Cyber attacks can negatively impact firm stock prices in the short term. Analyzing 3 datasets of cyber attacks on public companies from 2011-2016, the researchers found: 1) Stock prices dropped on average 0.63% on the day of the attack announcement and for 2 days after, with over 50% of attacks resulting in negative returns. 2) Company size and diversification were the most important factors determining the size of the stock price drop. 3) Machine learning models could predict short term stock price drops based on attack and company characteristics but were not highly accurate. 4) Long term impacts may include reduced profitability and increased costs rather than just stock price effects.

1. A Case Study on the Effects of Cyber
Attacks on Firm Stock Price
IEORE4211 Applied Consulting
Group 1: Cedric Canovas, Shravan Kumar Chandrasekaran, Michelle Liu,
Xiaomeng Luo, Andrew Tang, Ran Wang, and Ruyue Xu

2. Executive Summary
Cyber Security Overview
Three Data Sets Used
Literature Review
Model 1: The Market Model
Model 2: Multiple Regression Analysis
Model 3: Machine Learning
Conclusion & Further Thoughts
Methodology

3. Introduction
❖ Over 169 million personal records were
exposed in 2015, from 781 publicized breaches
❖ Average global cost for lost/stolen records
containing confidential and sensitive data was
$154/record, highest cost was $363/record for
health care
❖ In 2015, there were 38% more security incidents
detected than in 2014
❖ Attackers stay dormant within a network before
detection for a median of over 200 days
❖ 74% of CISOs are concerned about employees
stealing sensitive company information
❖ Only 38% of global organizations claim they are
prepared to handle a sophisticated cyberattack
Cyber security spending in the US, percent of
GDP and USD billions, 2009 - 2017

4. Introduction
Most Prevalent Cyber Threats - Top
TenTypes of Threats:
❖ Insider threats (employees)
❖ Outside threats (hackers,
organized crime outfits,
activists or other parties)
Common Methods of Attacks:
❖ Malware: Trojans, viruses,
worms
❖ Phishing: emails
❖ Password Attack: brute
force attack
❖ Denial-of-Service (DoS)
Attack: distributed-denial-
of-service (DDoS) attack
❖ SQL Injection

5. High-Target Industries:
❖ Healthcare: personal information, most highly
targeted industry for data breaches
❖ Education: colleges and universities, educational
records
❖ Government: foreign nation-states, militant groups,
crime rings benefit from government-related data
❖ Retail: credit card information, which can be sold on
the Dark Web
❖ Financial: bank account information
Top Cyber Attack Motives:
❖ Information Theft: acquire information owned by
the target
❖ Espionage: monitor the activities of the targets and
steal information that these targets may have
❖ Sabotage: destroy, defame or blackmail the target
Introduction

6. Three Datasets:
First Data Set
❖ 4000+ raw data from
2011-2016
❖ 500+ major incidents
happened to public
companies in US
❖ Source:
Hackmageddon-
Information Security
Timelines and Statistics
Website
❖ Number of major
industries affected: 25+
Second Data Set:
❖ World’s largest data
breaches (>30000
records)
❖ 185 raw data from
2004-2015
❖ 50 incidents happened
to public companies at
the time of incident
❖ Source: A data
website- Information Is
Beautiful
❖ Number of major
industries affected: 5
Third Data Set:
❖ 400+ raw incident data
from 2005-2016
❖ 150+ major public
companies targeted in
the US
❖ Source:
Study on major data
leakages by the
Verizon Risk Team for
their Verizon Data
Breach Investigation
Report
❖ Number of major
industries affected: 15+

7. Evolution of the Number of Attacks
Source: Hackmageddon Dataset
Average monthly attacks has gradually steadied to around 90 from 2012, when the attacks were
very erratic

8. Types of Attacks Across Time
Source: Hackmageddon Dataset
Cyber crime has steadily increased from 61.6% of total cyber attacks in 2012 to 94.3% in 2015
There was a sudden spurt in Hacktivism in 2013, contributing to almost 80% of total cyber attacks

9. Attacks Are Affecting Industries at Different Levels
❖ E- Commerce & Software reign as the two major technological submarkets that are most affected by cyber
incidents
❖ Technology in general makes up 40% of the targeted industries consistently through the graphs of the three
data sets above
❖ Retail next most significantly hit area in all 3 charts after technology

