Data Breaches Have Lasting Effect on Stock Price

by Chris Brook on Thursday August 22, 2024

A recent study looked at stocks from 28 companies that experienced a breach of one million people or more and found that in the long run breached companies underperformed the market.

Data breaches are a dime a dozen these days. While each one obviously has an immediate effect on victim companies, it wasn't clear just what kind of lasting outcome breaches have on companies until just recently.

It turns out that companies that experience a breach, on average, underperform the NASDAQ by -3.7 percent after one year, according to a recent study. Comparitech, a U.K.-based site that aggregates consumer tech reviews, found that while share prices grew, year after year, the companies still underperformed in the long term. After two years the average share price of companies it looked at rose 17.78 percent but underperformed the NASDAQ by -11.35 percent, according to the study.

The service looked at the closing share prices of 24 companies that were hit by 28 breaches starting the day prior to the day its breach was disclosed.

The site looked at companies that were breached as far back as TJ Maxx, which was breached in 2007, and the Royal Bank of Scotland, which was breached in 2008, up to companies that were breached recently, like Under Armour this year, and Equifax, which was breached last year.

According to the study companies' share prices hit their lowest point roughly 14 market days after a breach, falling 2.89 percent on average, underperforming NASDAQ by -4.6 percent.

Blog Post

Data Breach Experts Share The Most Important Next Step You Should Take After A Data Breach

READ NOW

Logically, according to Comparitech's findings, Breaches that leak highly sensitive information like credit card and social security numbers saw larger drops in share price performance on average than companies that leak less sensitive information.

It's not the first time the company, which operates in a space akin to that of Consumer Reports, looked at how companies performed following a breach. It mounted a similar study last year, sans Under Armour and Equifax, and adjusted the window of time it evaluated share prices, to six months, instead of 1-3 years.

The company's research, while interesting, is limited in the sense that it only includes breached companies that lost one million or more records, publicly disclosed a breach, and was listed on the New York Stock Exchange at the time of its disclosure. There are only so many companies that fit the bill, hence why there are only two that were breached in the last two years, Under Armour, and Equifax.

The firm does a complete breakdown of share prices before, after, and how they measure up against NASDAQ, in graph form, on its site.

Tags: Data Breaches

Chris Brook

Chris Brook is the editor of Digital Guardian’s Data Insider blog. He is a cybersecurity writer with nearly 15 years of experience reporting and writing about information security, attending infosec conferences like Black Hat and RSA, and interviewing hackers and security researchers. Prior to joining Digital Guardian–acquired by Fortra in 2021–he helped launch Threatpost, an independent news site that was a leading source of information about IT and business security for hundreds of thousands of professionals worldwide.