Speaking of bad news, a joint study (available for download) by ISS STOXX and ISS-Corporate recently examined just how much one type of bad news – reporting a cyber incident – impacts a company’s stock price. You might be surprised at what the summary refers to as the “depth and duration of damage.” The study examined the impact of reported cyber incidents on share values across the U.S. Russell 3,000 index from 2022 through 2024. They found that, “while share price underperformance manifests quickly, it is also sustained and builds over time.” Specifically:

– [F]irms reporting significant cyber incidents underperform the market (as measured by share price) by nearly 5% on average.

– This study confirms continued share price underperformance at one full year after incidents are first reported, with a peak negative average impact of nearly -4.9% after 250 trading days.

– The Finance and Banking sector, as well as the Health Care sector, show higher negative average impacts to relative share price in the months following a reported cyber incident (peaking at -8.5% and -8.3%, respectively).

Those two industries also experienced the majority of the total incidents in the three-year period.

– Meredith Ervine