Cybersecurity Risk and the Cost of Debt

Abstract

This study investigates the relation between cybersecurity breaches and the cost of debt. Using a sample of 290 cybersecurity breaches from 2005 to 2018, I find a positive association between a cybersecurity breach and a firm’s cost of privately placed debt. Compared with loans initiated before a breach, loans initiated after a breach have significantly higher spreads (30 basis points on average). This relation is more pronounced for firms with lower pre-breach credit ratings (i.e., higher credit risk) and with less investment in control systems (i.e., higher IT risk). I also provide evidence that loans issued after a breach have fewer lenders, are smaller in size, and have a higher likelihood of requiring performance pricing. Finally, I document adverse effects of cybersecurity breaches in both the public debt and equity markets. Overall, these findings inform the ongoing regulatory discussion regarding mandated disclosure of cybersecurity events and suggest cybersecurity risk has an economically significant impact on firms’ financing costs.

Keywords: cost of debt, cybersecurity, business risk, technology, cost of equity

JEL Classification: M41, O31