Using daily abnormal currency returns for the universe of countries with flexible exchange rates, we show local currency depreciations ahead of unscheduled, public sovereign debt downgrade announcements. Consistent with the private information hypothesis, the effect is stronger in lower institutional quality countries and holds after we control for concurrent public information and for publicly available rumors about the forthcoming downgrades. Our results persist when abnormal currency returns are adjusted for global carry and dollar risk factors, world equity and bond returns, as well as local stock market returns. Finally, the currency depreciations are permanent, providing evidence for a link between fundamentals and currency markets.

Rating agencies consult with local government officials several days prior to official announcements of sovereign debt rating changes, making information leakage likely. Using cross-country data from 1988 to 2012, we find evidence of information leakage. In particular, we find statistically and economically significant negative daily abnormal stock index returns prior to downgrade announcements. These effects are more pronounced in countries with lower institutional quality, and they persist during times with no downgrade rumors and no concurrent bad news in general. A mild post-announcement reversal consistent with overreaction to pre-event downgrade rumors highlights the adverse effects of such leakage and, thus, should be a policy concern for capital market regulators.

We develop a model where a firm has an optimal exposure to cyber risk. With rational, fully informed agents and with no hysteresis, a successful cyberattack should have no impact on a financially unconstrained target's reputation and post-attack policies. In contrast, when a successful attack involves the loss of personal financial information, there is a significant shareholder wealth loss, which is much larger than the attack's out-of-pocket costs. This excess loss is higher when the attack decreases sales growth more and lower when the board pays more attention to risk management before the attack. Further, an attack decreases a firm's risk appetite, as it beefs up its risk management and information technology and decreases the risk-taking incentives of management. Finally, successful cyberattacks adversely affect the stock price of firms in the target's industry. These results imply that successful attacks with personal financial information loss provide adverse information about cyber risk to target firms, their stakeholders, and their competitors.