Financial Company Stocks Fare Worse After Data Breaches

The stock prices of most companies that suffer data breaches fall in the days following the revelation of the breach, and financial companies have the largest downturns, according to recent research.

And data breaches are not likely to go away, says Paul Bischoff, privacy officer at Comparitech, a global technology research firm based in the United Kingdom.

“Companies will learn to protect themselves against current threats, but hackers will find new avenues of attack,” Bischoff says. “This is not something that is going to diminish.”

Comparitech looked at publicly traded companies listed on the New York Stock Exchange where data breaches affected 1 million or more records. On average, share prices of breached companies hit a low point approximately 14 market days following a breach, with prices falling 2.89%.

Share prices revived during the six months following the breach, but the companies still underperformed the market. After one year, the average share price of the breached companies grew 8.53%, but underperformed the Nasdaq Composite Index, which rose by 12.23%. (Comparitech used the Nasdaq—which contains more than 3,400 common stocks—as a benchmark for the wider market).

After two years, the average share price for the companies that suffered data breaches gained 7.78%, but still underperformed the Nasdaq, which leaped 29.13%. And after three years, the average share price of breached companies was up by only 28.71%, underperforming against the Nasdaq, which zoomed 44.29%.

“It is important to note the impact of data breaches likely diminishes over time,” Bischoff says.

The companies included in the study were Apple, Adobe, Anthem, Community Health Systems, Dun & Bradstreet, eBay, Equifax, Experian, Global Payments, Home Depot, Health Net, Heartland Payment Systems, JPMorgan Chase, LinkedIn, Monster, T-Mobile, Sony, Staples, Target, TJ Maxx, Under Armour, Vodafone and Yahoo. Comparitech compared stock prices from the day before the revelation of the breach to prices at various points afterward.

“By far, Equifax suffered the worst breach,” Bischoff says. The company announced in September 2017 a hack that exposed the private information of about 143 million Americans, including Social Security numbers, birth dates, addresses and driver’s license numbers. Breaches such as this affect employees, owners and the public, and damage a company’s reputation with the public and investors, says Bischoff.