Building on her research investigating how firm value is affected by repeat data breaches, finance assistant professor Jin Peng, Ph.D., analyzed how businesses adjust and update their policies after data breaches, especially after multiple instances.
Peng and her co-authors focus on two primary questions in “How do repeated data breaches affect firm policies?“: which types of firms are the most likely to experience repeat breaches, and how those breaches inform policy updates, changes in expenses and other factors.
By reviewing 1,014 data breach incidents in U.S. companies that took place between 2021 and 2024, the team learned more about which are more likely to suffer a data breach and how those businesses operate. They found that large firms, firms with high institutional ownership and firms with higher research and development (R&D), capital expenditure and advertising expenses were more expected to have repeat incidents. This can be attributed to the visibility and more complex financial and technological infrastructure of larger companies, while businesses that prioritize R&D are more likely to have trade secrets and intellectual property, and firms with higher expenses are often more popular or well-known— all traits that make them more appealing targets.
When these breaches do happen multiple times, the study found that firms usually respond by lowering their leverage adjustments (ratios of debt to assets) and increasing R&D and/or advertising expenses. Subsequently, firms generally take fewer risks following breaches and invest more in cybersecurity.
As a result of the findings, the authors recommend that firms with high cybersecurity risk “should be more conservative in their financing policies, should be more active in hardening their cybersecurity infrastructure, and should adopt more efficient marketing strategies.”
Peng’s co-authors for this study include Haofei Zhang, Ph.D., Assistant Professor at Nankai University; Juan Mao, Ph.D., Associate Professor at the University of Texas at San Antonio; and Shouhuai Xu, Ph.D., UCCS Professor of Computer Science. Read the entirety of “How do repeated data breaches affect firm policies?” online.