Measuring the Economic Effects of Data Breaches on Firm Outcomes: Challenges and Opportunities

Abstract

We estimate the association between data breaches and firm-level outcomes using newly assembled data on the universe of reported data breaches between 2005 and 2016. First, we document several new facts about the incidence of data breaches. Second, using cross-sectional variation and controlling for time-varying observable firm inputs, we find that a 10% rise in breaches is associated with approximately a 0.2% decline in firm productivity. However, we also find large heterogeneity depending on the type of breach (e.g., theft of a company laptop). Third, we characterize a major limitation with publicly reported breach data, namely a sample selection problem that creates non-classical measurement error. While our results suggest that breaches do have a negative effect on firm financial outcomes, our results also point out the inadequacy of publicly reported breach data for causal inference.

Keywords: Cyber Crime, Data Breaches, Productivity, Information Security

JEL Classification: D80, H40, L10, L86