Are There Trade-Offs with Mandating Timely Disclosure of Cybersecurity Incidents? Evidence from State-Level Data Breach Disclosure Laws

Motivated by the SEC’s new proposal to require firms to publicly disclose their cybersecurity incidents within four days of discovery, we study whether there are trade-offs with mandating a disclosure deadline for cybersecurity incidents. In the U.S., state-level data breach disclosure laws require firms to disclose the occurrence of a data breach, and some of these state laws require disclosure of a data breach within a deadline while others have no such deadline. Using a generalized difference-in-differences research design that exploits this state-level variation in disclosure deadlines, we find that, when they face a deadline, firms disclose the occurrence of a data breach 89.82 percent faster but are 57.71 percent less likely to disclose details about the breach. We also find that investors respond negatively to delayed breach disclosures but are forgiving of a disclosure delay when that delay is used to gather and report breach details. Our study has important policy implications, highlighting the trade-offs with mandating a disclosure deadline for cybersecurity incidents