Do Nonprofessional Investors Care About How and When Data Breaches are Disclosed?

While prior research suggests that the market responds negatively to data breach disclosures, how nonprofessional investors assess factors surrounding these disclosures has only been assessed anecdotally. We examine whether investor judgments are influenced by whether a breached company is the first to disclose a data breach and whether a significant amount of time has lapsed between the breach and disclosure. We find evidence that investors respond to a company originating disclosure with lower investment judgments than if disclosure comes from an external source, without consistent regard to the timing of disclosure. We also find that investors make the least favorable investment judgments when the breached company initiates the data breach disclosure and when there is a significant delay between the data breach and initial public disclosure. Our study provides a greater understanding of one consequence of data breaches, that is, how timing and disclosure initiative influence nonprofessional investors' judgments.