Study finds breach companies underperform NASDAQ.
Study finds breach companies underperform NASDAQ.

While it's widely known that data breaches often hurt the reputations of a company, a recent study found breaches also temporarily hurt a company's stock market status as well.

Breached companies as a whole tend to underperform the NASDAQ with researchers noting these firms recover to the index's performance level after 38 days on average, but after three years the NASDAQ ultimately outperforms them by a margin of over 40 percent, according to a July 11, 2017 Comparitech Analysis.

The study found, on average, stocks suffer an immediate decrease in share price of about .43 percent, about equal to their average daily volatility, after a breach. In the long term, share prices continue to rise at a slower rate with researchers noting a 45.6 percent increase in share price during three years prior to breach, and only 14.8 percent growth in the three years after.

To measure the effects of a breach, the researchers compared the performance of the share price versus the performance of the NASDAQ over the same period to see how that stock performs against the general market to help to account for general market forces.

Financial companies often experienced the biggest immediate yet small impact on share price after a breach with an initial fall of almost 3 percent  on an average volatility of 0.19 percent and continuing to drop for over a month to -3.49 percent before gradually picking up.

“I suspect this is because reputation is so vital to banks and payment companies, and their reputations are built on trust,” Paul Bischoff, researcher and privacy advocate for Comparitech told SC Media. “A breach of data is seen as a breach of customer trust.”

He added that he was expecting a much larger initial drop off after a breach it seems investors don't take breaches as serious as consumers. Another surprise was that smaller breaches tended to have a larger impact on shares than larger breaches, possibly because smaller breaches happen to smaller companies which are more volatile.

Internet businesses, such as ecommerce and social media companies, suffered the most in the long term after a breach though the exact reason is unclear.

“I'm not certain about why this is, but one theory I have is that a data breach is a symptom of broader structural, cultural, or even financial issues within a company,” Bischoff said. “A company that doesn't invest enough into data security could be cutting corners or just be more prone to oversights.”

Researchers also noted other outside factors that could have contributed to decreases in share prices for companies such as when Apple stock performed poorly after its data breach. In this instance researchers noted it was around the same time that the company released its first iPhone without Steve Jobs at the helm, which was likely a greater factor in share price decline, Bischoff said.