Why Information Security Breaches may matter to stock prices

admin
2015-05-01T16:01:00+00:00

I've been chewing on the this post since @dearestleader's BSidesATL talk and since reading this HBR piece.

First, know that stock investors care about the past only in how it might reflect potential future outcomes. By the time a breach is discovered it is history. Most companies have insurance that will cover some portion of the expense. There are PR firms ready to handle the press and information security consultants ready to proclaim the advanced nature of the attack. The dollar impact is proclaimed to be tiny compared to the revenue.

However, businesses flourish by creating capital at a rate higher than their weighted-average cost of capital. The lower the average cost of their stocks, loans, bonds and other forms of financing the easier it is to exceed that rate. The easier it is to exceed the cost of capital, the cheaper it becomes. It can be a highly virtuous circle. Or the opposite.

For a breach to have a negative impact, it would have to represent part of a larger issue. For example. the fact that Home Depot's lead security architect had a history of sabotaging his former employer might indicate other HR issues. The best way to evaluate the impact is to compare the performance of Home Depot versus the competition. I don't have the time to do this in detail, but I will share this graph comparing Home Depot to Lowes in the last 6 months (the HD breach press release was Nov 6th 2014 pdf) :

Both stocks did better than the S&P, but Lowes significantly outperformed HD, giving Lowes a lower weighted-average cost of capital. We'll see what the can do with it.

This is of course just anecdotal and there are many possible reasons for this. It could be enlightening to evaluate a portfolio of breached companies to their competitors and the market overall. It seems likely we will have sufficient data for that. But it's a mistake to say "after the breach the stock went up" without comparing the stock to the market and the competition.