Skip to main content
SpringerLink
Log in

Breached But Not Broken: How Attributional Information Shapes Shareholder Reactions to Firms Following Data Breaches

  • Original Article
  • Published:
Corporate Reputation Review Aims and scope Submit manuscript

Abstract

Data breaches are increasingly consequential for many business organizations. How firms address data breaches has substantial ethical and societal implications. However, there is still uncertainty regarding why certain organizations experience more severe consequences than others following data breaches and what actions firms can take to minimize the negative outcomes. To answer these questions, we leverage insights from the literature on crisis communication strategies and attribution theory to predict stock market reactions. We argue that those reactions, as reflected in shareholders’ responses following a breach, depend on the nature of attributional information and are contingent upon firms’ responses and media sentiment. Analyzing a sample of 287 data breach events in 95 publicly traded US firms over a decade, we found that when shareholders attribute the data breach to internal and stable causes, the firm appears “broken,” resulting in a decline in stock market returns. However, our findings also indicate that firms’ ceremonial responses and media sentiment mitigate this negative relationship. Our discussion explores the benefits of understanding the role of crisis communication strategies and applying attribution theory within corporate-level studies. We also suggest potential avenues for future research.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1
Fig. 2
Fig. 3

Similar content being viewed by others

Notes

  1. RavenPack assigns relevance scores with the range between 0 and 100, which “indicates how strongly related the entity is to the underlying news story.” Higher values indicate greater relevance. A score of 100 means the firm described was prominent in the news story (RavenPack News Analytics 2023).

  2. In our post hoc analyses section, we report the findings involving alternative time windows; these analyses yielded very similar results.

  3. RavenPack contains new reports from the Dow Jones Financial Wires, Wall Street Journal, Baron’s, MarketWatch, and other newswires.

  4. Moderating relationships must pass a simple slope test for estimation accuracy (Preacher et al., 2006). A simple slopes test is a standard t test to determine whether individual slopes of the simple models are statistically different; thus, it exhibits the difference between the two lines of a moderating effect.

  5. Frank, K. A. 2000. Impact of a confounding variable on a regression coefficient. Sociological Methods and Research, 29: 147–194.

References

  • Allen, M.W., and R.H. Caillouet. 1994. Legitimation endeavors: Impression management strategies used by an organization in crisis. Communications Monographs 61 (1): 44–62.

    Article  Google Scholar 

  • Ashforth, B.E., and B.W. Gibbs. 1990. The double-edge of organizational legitimation. Organization Science 1 (2): 177–194.

    Article  Google Scholar 

  • Baker, W.H., A. Hylender, C.D. Pamula, J. Porter, and C. Spitler. 2011. 2011 Data breach investigations report. New York: Verizon RISK Team.

    Google Scholar 

  • Benoit, W.L. 1997. Image repair discourse and crisis communication. Public Relations Review 23 (2): 177–186.

    Article  MathSciNet  Google Scholar 

  • Benoit, W.L. 2014. Accounts, excuses, and apologies: Image repair theory and research. Albany: SUNY Press.

    Google Scholar 

  • Benson, D.J. 1989. An efficient, accurate, simple ALE method for nonlinear finite element programs. Computer Methods in Applied Mechanics and Engineering 72 (3): 305–350.

    Article  ADS  Google Scholar 

  • Bergh, D.D., and P. Gibbons. 2011. The stock market reaction to the hiring of management consultants: A signalling theory approach. Journal of Management Studies 48 (3): 544–567.

    Article  Google Scholar 

  • Bielefeld, V. 2021. How to steal thunder: The effects of crisis communication timing, crisis communication framing and communication medium on consumer's trust, perceived sincerity, anger, purchase intention and perceived crisis severity. Master’s Thesis, University of Twente.

  • Boyd, B.K., S. Gove, and M.A. Hitt. 2005. Construct measurement in strategic management research: Illusion or reality? Strategic Management Journal 26 (3): 239–257.

    Article  Google Scholar 

  • Bundy, J., M.D. Pfarrer, C.E. Short, and W.T. Coombs. 2017. Crises and crisis management: Integration, interpretation, and research development. Journal of Management 43 (6): 1661–1692.

    Article  Google Scholar 

  • Busenbark, J.R., H. Yoon, D.L. Gamache, and M.C. Withers. 2022. Omitted variable bias: Examining management research with the impact threshold of a confounding variable (ITCV). Journal of Management 48 (1): 17–48.