10. Literature Review
Author Period
Studied
Sample
Size
Focus of Study Major Findings
Campbell et
al. (2003)
1995 - 2000 43 Two types (access to
confidential or not)
❖ Significant negative return involving confidential information and
no changes in return for other types of breaches
Garg et al.
(2003)
1996 - 2002 22 All ❖ On average, the loss is 2.7% over one day and 4.5%
over a 3-day period
Hovav & D’
arcy (2003)
1998 - 2002 23 DOS attacks ❖ Negative abnormal returns of the Internet-specific companies
were larger
Hovav & D’
arcy (2004)
1988 - 2002 186 Virus attacks ❖ No negative returns over 5 days after the
announcement
Telang &
Wattal (2007)
1999 - 2004 147 Vulnerability
announcements
❖ Average loss of 0.63% conditioned by various factors
❖ Vendors lose more value in competitive markets, larger software
vendors are less affected
❖ More severe and confidentiality-related vulnerabilities cause
more stock price losses
Arcuri & Brogi
(2014)
1995 - 2012 128 All ❖ Cyber attack announcements affect stock market returns of firms
❖ Stock market reaction differs with economic sector of firms

11. Methodology: Event—Study
Event-Study
❖ Assume that returns on a stock are significantly impacted by an event of interest (a cyber
security attack). The period of interest for which we observe is known as the event window.
❖ In practice and in academic research, the event window includes two days: day 0 and day 1
to capture the effect of an announcement. Sometimes -1 day is also used to incorporate
possible information leaks before the announcement date.
❖ The methodology has been widely used in the banking and finance literature when
analyzing information breaches and other related events. Based on efficient market theory.
Design of the
testing
framework
for the
abnormal
returns
Determine
the model for
computing
the abnormal
returns:
Determine
the entities
involved and
choose the
reasonable
event
window:
MacKinlay (1997) presents a comprehensive review for this type of research and clearly defines the required steps:
❖ What are considered normal returns?
❖ How to define abnormal returns? Test Statistic Z
Day 0 as the announcement
day; Can vary according to
research interests

12. Estimate Normal Stock Return
Event—Study: Three Important Calculations
Define Abnormal Stock Return Calculate Cumulative Abnormal. Return
: the return of stock i in period t
: the return of market portfolio
(benchmark)
: error term with mean 0
: risk-adjusted performance of stock i
: a measure of risk compared to the
market
The equation is based on the assumption that
daily stock returns are consistent with the
Capital Asset Pricing Model (CAPM).
Used for running regressions to get the normal
stock returns
Gather 120-day data prior to the
announcement date for estimating the model
: abnormal return of stock i in period t
: actual return of stock i in period t
Aggregate the abnormal returns for stock i
over time interval [t1, t2]. Could calculate a
mean CAR if want to know average
impact.
The shortest commonly
accepted estimation period
is 120 days. Many past
literatures used the 120-day
period.
120 data points for both
stock returns as well as
market returns within the
same period.
A short-term event period (3
days, 5 days, etc.) is
generally accepted in similar
studies. K.Campbell et al.
points out that extending the
window would increase the
likelihood of confounding
events and adding much
noise.

13. Model 1: The Market Model
Results
❖ How do we know if the abnormal returns are
not random but due to the effects of cyber
attacks?
Z statistics
Null hypothesis (abnormal returns are not significantly different from 0 )
Method discussed by Arcuri et al. (2014):
N: number of stocks in the sample
SCAR(t1,t2): the standardized CAR on stock i in period t
: : average return on market index in period t
: : estimated standard deviation of Abnormal Return on stock i
T: number of days in the estimation period
Ts: number of days in the event window
Z-statistics has a t-distribution with T-2 degrees of freedom and
converges to a unit normal
Days Event
Wind
ow
Mean
CAR
Total
CAR
Z-Test
Statisti
cs
Negative
CARs
3-Day (-1,1) -0.63% -1.89% -4.962** 53.36%
5-day (-1,3) -0.42% -2.10% -2.125* 52.88%
7-day (-1,5) -0.21% -1.47% -1.207 51.06%
9-day (-1,7) -0.13% -1.17% -1.021 50.25%
The second dataset, World’s Major Attacks, is used.
** statistically significant at 5% level; * at 10% level
We can reject the null hypothesis that cyber attack does
have an effect on the company’s stock returns over the event
window (-1,1) and (-1,3). Hence 3-day and 5-day are critical.
However, we did not find enough evidence to reject the null
hypothesis for 7-day and 9-day, which means that the effect
is not obvious 3 days after the announcement. Overall, the
effect is relatively short-lived. A little more than 50% of the
total incidents have seen negative CARs over (-1,1) and (-1,3).

