Paper Number
ICIS2025-2759
Paper Type
Complete
Abstract
This study investigates the effects of information security incidents on the stock prices of event companies and their industry peers, emphasizing the moderating roles of incident attributions (managerial vs. technical) and organizational response strategies (defensive vs. non-defensive). Based on 177 incidents involving 116 event firms and 16,801 industry peers in China, we find that such incidents negatively impact event companies’ stock prices and trigger industry-wide spillover effects. Notably, incidents attributed to managerial failures (vs. technical flaws) inflict greater losses on event firms but weaker spillover effects on peers. Defensive response strategies (e.g., denial) exacerbate event companies’ losses yet mitigate the spillover effects, compared to non-defensive approaches (e.g., compensation). The study contributes by revealing opposing moderating effects of incident attributions and demonstrating how response strategies differentially shape firm- and industry-level outcomes. Practical insights are discussed for event firms, industry peers, and regulators.
Recommended Citation
Wei, Xinyu; Jiang, Hemin; Zhang, Li; and Wei, Jiuchang, "Understanding the Economic Consequences of Information Security Incidents on Companies and Industry Peers: The Moderating Roles of Incident Attribution and Organizational Response" (2025). ICIS 2025 Proceedings. 25.
https://aisel.aisnet.org/icis2025/cyb_security/cyb_security/25
Understanding the Economic Consequences of Information Security Incidents on Companies and Industry Peers: The Moderating Roles of Incident Attribution and Organizational Response
This study investigates the effects of information security incidents on the stock prices of event companies and their industry peers, emphasizing the moderating roles of incident attributions (managerial vs. technical) and organizational response strategies (defensive vs. non-defensive). Based on 177 incidents involving 116 event firms and 16,801 industry peers in China, we find that such incidents negatively impact event companies’ stock prices and trigger industry-wide spillover effects. Notably, incidents attributed to managerial failures (vs. technical flaws) inflict greater losses on event firms but weaker spillover effects on peers. Defensive response strategies (e.g., denial) exacerbate event companies’ losses yet mitigate the spillover effects, compared to non-defensive approaches (e.g., compensation). The study contributes by revealing opposing moderating effects of incident attributions and demonstrating how response strategies differentially shape firm- and industry-level outcomes. Practical insights are discussed for event firms, industry peers, and regulators.
When commenting on articles, please be friendly, welcoming, respectful and abide by the AIS eLibrary Discussion Thread Code of Conduct posted here.
Comments
09-Cybersecurity