Understanding Cybersecurity Breach Contagion Effects : The Role of the Loss Heuristic, Managerial Ability, and Internal Controls

In this study, we seek to provide insights into the conflicting findings from prior research regarding whether the effects of a cybersecurity breach spillover to non-breached bystander firms in the same industry - a phenomenon known as contagion effects. We suggest that when considering the implications of a breach for a bystander firm, investors will use the loss heuristic and view loss bystander firms as more likely to suffer a similar breach in the future, leading to greater cybersecurity breach contagion effects for loss versus profit firms. Furthermore, we propose that managerial ability and internal control quality will mitigate contagion effects and to a greater extent for loss firms than for profit firms. To test our hypotheses, we use a sample of cybersecurity breaches and then identify a sample of non-breached bystander firms in the same subindustry with the breached firms. Our findings offer insights into the mixed findings from the body of research on cybersecurity breach contagion effects and should be informative to boards of directors and firm management considering ways to minimize costs associated with peer cybersecurity breaches