Information security breaches and IT security investments: Impacts on competitors

Christina Y. Jeong, Sang Yong Tom Lee, Jee Hae Lim

Research output: Contribution to journalArticlepeer-review

27 Scopus citations


In current business climate, a firm's information systems security is no longer independent from the industry's broader security environment. A question arises, then, whether stock market values reflect the interdependence of security breaches and investments. In this paper, we used the event study methodology to investigate how a firm's security breaches and IT security investments influence its competitors. We collected and reviewed 118 information security breaches and 98 IT security investment announcements from 2010 to 2017. We found substantial evidence supporting our hypothesis that information security breaches do, indeed, have a competition effect: when one firm is breached, its competitors have opportunities to absorb market power. For the IT security investment announcements, however, we observed the positive externalities, or contagion effect, in play: market investors feel that the security investments made by one firm increase the security level of the entire network, and hence, competitors also get benefits. Additionally, we found that the competition effect was higher when the breaches occurred after the preceding security investments than when there were no preceding investments before the breaches.

Original languageEnglish
Pages (from-to)681-695
Number of pages15
JournalInformation and Management
Issue number5
StatePublished - 2019 Jul


  • Breach
  • Event study
  • Externalities
  • Information security
  • Information transfer effect
  • Investment


Dive into the research topics of 'Information security breaches and IT security investments: Impacts on competitors'. Together they form a unique fingerprint.

Cite this