Cybersecurity, Internal Controls, and Brand Capital

In this paper, we examine whether and how firms’ brand capital is hurt by cybersecurity breaches. Our difference-in-differences analysis based on matched pairs indicates that firms suffering cybersecurity breaches are associated with more canceled trademarks, fewer trademark registrations, and fewer trademark citations, all pointing to weakened brand capital. We also show that cybersecurity breaches are associated with more negative news sentiments and poorer operating performance, suggesting that the loss of clients’ trust serves as the underlying mechanism. Additional analyses show that brand capital is hurt more by cybersecurity breaches when firms engage in more internet advertising activity, when firms are headquartered in states that enact notification laws, or when firms have poorer internal controls. We also find an intriguing pattern that cyberattacks on a firm also hurt its peers’ brand capital, a finding that supports a contagion effect