Risk managers need to assess risk impacts that are difficult to evaluate, such as the cost of reputation damage. But how do you put a value on the impact of an IT security failing that results in the breach of customer data? One way is to look at the company’s share price. The stock market valuation of a company will be influenced by many factors but it is generally believed that privacy breaches erode customer confidence, with the result that the company becomes less attractive to investors, who would then choose to invest their money elsewhere. A comprehensive study by Comparitech reviewed the impact of 40 major privacy breaches on the share price of listed US companies since 2017 and found the situation was more complicated than you might suppose.
Companies that suffered breaches did slightly worse overall, but results were mixed. Using the NASDAQ index as a baseline, the breached companies underperformed the NASDAQ by 3.5 percent. However, many of the underperforming businesses were already lagging the stock market before their breaches occurred. Comparing movements in share prices before and after the breach suggested that many of the firms actually did better than would have been predicted from share prices before their breach became public.
Telco risk managers cannot relax yet. The extent of the reputation damage caused by a privacy breach appears to vary by business sector. Shares of social media firms were not hurt by the negative publicity surrounding a privacy breach whilst technology and telecoms companies were knocked most of all, with their shares performing significantly worse in the half-year following the breach than in the half-year beforehand. One possible explanation is that customers place more trust in businesses like Sony and T-Mobile and are hence more upset when they fail to protect the customer’s privacy.
You can read Comparitech’s analysis here.
