Please rotate your device to landscape mode to view the charts.

Are the good spared? Corporate social responsibility as insurance against cyber security incidents

Journal: Risk Analysis

Date: 2023

Author: Vassiliki Bamiatzi, Michael Dowling, Fabian Gogolin, Fearghal Kearney, Samuel Vigne

Abstract:
Despite the increasing consensus that socially responsible behaviour can act as insurance against externally induced shocks, supporting evidence remains somewhat inconsistent. Our study provides a clear demonstration of the insurance-like properties of corporate social responsibility (CSR) in preserving corporate financial performance (CFP), in the event of a data (cyber) breach. Exploring a sample of 230 breached firms, we find that data breaches lead to significantly negative CFP outcomes for low CSR firms, with the dynamic being particularly pronounced in consumer-sensitive industries. Further, we show that firms increase their CSR activities in the aftermath of a breach to recover lost goodwill and regain stakeholder trust. Overall, our results support the use of CSR as a strategic risk-mitigation tool that can curtail the consequences of data breaches, particularly for firms operating in consumer-centric environments.

Link: Google Scholar

Background and Context

Research Motivation

As cyber security breaches become increasingly common, this study examines whether corporate social responsibility (CSR) can act as insurance against the negative impacts of data breaches.

Study Sample

Analysis of 230 data breaches across 638 firms between 2005-2014, examining both financial performance and CSR activities before and after breaches.

Key Focus

Special attention given to consumer-sensitive industries like retail and finance, where data breaches may have heightened impact due to handling of sensitive customer information.

Distribution of Data Breaches Across Industries Shows Higher Risk in Consumer-Facing Sectors

  • Finance and retail sectors experienced the highest number of data breaches
  • 77 breaches occurred in financial sector firms, followed by 49 in wholesale/retail
  • Consumer-facing industries appear more vulnerable to cyber attacks

High CSR Scores Reduce Negative Impact of Data Breaches on Firm Performance

  • Firms with low CSR scores saw ROA decline by 2.5% after breaches
  • Firms with high CSR scores experienced only 0.9% decline in ROA
  • Strong CSR activities appear to provide insurance-like protection against breach impacts

Consumer-Sensitive Industries Show Stronger Negative Effects from Data Breaches

  • Consumer-sensitive industries experienced 3.4% decline in ROA after breaches
  • Non-consumer-sensitive industries saw only 0.8% decline
  • Consumer trust appears more critical in consumer-facing industries

CSR Score Improvements in Years Following Data Breaches

  • Firms significantly increase CSR activities in years following breaches
  • Largest increase observed one year after breach
  • Suggests strategic use of CSR to rebuild stakeholder trust

Distribution of Sample Across Consumer-Sensitive Industries

  • 67% of sample firms operate in consumer-sensitive industries
  • 3,423 firm-year observations in consumer-sensitive industries
  • Demonstrates robust sample size for analysis

Contribution and Implications

  • CSR activities provide significant insurance-like protection against negative impacts of data breaches
  • Consumer-sensitive industries benefit most from CSR investment as protection against breach impacts
  • Firms strategically increase CSR activities after breaches to rebuild stakeholder trust

Data Sources

  • Industry distribution chart based on Table 1, Panel B
  • CSR impact analysis based on Table 4 regression results
  • Consumer-sensitive industry effects from Table 5
  • CSR timeline changes based on Table 6, Panels A-C
  • Sample distribution from Table 1, Panel C