The Textual Contents of Media Reports of Information Security Breaches and Profitable Short-Term Investment Opportunities

Abstract

Information security-related incidents continue to make headlines. Interestingly, researchers have found mixed results when attempting to associate reports of information security breaches with changes in the affected firm's stock price. This research delves further into this puzzle by investigating the association between the textual contents of information security breach media reports and the stock price, as well as the trading volume reactions of the affected firm(s) around the breach announcement day. Our findings suggest that when the textual contents of breach reports provide more detailed information regarding the incidents, a more consistent belief is formed by the market about the negative impact of the reported security incident on the firm's business value. However, when there is a lack of specific information regarding the reported breach, the market does not seem to reach consensus on the impact of reported security incidents. We further demonstrate that different perceptions exist among general and sophisticated investors regarding the impact of reported information security incidents on a firm's future performance as demonstrated by changes in trading volume. By exploiting the different perceptions among investors, we form a trading strategy to demonstrate that, on average, one can make about 300% annual profit around the breach announcement day.

Keywords:

• information security
• breach announcements
• text mining
• decision tree
• sophisticated investors

ACKNOWLEDGMENTS

The authors would like to thank the review team for their valuable comments and suggestions. The authors also thank the Center for Education and Research in Information Assurance and Security (CERIAS) as well as the participants of the 20th Workshop on Information Systems and Economics (WISE 2008) and the 10th Annual Information Security Symposium Poster Session. The authors are grateful for the financial support from the University of Hawaii at Manoa and Purdue University.

Notes

¹We consider the following criteria for our sample selection. First, it must be related to publicly traded firms. We exclude government agencies, private organizations, schools, etc. from our analyses. Second, the breach announcement must be from a national media source, such as the Wall Street Journal, USA Today, Washington Post, and the New York Times. We do not consider other sources because we investigate the market reactions to media reports. It is hard to argue that the market is affected by a report released by local media outlets. Third, we only consider the first event in our sample period. Last, the observations are not included if there exist confounding events. Based on the above criteria, only 89 observations remain in our sample.

²We choose to form clusters instead of using words (or phrases) directly to predict market reactions because of the following reasons. We have more than 100,000 words/phrases in our dataset. Although it is not a big dataset, when we use all these words/phrases to predict the market reactions, it becomes very difficult to understand the results, not to mention the low predictability. That is, we are not able to summarize 50,000 words/phrases, for instance, to explain why the textual contents may be associated with different market reactions.

Figure 1 Building process of the Classification Model.

³As given in Table 5, Dataset A has an average of about 388 words and Dataset B has an average of about 565 words. The media reports are relatively short. In addition, the most popular word in our dataset, not surprisingly, is “security,” which only appears about 2.7 times per announcement. Most of the words only appear once in a particular media article. These may be the reasons (or our intuitions) why the weighting scheme does not affect our results.