On the use of market derived estimates of contingent losses: the case of data breaches
Bruce Bublitz, Kirk L. Philipich, Ramachandran Ramanan · 2015
In this study, the security market reaction to data breaches in two firms, TJX Companies and Heartland Payment Systems (HPY), are examined. Management of firms where such breaches occur claim that it is extremely difficult to estimate losses arising from these events, and refrain from making any disclosure until approximately nine months later. The primary thrust of this exploratory examination is to judge the usefulness of the market’s reaction to the breach’s occurrence as a proxy for the ultimate loss incurred by the firm experiencing the breach. The market’s reaction at the time of the breach is determined using two measures of abnormal returns: (1) market-adjusted returns, and (2) risk-adjusted returns. These abnormal returns (percentages) are then multiplied by the firm’s approximate market capitalization at the time of the breach to estimate the dollar amount of potential loss to the firm. The paper investigates whether the market’s reaction could serve as a starting point in determining the damages that might be claimed. The results of this study indicate that the losses estimated from the security market are reasonable proxies for the eventual losses reported by the firms. With regard to TJX, the market estimated losses are within 25% of the losses reported later; for HPY the market losses were within 20% of those disclosed by the firm. These results suggest that managers of firms may consider using market estimates of losses to report estimates earlier, with the provision to update these estimates later as more information becomes available regarding the eventual loss.