Data Breaches and Stock Prices

When talking to companies about the effects of hacking and data breaches I often talk to companies about the effect on stock prices and the potential for brand damage – but, does a security breach really cause a noticeable effect on share prices? Incidentally I was recently working on a script to pull historical stock data for companies at specific dates. So I figured I’d test drive the new script and pull some historic data for companies immediately following a breach, to show the ultra-short term affect on their share price. So I offer my raw data here without analysis and allow you to draw your own conclusions. It’s pretty interesting to see the initial drops in stock and the patterns that affect all companies and all breaches regardless of how well it is handled.

I selected a sample of companies and tried to determine as best as I could the point of disclosure. The point of disclosure is an interesting thing in itself so I’ve tried to pick something sensible, such as the official company disclosure or an early news article. The table below shows, in chronological order, the companies that I ran the number for, their stock code, the date I selected as the “point of disclosure” and a link to the article or official post to add a little depth. I’ve shortened the URLs just to keep the table neat.

Company NameStock CodeDisclosure DateBreach Announcement
Sony PSNSNE31-May-11http://on.mash.to/1NOdh57
TerracomTER.AX23-May-13http://bit.ly/1ONRHxm
AdobeADBE03-Oct-13http://bit.ly/1CNbsPI
TargetTGT01-Jan-14http://tcrn.ch/1VBfWIp
EbayEBAY21-Mar-14http://bit.ly/1ItoefP
Home DepotHD02-Sep-14http://bit.ly/1qlYRAZ
GoogleGOOG10-Sep-14http://bit.ly/YxwANL
Sony PicturesSNE08-Dec-14http://bit.ly/1AAFh6e
PremeraESRX29-Jan-15http://bit.ly/22r23NU
AnthemANTM04-Feb-15http://bit.ly/16kXhba
ExperianEXPN.L01-Oct-15http://reut.rs/1U7vSwS
TalkTalkTALK.L06-Nov-15http://bit.ly/1WEWm9d
JuniperJNPR17-Dec-15http://juni.pr/1Zgz2li

The raw data is shown in the following graphs, I’ve included three graphs per company, the first covers a period starting 14 days before the disclosure and 46 days forward, the second is from the point of breach and 14 days forward and the third is from the point of breach and five days forward. So the first figure of each trio will show the point just before the breach where as the second two will show the immediate effect. Each figure includes two views, the top view is a candlestick diagram which shows the open, close, high and low values for each day whist the below view is a simplified one which shows each day’s close value.

My naive view is that the first figure of each trio shows the price trundling along as usual before the point of disclosure where it seems across the board share prices slam down as you’d expect, although surprisingly in many cases the appear to recover very quickly!

Sony PSN

Sony PSN Breach – 14 days before breach point and 45 days forward.
Sony PSN Breach – Breach point and 15 days forward.
Sony PSN Breach – Breach point and 5 days forward.

Terracom

Terracom Breach – 14 days before breach point and 45 days forward.
Terracom Breach – Breach point and 15 days forward.
Terracom Breach – Breach point and 5 days forward.

Adobe

Adobe Breach – 14 days before breach point and 45 days forward.
Adobe Breach – Breach point and 15 days forward.
Adobe Breach – Breach point and 5 days forward.

Target

Target Breach – 14 days before breach point and 45 days forward.
Target Breach – Breach point and 15 days forward.
Target Breach – Breach point and 5 days forward.

Ebay

eBay Breach – 14 days before breach point and 45 days forward.
eBay Breach – Breach point and 15 days forward.
eBay Breach – Breach point and 5 days forward.

Home Depot

Home Depot Breach – 14 days before breach point and 45 days forward.
Home Depot Breach – Breach point and 15 days forward.
Home Depot Breach – Breach point and 5 days forward.

Google

Google Breach – 14 days before breach point and 45 days forward.
Google Breach – Breach point and 15 days forward.
Google Breach – Breach point and 5 days forward.

Sony Pictures

Sony Pictures Breach – 14 days before breach point and 45 days forward.
Sony Pictures Breach – Breach point and 15 days forward.
Sony Pictures Breach – Breach point and 5 days forward.

Premera

Premera Breach – 14 days before breach point and 45 days forward.
Premera Breach – Breach point and 15 days forward.
Premera Breach – Breach point and 5 days forward.

Anthem

Anthem Breach – 14 days before breach point and 45 days forward.
Anthem Breach – Breach point and 15 days forward.
Anthem Breach – Breach point and 5 days forward.

Experian

Experian Breach – 14 days before breach point and 45 days forward.
Experian Breach – Breach point and 15 days forward.
Experian Breach – Breach point and 5 days forward.

TalkTalk

TalkTalk Breach – 14 days before breach point and 45 days forward.
TalkTalk Breach – Breach point and 15 days forward.
TalkTalk Breach – Breach point and 5 days forward.

Juniper

Juniper Breach – 14 days before breach point and all available data forward at 24 Dec 2015.
Juniper Breach – Breach point and all available data forward at 24 Dec 2015.