Do Nonprofessional Investors Care About How and When Data Breaches are Disclosed

While prior research suggests that the market responds negatively to data breach disclosures, how nonprofessional investors assess factors surrounding these disclosures has only been assessed anecdotally. We examine whether investor judgments are influenced by whether a breached company is the first to disclose a data breach and whether a significant amount of time has lapsed between the breach and disclosure. Nonprofessional investors could be influenced by the nature of breach disclosures even if a company's actual response to the breach is consistent with expectations. Experimentally, we find evidence that investors respond to a company originating disclosure with lower investment judgments than if disclosure comes from an external source, without consistent regard to the timing of disclosure. We also find that investors make the least favorable investment judgments when the breached company initiates the data breach disclosure and when there is a significant delay between the data breach and initial p...