With the growing attention to information security (infosec) in safeguarding data assets, more and more firms voluntarily disclose their infosec practices to cater to the market. Such disclosures not only affect the trust of investors but also have significant impacts on hackers’ behaviors. Previous studies empirically discussed how infosec disclosure affects firm value, but didn’t consider the authenticity of such disclosure. This study develops a game-theoretic model involving one firm and a strategic hacker, aiming to analyze how overstatement in infosec disclosure affects both firms and hackers. We find that when the firm discloses infosec practice, compared with the non-disclosure situation, the threat faced by the firm will decrease but the breach probability will increase, while the hacker’s effort and expected benefit will increase. When the firm overstates infosec practices, compared with honest disclosure, the threat and the breach probability will decrease, while the hacker’s effort and expected benefit will decrease. Moreover, we find that when the firm overstates the infosec practice, it increases other firms’ expected costs, resulting in a negative spillover effect in the industry.