Data breaches make companies underperform the market in the long run

While the share prices of companies that experienced a sizeable/huge data breach suffer just a temporary hit, in the long term breached companies underperformed the market, an analysis by consumer tech product review and comparison site Comparitech has shown.

This is the site’s second annual analysis into the share prices and overall performance of 24 companies that are listed on the New York Stock Exchange and have suffered a data breach in the last ten years or so. Among others, these include Apple, Anthem, Equifax, Home Depot, JP Morgan Chase, Sony, and Yahoo.

The effect of data breaches

The analysts looked at the closing share prices of these companies starting the day prior to the public disclosure of their respective data breaches and up until the six months following a breach.

Some of the breaches involved the compromise or more sensitive information that others. The number of compromised records spans from 1 to 100 millions.

Their analysis showed that share prices of breached companies hit a low point approximately 14 market days following a breach, but that they rebound and catch up to NASDAQ performance on average after about a month.

“After the first month, the companies we analyzed actually performed better than they did prior to the breach,” says Comparitech’s Paul Bischoff.

“In the long term, breached companies underperformed the market. After 1 year, Share price grew 8.53% on average, but underperformed the NASDAQ by -3.7%. After 2 years, average share price rose 17.78%, but underperformed the NASDAQ by -11.35%. And after three years, average share price is up by 28.71% but down against the NASDAQ by -15.58%.”

Other interesting findings:

• Finance and payment companies suffered the largest initial downturn following breaches on average. Healthcare companies, on the other hand, seem largely unaffected by the breach.
• The companies that leaked credit cards and social security numbers witnessed a sharp drop in share price performance on average in the first three weeks following the breach. “They performed worse in the six months following a breach than the six months prior, but not by much,” Bischoff shared. Companies that leaked usernames, email addresses, phone numbers, addresses – i.e., information that could be used to target account holders with advertisements, scams, and phishing emails – significantly underperformed the NASDAQ six weeks after the breach (compared to the the six months before it).

Bischoff noted that the impact of data breaches likely diminishes over time, so they only looked at a short period of time when changes in share price can be more attributable to data breaches.

Also, that they likely did not have all the information to evaluate how data breach lawsuits and consequent settlements affect stock prices, and how shareholder reports (and additional breach info) might have influenced investors to pull out.