Spillover Effects of Firms’ Data Breach Disclosures on Suppliers and on Industry Peer Competitors

Abstract

Data breaches are becoming increasingly pervasive and costly to firms. Prior and recent studies on the consequences of disclosed data breaches primarily focus on the direct effects on the breached firms. We undertake a different approach by studying the spillover effects from breached customer firms to related firms (their suppliers). We also study the spillover effects from breached firms to similar firms (same-industry competitors). We first document that such spillover effects exist in the stock market, as reflected by negative cumulative abnormal returns to stocks of suppliers following breach disclosures made by their major customers. We also observe positive cumulative abnormal returns to stocks of firms in the same industries as breached firms. Spillover effects to related and similar firms also exist for real activities. Non-breached suppliers reduce their extension of trade credit to customers following disclosures of breaches by specific related (customer) firms. Suppliers also reduce relation-specific investments in R&D following disclosures of breaches by related firms. Non-breached firms increase their extension of trade credit, and their R&D outlays, subsequent to disclosures of breaches made by similar (same-industry, competing) firms. We further document differential spillover consequences for data breaches accomplished by outsiders via electronic means (such as external hacking of corporate computers) versus data breaches accomplished by insiders or via other means (such as by theft of hardware). Our findings suggest that important consequences of data breaches extend beyond the breached firms.