    Article  Google Scholar 

  • Butt, U.A., R. Amin, M. Mehmood, H. Aldabbas, M. Alharbi, and N. Albaqami. 2023. Cloud security threats and solutions: A survey. Wireless Personal Communications 123 (1): 387–413.

    Article  Google Scholar 

  • Carroll, C., and M. McCombs. 2003. Agenda-setting effects of business news on the public’s images and opinions about major corporations. Corporate Reputation Review 6: 36–46.

    Article  Google Scholar 

  • Carroll, R.J., and D. Ruppert. 1982. Robust estimation in heteroscedastic linear models. The Annals of Statistics 10 (2): 429–441.

    Article  MathSciNet  Google Scholar 

  • Carson, J.E. 2019. External relational attributions: Attributing cause to others’ relationships. Journal of Organizational Behavior 40 (5): 541–553.

    Article  Google Scholar 

  • Cavusoglu, H., B. Mishra, and S. Raghunathan. 2004. The effect of internet security breach announcements on market value: Capital market reactions for breached firms and internet security developers. International Journal of Electronic Commerce 9 (1): 70–104.

    Article  Google Scholar 

  • Chen, J., E. Henry, and X. Jiang. 2023. Is cybersecurity risk factor disclosure informative? Evidence from disclosures following a data breach. Journal of Business Ethics 187: 199–224.

    Article  Google Scholar 

  • Coombs, W.T. 1995. Choosing the right words: The development of guidelines for the selection of the “appropriate” crisis-response strategies. Management Communication Quarterly 8 (4): 447–476.

    Article  Google Scholar 

  • Coombs, W.T. 2007. Protecting organization reputations during a crisis: The development and application of situational crisis communication theory. Corporate Reputation Review 10 (3): 163–176.

    Article  Google Scholar 

  • Cornelissen, J.P., R. Durand, P.C. Fiss, J.C. Lammers, and E. Vaara. 2015. Putting communication front and center in institutional theory and analysis. Academy of Management Review 40 (1): 10–27.

    Article  Google Scholar 

  • Crook, T.R., S.Y. Todd, J.G. Combs, D.J. Woehr, and D.J. Ketchen Jr. 2011. Does human capital matter? A meta-analysis of the relationship between human capital and firm performance. Journal of Applied Psychology 96 (3): 443–456.

    Article  PubMed  Google Scholar 

  • Dang, T.L., F. Moshirian, and B. Zhang. 2015. Commonality in news around the world. Journal of Financial Economics 116 (1): 82–110.

    Article  Google Scholar 

  • Davis, J.R., and G.J. Gold. 2011. An examination of emotional empathy, attributions of stability, and the link between perceived remorse and forgiveness. Personality and Individual Differences 50 (3): 392–397.

    Article  Google Scholar 

  • Deephouse, D.L. 2000. Media reputation as a strategic resource: An integration of mass communication and resource-based theories. Journal of Management 26 (6): 1091–1112.

    Article  Google Scholar 

  • Deephouse, D.L., and M. Suchman. 2008. Legitimacy in organizational institutionalism. In The Sage handbook of organizational institutionalism, ed. R. Greenwood, C. Oliver, T.B. Lawrence, and R.E. Meyer, 49–77. London: SAGE.

    Chapter  Google Scholar 

  • Donaldson, T., and L.E. Preston. 1995. The stakeholder theory of the corporation: Concepts, evidence, and implications. Academy of Management Review 20 (1): 65–91.

    Article  Google Scholar 

  • Dyck, A., and L. Zingales. 2003. The bubble and the media. Corporate Governance and Capital Flows in a Global Economy 3: 83–104.

    Article  Google Scholar 

  • Dyck, A., N. Volchkova, and L. Zingales. 2008. The corporate governance role of the media: Evidence from Russia. Journal of Finance 63 (3): 1093–1135.

    Article  Google Scholar 

  • Elsbach, K.D. 1994. Managing organizational legitimacy in the California cattle industry: The construction and effectiveness of verbal accounts. Administrative Science Quarterly 39 (1): 57–88.

    Article  Google Scholar 

  • Elsbach, K.D. 2003. Organizational perception management. Research in Organizational Behavior 25: 297–332.

    Article  Google Scholar 

  • Fama, E.F. 1970. Efficient capital markets: A review of theory and empirical work. Journal of Finance 25 (1): 383–417.

    Article  Google Scholar 

  • Ferrin, D.L., P.H. Kim, C.D. Cooper, and K.T. Dirks. 2007. Silence speaks volumes: The effectiveness of reticence in comparison to apology and denial for responding to integrity- and competence-based trust violations. Journal of Applied Psychology 92 (4): 893–908.

