breached companies experience, on average, an immediate, day-of share drop of 2.38 percent, the study said. One year after a data breach, the companies underperformed by an average of 7.33 percent; three years out, 41.6 percent.
The study also found that earlier breaches had heavier immediate impacts on company share prices. Breaches in 2011 and before, including those at retailer T.J. Maxx, Countrywide PLC, job search site Monster, Health Net Inc., online gambling company Betfair and Sony, resulted in immediate share price drops of 3.17 percent, and relative drops of 11.62 percent when compared to the Nasdaq's performance. Breaches in 2015 and beyond, including those at Yahoo, JP Morgan Chase, Anthem Inc., LinkedIn and T-Mobile, actually resulted in no raw share price drop, and, relative to the Nasdaq, dropped just 0.87 percent, the study said.
The researchers analyzed breach response by industry as well, parsing the companies into categories of finance and payments, e-commerce and social media, health care, retail and technology. E-commerce and social media companies showed the strongest day-of resilience to a breach, with shares dropping 0.73 percent, but one year later, compared to the Nasdaq, the stocks underperformed by 47.2 percent.
Interestingly, the size of the breach didn't necessarily correspond to the effect on stock values. Instead of "the bigger the breach, bigger the impact" relationship that researchers expected, the study found that companies hit with the smallest breaches, of between 1 million and 10 million records, suffered the largest share drops. Those companies, on average, saw an initial 2 percent hit, and recovered an average of 21 days later.