Analysis of Stock Returns Following Cyber Incidents

Incident Impact has gathered data from 30 documented cases to evaluate the share-price performance of companies following cyber incidents. This analysis includes a comparison to the SPY index and a fixed-panel view of media attention during the first 14 days after the incidents were disclosed. Users can select a case to see how share prices moved after the incident became public. However, it is important to note that the data does not prove that the incident caused the stock price movement, as other factors such as company news, sector performance, and broader market trends can influence results. The median difference between company returns and SPY is highlighted, along with the percentage of cases that underperformed the benchmark. The analysis begins from a pre-disclosure baseline rather than a single post-incident entry point. The report also includes a count of articles that mentioned the affected companies during the first two weeks after the incidents, revealing that the median case had 10.5 articles, although some cases had none. The quality of archived articles varies by publisher and year, meaning that the volume of coverage does not necessarily indicate the importance or reputational impact of the incident. The report emphasizes that the framing labels used in headlines describe the wording rather than the sentiment or tone of the articles. A notable finding is that investing $1,000 in a company three days after a cyber incident and holding it for a year would have yielded a return of $1,786, compared to $1,148 if invested in SPY. This example suggests a potential positive outcome for buying after an incident, although it may not represent the overall catalog of cases. The report mentions several significant cyber incidents, including AT&T's disclosure of a data breach affecting nearly all wireless customers, the Change Healthcare ransomware attack that disrupted national claims and payment infrastructure, and Microsoft's revelation of a breach involving corporate email accounts. Other incidents include Caesars' social-engineering attack leading to theft of customer data, MGM's cybersecurity issue causing operational disruptions, and Clorox's unauthorized activity that impacted order processing and product availability. The report concludes that earnings, company news, and market conditions continue to evolve regardless of cyber incidents, with SPY serving as a consistent benchmark for comparison, though not a causal explanation for stock movements.