    Article  PubMed  Google Scholar 

  • Fidrmuc, J.P., M. Goergen, and L. Renneboog. 2006. Insider trading, news releases, and ownership concentration. Journal of Finance 61 (1): 2931–2973.

    Article  Google Scholar 

  • Fiske, S.T., and S.E. Taylor. 2013. Social cognition: From brains to culture, 2nd ed. London: SAGE.

    Book  Google Scholar 

  • Flammer, C. 2013. Corporate social responsibility and shareholder reaction: The environmental awareness of investors. Academy of Management Journal 56 (3): 758–781.

    Article  Google Scholar 

  • Försterling, F. 2001. Attribution: An introduction to theories, research, and applications. New York: Psychology Press.

    Google Scholar 

  • Freeman, R.E. 1984. Strategic management: A stakeholder approach. Boston: Pitman.

    Google Scholar 

  • Gao, H., T. Yu, and A.J. Cannella. 2016. The use of public language in strategy: A multidisciplinary review and research agenda. Journal of Management 42 (1): 21–54.

    Article  Google Scholar 

  • Garg, A., J. Curtis, and H. Halper. 2003. Quantifying the financial impact of IT security breaches. Information Management and Computer Security 11 (1): 74–83.

    Article  Google Scholar 

  • Gatzlaff, K.M., and K.A. McCullough. 2010. The effect of data breaches on shareholder wealth. Risk Management and Insurance Review 13 (1): 61–83.

    Article  Google Scholar 

  • Gooding, R.Z., and A.J. Kinicki. 1995. Interpreting event causes: The complementary role of categorization and attribution processes. Journal of Management Studies 32 (1): 1–22.

    Article  Google Scholar 

  • Gwebu, K.L., J. Wang, and L. Wang. 2018. The role of corporate reputation and crisis response strategies in data breach management. Journal of Management Information Systems 35 (2): 683–714.

    Article  Google Scholar 

  • Hambrick, D.C., and P.A. Mason. 1984. Upper echelons: The organization as a reflection of its top managers. Academy of Management Review 9 (2): 193–206.

    Article  Google Scholar 

  • Harvey, P., K. Madison, M. Martinko, T.R. Crook, and T.A. Crook. 2014. Attribution theory in the organizational sciences: The road traveled and the path ahead. Academy of Management Perspectives 28 (2): 128–146.

    Article  Google Scholar 

  • Hathaway, O.A., R. Crootof, P. Levitz, H. Nix, A. Nowlan, W. Perdue, and J. Spiegel. 2012. The law of data breach. California Law Review 100 (4): 817–885.

    Google Scholar 

  • Hersel, M.C., K.A. Gangloff, and C. Shropshire. 2023. Mixed messages: Crisis communication-dismissal (in)coherence and shareholder trust following misconduct. Academy of Management Journal 66 (2): 638–666.

    Article  Google Scholar 

  • Hong, H., W. Torous, and R. Valkanov. 2007. Do industries lead stock markets? Journal of Financial Economics 83 (2): 367–396.

    Article  Google Scholar 

  • Hooghiemstra, R. 2000. Corporate communication and impression management—New perspectives why companies engage in corporate social reporting. Journal of Business Ethics 27: 55–68.

    Article  Google Scholar 

  • Hou, K. 2007. Industry information diffusion and the lead-lag effect in stock returns. Review of Financial Studies 20 (4): 1113–1138.

    Article  Google Scholar 

  • Hovav, A., and J. D’Arcy. 2003. The impact of denial-of-service attack announcements on the market value of firms. Risk Management and Insurance Review 6 (2): 97–121.

    Article  Google Scholar 

  • Huang, K., and S. Madnick. 2020. A cyberattack doesn’t have to sink your stock price. Harvard Business Review, August 14. https://hbr.org/2020/08/a-cyberattack-doesnt-have-to-sink-your-stock-price#:~:text=Likewise%2C%20following%20the%20announcement%20of,%2492.98%20in%20just%20one%20week.

  • Hyatt, D.G., and N. Berente. 2017. Substantive or symbolic environmental strategies? Effects of external and internal normative stakeholder pressures. Business Strategy and the Environment 26 (8): 1212–1234.

    Article  Google Scholar 

  • IBM. 2020. Cost of a data breach report 2020. IBM. https://www.ibm.com/reports/data-breach.

  • IBM. 2023. Cost of a data breach report 2023. IBM. https://www.ibm.com/reports/data-breach.

