Impact of reporting information security breaches, accounting quality, and the opportunistic disclosure of good news and bad news

Abstract

Given the growing number and impact of information security breaches, we investigate and find a significant association between information security breaches and the risk of a stock price crash. In particular, for some information security breach firms, we find evidence of good news disclosures, with such disclosures being negatively associated with the risk of a stock price crash. Our results indicate that firms with information security breaches use the timing of the disclosure of good news to cushion the blow on firm value due to the reporting of these breaches. We also find a positive and significant association between bad news disclosure and all three measures of stock price crash risk. The timing of the opportunistic release of good or bad news could suggest an effort by firms with information security breaches to confuse investors about the overall impact. Furthermore, we show that firms with information security breaches are less likely to be associated with the risk of a stock price crash when they have more transparent financial reports or ISO 27001 certification.