Cybersecurity Breaches reduce innovation

Using data from 2005–2014, we investigate the relationship between reportable CSBs and future levels of innovation. The increasing costs associated with CSBs, along with the possibility of CSBs leading to a diversion of resources away from future innovation activities, make this topic important to study. While the existing CSB research largely focuses on short-term market impacts of a CSB (e.g., Goel and Shawky 2009; Spanos and Angelis 2016; Higgs et al. 2016) and argues that such effects are not economically significant to affected firms (Hilary et al. 2016), we take a relatively longer-term approach to analyze the potential innovation impacts by using one- and two-year windows and by investigating investment efficiency and ROA for CSB firms over the four years following the CSB.

Consistent with the cited literature, we expected that the presence of a reportable CSB is negatively associated with our main innovation measure of subsequent-year R&D spending. Given that R&D spending is not uniformly distributed across the cross-section of firms, we predicted that Innovation Leader and Innovation Peer firms react to CSBs in different ways. Additional analyses examine alternative innovation proxies. Specifically, we investigate if affected firms reduce patent activity two years after a reportable CSB, hold more cash, and reduce their investment efficiency.

Our cross-sectional tests indicate a negative association between breached firms and R&D spending in the year following a reportable CSB and support the hypothesis that the decrease is strongly associated with firms whose business model arguably does not have R&D spending at its core (i.e., Innovation Peers). Conversely, our results suggest that Innovation Leader firms send a signal to the market that they will keep increasing their R&D spending despite the negative CSB event. Additional evidence suggests that the decrease in R&D spending is associated with a decrease in patents in the two years following the CSB. However, because of limitations in our patent data, we are only able to study patents for the sample of CSBs from 2005– 2008. Future research should further investigate the impact of CSBs on patents as more data become available.

Importantly, we also find evidence suggesting that breached firms hold more cash and reduce their investment efficiency following reportable CSBs. The aggregate results suggest that reportable CSBs have a direct impact on several measures of innovation and are economically significant. Further, we show that the effects of reducing R&D spending are long reaching, affecting ROA and investment efficiency for at least four years following a reportable CSB.

Our study contributes to the extant CSB, signaling theory, and innovation domains within AIS research. Our focus on future levels of innovation complements the larger body of CSB research. Further, the economically significant decreases in innovation we find (e.g., a reduction in R&D spending of approximately 10 percent in the year following a reportable CSB for all breached firms, on average, or a 12.7 percent reduction just for the Innovation Peers) provide evidence contradicting Hilary et al.’s (2016) argument that CSBs are not economically significant events. Two of the innovation proxies we use, R&D spending and patent activity, also represent an interesting dichotomy, as the former is identified in the literature as an input into the innovation process, while the latter is an innovation outcome.

Managers face potentially significant strategic choices in the time period after a reportable CSB. They may choose to cut discretionary spending in some areas (e.g., R&D), which could negatively affect long-term innovation (e.g., patent activity), but help to accomplish short-term profitability. Our findings pertaining to increased levels of cash holdings and decreased investment efficiency post CSB represent a direct investigation of the associations between CSBs and a firm’s financial characteristics and are the first of their kind that we are aware of. Thus, managers and directors seeking to minimize damage related to CSBs, while also attempting to balance the risks associated with strategic financial decisions, should be interested in our findings. Our research should also be of interest to regulators (e.g., the SEC) interested in the impact of CSB disclosure on firms, as well as investor groups interested in firms’ future growth potential.