Security Breaches and Modifications on Cybersecurity Disclosures

Jacob Peng () and Chang-Wei Li
Additional contact information
Jacob Peng: Department of Accounting and Taxation, Robert Morris University, USA
Chang-Wei Li: Department of Accountancy and Graduate Institute of Finance, National Cheng Kung University, Taiwan

Journal of Accounting and Management Information Systems, 2022, vol. 21, issue 3, 452-470

Abstract: Research Question - How do firms approach their cybersecurity disclosure obligations, especially for those who experienced a cyber-attack? Prior research has found that year-after-year modification on textual disclosures adds more appreciable information that makes it more relevant. But do firms provide meaningful disclosures to promote market transparency? Motivation - Because of growing cybersecurity threats in recent years, the U.S. Securities and Exchange Commission (SEC) has issued several regulations and guidance that emphasized on the disclosure of material information on cybersecurity. Given that the mandatory risk factor disclosures in SEC Form 10-K is the first place firms are encouraged to disclose cybersecurity-related assessment, it is important to examine how firms approach their disclosure expectations. Idea - To examine whether firms respond to cyber-attacks with meaningful disclosures, we use the Vector Space Model (VSM) to calculate disclosure modifications before and after major cyber-attack incident. Data: We extracted cybersecurity breach incidents from the Data Breach Database, a centralized and global database of data breaches maintained by a leading security company. In addition, we use the SEC data depository to find firms’ 10-K disclosures. Findings - We find that firms modify their cybersecurity disclosures by increasing the quantity of disclosures, but not necessarily the quality of disclosures as measured by document similarity. Furthermore, we find partial evidence that the degree of modification is positively associated with the severity of cyber-attacks. Contribution - Our evidence suggests that firms tend to use boilerplate language to disclose cybersecurity-related issues. This finding is consistent with prior research. That is, consistent with prior literature, the information content in public company 10-Ks is limited. We find that this seems to be the case as well when it comes to cybersecurity disclosures.

Keywords: cybersecurity; text analytics; VSM; risk factor (search for similar items in EconPapers)
JEL-codes: M41 (search for similar items in EconPapers)
Date: 2022
References: Add references at CitEc
Citations:

Downloads: (external link)
http://online-cig.ase.ro/RePEc/ami/articles/21_3_7.pdf (application/pdf)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:ami:journl:v:21:y:2022:i:3:p:452-470

Access Statistics for this article

More articles in Journal of Accounting and Management Information Systems from Faculty of Accounting and Management Information Systems, The Bucharest University of Economic Studies
Bibliographic data for series maintained by Cristina Tartavulea ().