Review of Financial Studies Vol. 36 No. 1 2022

Cybersecurity Risk

Chris Florackis¹; Christodoulos Louca²; Roni Michaely³; Michael Weber⁴

¹ University of Liverpool , UK · ² Cyprus University of Technology , Cyprus · ³ University of Hong Kong and ECGI , Hong Kong · ⁴ University of Chicago and NBER , USA

Abstract

Based on textual analysis and a comparison of cybersecurity risk disclosures of firms that were hacked to others that were not, we propose a novel firm-level measure of cybersecurity risk for all U.S.-listed firms. We then examine whether cybersecurity risk is priced in the cross-section of stock returns. Portfolios of firms with high exposure to cybersecurity risk outperform other firms, on average, by up to 8.3% per year. Yet, high-exposure firms perform poorly in periods of high cybersecurity risk. Reassuringly, the measure is higher in information-technology industries, correlates with characteristics linked to firms hit by cyberattacks, and predicts future cyberattacks.

DOI

10.1093/rfs/hhac024

Volume

36

Issue

1

Pages

351-407

Language

en

Sources

bibtex:phds-export.bib openalex crossref

Cite

APA 7 MLA 9 Chicago (author–date) Harvard Elsevier Harvard (JFE, JBF…) The Accounting Review Academy of Management American Marketing Association INFORMS (Management Science) Copy citation Copied ✓