The Impact of Ransomware Attacks on Security Portfolios: Firm-Level Panel Data

Abulfaz Hajizada, Dana Etgar Itzhaki, Noa Barnir, Tyler Moore and Neil Gandal

No 21219, CEPR Discussion Papers from Centre for Economic Policy Research

Abstract: We study how firms adjust their cybersecurity postures after experiencing a cyber attack. We combine publicly disclosed ransomware cyber incidents with detailed data on security products and vendor deployments from the Spiceworks Ziff Davis (SWZD) Company Intelligence Database (CIDB) over multiple years. Our empirical approach compares attacked firms to similar non-attacked firms using econometrics and employing a difference-in-difference (DID) framework. Controlling for common changes made by all firms over time, we find that ``attacked" firms increased the breadth of their security posture relative to non-attacked firms. They adopted more National Institute of Standards and Technology (NIST) functions and had broader ``category coverage" than non-attacked firms in the ``post attack" period. Attacked firms also increased the usage of security products from large and ``platform" vendors relative to non-attacked firms in the ``post attack" period.

Keywords: Econometrics (search for similar items in EconPapers)
JEL-codes: D0 L00 (search for similar items in EconPapers)
Date: 2026-02
References: Add references at CitEc
Citations:

Downloads: (external link)
https://cepr.org/publications/DP21219 (application/pdf)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:cpr:ceprdp:21219

Ordering information: This working paper can be ordered from
https://cepr.org/publications/DP21219

Access Statistics for this paper

More papers in CEPR Discussion Papers from Centre for Economic Policy Research 33 Great Sutton Street, London EC1V 0DX, UK.
Bibliographic data for series maintained by CEPR ().