14. Model 2: Multiple Regression Model
Cyber attacks might not affect all firms in the same way.
Company-specific characters would also influence how
serious a cyber attack would be on the company stock
return.
Total
Assets (in
$ billion)
Growth
Rate
Competiti
ve or Not
Diversificati
on
Max 4,808.200 86.19% 1 0.74
Min 0.460 -9.58% 0 0
Mean 401.952 7.66% 0.44 0.43
S.D. 880.12 0.17 0.50 0.18
Follow the method adopted by Telang and Wattal (2007):
Measure diversification in terms of the Herfindahl index.
The index of a firm is calculated as:
N: the number of segments in which the firm operates
Pi: the ratio of segment, represented as segment i’s revenue
to total revenue
DIV=0, not diversified
DIV=1, diversified
Variable Coefficient
Total Asset (Natural Log) 0.0037*(0.08)
Growth Rate 0.0021 (0.56)
Competitive or Not -0.0015 (0.48)
Diversification 0.0054** (0.03)
Results ** statistically significant at 5% level; * at 10% level
: average abnormal return over 3-day period
Xi : company-specific factors

15. Model 3: Machine Learning
This analysis uses the third dataset with many input
variables
Again, we try to predict 3-day abnormal return
Algorithms tested: Gradient Boosting, Generalized Linear
Model, K-nearest-neighbors, Random Forest
Random Forest
Absolute RMSE: 0.01
Variables: Discovery method, industry, type of attack, employee
count, type of affected asset, governance of affected asset
❖ Many parameters influence the market reaction, but hard to
get a reliable predictive model due to the low number of
datapoints
Example of a generated decision tree

16. Model 3: Machine Learning
Parameter Importance
Discovery method:
employee
1.61
# of employees: 1001-
10000
1.41
Type of attack 1.40
Industry 1.20
Relative importance of variables
❖ Some correlations between input variables and the impact
on the stock price, no guarantee of causality

17. Conclusion
Industry analysts inferred that shareholders are numb to news of data
breaches. A widely accepted notion goes that there are only two types of
companies: those that have been breached and those that don’t know they
have.
Deeper reasons for the market’s failure to respond to these incidents:
❖ Shareholders have neither enough information about security incidents
nor sufficient tools to measure their impact.
❖ Shareholders only react to breach news when it has direct impact or
immediate hit to a company’s expected profitability.
❖ Delays in disclosing information security incidents often contribute to
shareholders’ hesitation and uncertainty with regard to how to factor in
the effects of the breaches. Oftentimes, when an attack is disclosed, it
is almost impossible for shareholders to assess its full implications.
(example: an attack happened last June, discovered this January, but
disclosed this March)
“... look beyond short-term effects
and examine the impact on other
factors, such as overall security
plans, profitability, cash flow, cost
of capital, legal fees associated
with the breach, and potential
changes in management ...”
Return on Assets (ROA)
Return on Sales (ROS)
Cost of Goods Sold to Sales (COGS/S)
Performance Variables
❖ Cyber attacks only affect stock return in a relatively short time window:
3- day and 5-day
❖ The size of the company and diversification are the two most important
factors that determine the impact of an attack on a specific company
Based on our findings, firms should focus more not
on the stock price, but on looking into factors that could
affect profitability in the long-term in a more subtle
way.

18. Further Thoughts
Cyber Attack
Discovery
Full/Limited
Disclosure
Recovery
Plan/No
Action
Announcement
Abnormal
Return
By Attack Source
By FirmBy Third Party
Limited Disclosure
Only Report to Firm
Full Disclosure Limited Disclosure
Attack Type and
Characteristics
Investor Expectation
and Response
Cyber Attack
Disclosure Process
❖ The most important factor that affects
the accuracy of the study is the source
and date, to better guarantee that the
date of the stock market return we
analyze is the correct one associated
with the attack.
❖ However, in an age of information
explosion with so many means to
transfer information, it is getting much
harder to pinpoint the first release date
of a cyber attack.
❖ The process of attack disclosure also
complicates the problem.
❖ Loss is ameliorated by 0.82% if the
company provides a patch at time of
disclosure. Presence of a patch reduces
customer loss and reflects commitment
to customers (Telang & Wattal).

19. Closing Remarks
Factors that contribute to cyber security vulnerability:
❖ Technical Failure
➢ Lack of fundamental cyber security measures
➢ Outdated software
➢ Failure to encrypt critical employee and user data
❖ Managerial Failure
➢ Not understanding potential cyber security risks
■ Lack of financial and talent support
■ Lack of awareness and training among
employees
➢ Lack of cyber security oversight processes
■ Lack of a recovery plan
➢ Not prioritizing cyber security policy
❖ Human Factor Failure
➢ Motives and methods that can trigger an “inside job”
■ Damage inflicted from social engineering,
remote access and laptop
➢ Allowing personal device at work
➢ Lack of awareness in HR department

20. THANKS!— Special thanks to Brian Krebs for advice (former Washington Post journalist
and expert on cyber crimes and other Internet security topics) and Paolo Passeri for
providing one of our datasets ( founder of www.hackmageddon.com, a website
offering information security timelines and statistics)