This paper reassesses two conflicting hypotheses on the valuation impacts of private placements of equity (PPEs), the monitoring/certification hypothesis and the managerial entrenchment hypothesis, by focusing on the shareholder approval, active buyer, and premium pricing features of PPEs. We find that PPEs with these features have significant positive announcement returns and insignificant mean long-run returns, while the corresponding announcement and long-run returns for PPEs without such features are significantly negative. Firms with value-enhancing PPE features are better governed and use proceeds more efficiently. Thus, the heterogeneous nature of PPEs helps reconcile the puzzling return patterns and conflicting hypotheses regarding PPEs.

We develop a model where a firm has an optimal exposure to cyber risk. With rational, fully informed agents and with no hysteresis, a successful cyberattack should have no impact on a financially unconstrained target's reputation and post-attack policies. In contrast, when a successful attack involves the loss of personal financial information, there is a significant shareholder wealth loss, which is much larger than the attack's out-of-pocket costs. This excess loss is higher when the attack decreases sales growth more and lower when the board pays more attention to risk management before the attack. Further, an attack decreases a firm's risk appetite, as it beefs up its risk management and information technology and decreases the risk-taking incentives of management. Finally, successful cyberattacks adversely affect the stock price of firms in the target's industry. These results imply that successful attacks with personal financial information loss provide adverse information about cyber risk to target firms, their stakeholders, and their competitors.