Exploring the Cybersecurity Spillover Effect : How Customer Data Breaches Affect Supplier Cost Management Strategies

Cybersecurity is a significant concern for businesses worldwide among management, stakeholders, and regulators. In this paper, we explore the spillover effect of customer firms’ data breaches on their upstream supplier firms’ cost management strategies, proxied by cost stickiness, a prevalent resource management strategy that occurs when firms cut costs less when demand falls than they increase for an equivalent demand increase. Our primary analyses suggest that data breaches suffered by customer firms are associated with a decrease in cost stickiness among supplier firms. Furthermore, the reductions in supplier cost stickiness are stronger if suppliers are managed by CEOs from national cultural groups with high uncertainty avoidance, low long-term orientations, and/or low individualism. In additional analyses, we provide evidence that our main findings are not influenced by either supplier product market competition or data breaches experienced by suppliers. To strengthen causality, using the passage of mandatory state-level data breach notification laws as natural experiments that generates plausibly exogenous variation in data breaches, we employ a staggered difference-in-differences approach. The results reveal that the adverse effect of customer data breaches on supplier cost stickiness is diminished after these laws became effective in the states in which the breached customer firms are headquartered. Our inferences also persist when utilizing the predicted probability of data breaches derived from a two-stage regression analysis. Finally, suppliers are found to be more likely to hire cybersecurity experts on the top management team following customer data breaches, even if the suppliers themselves have not encountered any cybersecurity issues. In sum, the findings contribute to both Operations Management (OM) and Accounting disciplines in terms of data breach, cost management strategy, and the role of national culture in OM. In particular, the findings can facilitate the management and regulation of data breaches for managers and regulators