Breached But Not Broken: How Attributional Information Shapes Shareholder Reactions to Firms Following Data Breaches

Data breaches are increasingly consequential for many business organizations. How firms address data breaches has substantial ethical and societal implications. However, there is still uncertainty regarding why certain organizations experience more severe consequences than others following data breaches and what actions firms can take to minimize the negative outcomes. To answer these questions, we leverage insights from the literature on crisis communication strategies and attribution theory to predict stock market reactions. We argue that those reactions, as reflected in shareholders’ responses following a breach, depend on the nature of attributional information and are contingent upon firms’ responses and media sentiment. Analyzing a sample of 287 data breach events in 95 publicly traded US firms over a decade, we found that when shareholders attribute the data breach to internal and stable causes, the firm appears “broken,” resulting in a decline in stock market returns. However, our findings also indicate that firms’ ceremonial responses and media sentiment mitigate this negative relationship. Our discussion explores the benefits of understanding the role of crisis communication strategies and applying attribution theory within corporate-level studies. We also suggest potential avenues for future research.