  • Ice, R. 1991. Corporate publics and rhetorical strategies: The case of Union Carbide’s Bhopal crisis. Management Communication Quarterly 4 (3): 341–362.

    Article  Google Scholar 

  • Jin, J., H. Li, and R.E. Hoskisson. 2022. The use of strategic noise in reactive impression management: How do market reactions matter? Academy of Management Journal 65 (4): 1303–1326.

    Article  Google Scholar 

  • Joshi, A.M., and D.M. Hanssens. 2009. Movie advertising and the stock market valuation of studios: A case of “great expectations?” Marketing Science 28 (2): 239–250.

    Article  Google Scholar 

  • Kamiya, S., J.K. Kang, J. Kim, A. Milidonis, and R.M. Stulz. 2018. What is the impact of successful cyberattacks on target firms? (No. w24409). National Bureau of Economic Research.

  • Kaplan, A.M., and M. Haenlein. 2010. Users of the world, unite! The challenges and opportunities of Social Media. Business Horizons 53 (1): 59–68.

    Article  Google Scholar 

  • Kelejian, H.H., and D.P. Robinson. 1998. A suggested test for spatial autocorrelation and/or heteroskedasticity and corresponding Monte Carlo results. Regional Science and Urban Economics 28 (4): 389–417.

    Article  Google Scholar 

  • Kelley, H.H. 1973. The process of causal attribution. American Psychologist 28 (2): 107–128.

    Article  Google Scholar 

  • Kelley, H.H., and J.L. Michela. 1980. Attribution theory and research. Annual Review of Psychology 31 (1): 457–501.

    Article  CAS  PubMed  Google Scholar 

  • Kent, R.L., and M.J. Martinko. 1995. The measurement of attributions in organizational research. In Attribution theory: An organizational perspective, ed. M.J. Martinko, 17–34. Delray Beach: St. Lucie Press.

    Google Scholar 

  • Knif, J., J. Kolari, and S. Pynnönen. 2008. Stock market reaction to good and bad inflation news. Journal of Financial Research 31 (2): 141–166.

    Article  Google Scholar 

  • Krippendorff, K. 2004. Content analysis: An introduction to its methodology. London: SAGE.

    Google Scholar 

  • Kuipers, S., and M. Schonheit. 2022. Data breaches and effective crisis communication: A comparative analysis of corporate reputational crises. Corporate Reputation Review 25: 176–197.

    Article  Google Scholar 

  • Kutner, M., C. Nachtsheim, J. Neter, and W. Li. 2004. Applied linear statistical models. New York: McGraw-Hill.

    Google Scholar 

  • Lamin, A., and S. Zaheer. 2012. Wall Street vs. Main Street: Firm strategies for defending legitimacy and their impact on different stakeholders. Organization Science 23 (1): 47–66.

    Article  Google Scholar 

  • Le, P.D., H.X. Teo, A. Pang, Y. Li, and C.Q. Goh. 2019. When is silence golden? The use of strategic silence in crisis communication. Corporate Communications: An International Journal 24 (1): 162–178.

    Article  Google Scholar 

  • Lima, J.C., and M. Siegel. 1999. The tobacco settlement: An analysis of newspaper coverage of a national policy debate, 1997–98. Tobacco Control 8 (3): 247–253.

    Article  CAS  PubMed  PubMed Central  Google Scholar 

  • Liu, Y., V. Shankar, and W. Yun. 2017. Crisis management strategies and the long-term effects of product recalls on firm value. Journal of Marketing 81 (5): 30–48.

    Article  Google Scholar 

  • Liu, A.Z., A.X. Liu, R. Wang, and S.X. Xu. 2020. Too much of a good thing? The boomerang effect of firms’ investments on corporate social responsibility during product recalls. Journal of Management Studies 57 (8): 1437–1472.

    Article  Google Scholar 

  • Lunden, I. 2017. After data breaches, Verizon knocks $350M off Yahoo! sale, now valued at $4.48B. Techcrunch. https://techcrunch.com/2017/02/21/verizon-knocks-350m-off-yahoo-sale-after-databreaches-now-valued-at-4-48b/. Accessed 20 Feb.

  • Manworren, N., J. Letwat, and O. Daily. 2016. Why you should care about the Target data breach. Business Horizons 59 (3): 257–266.

    Article  Google Scholar 

  • Martin, K.D., A. Borah, and R.W. Palmatier. 2017. Data privacy: Effects on customer and firm performance. Journal of Marketing 81 (1): 36–58.

    Article  Google Scholar 

  • Martinko, M.J. 1995. Attribution theory. The Blackwell encyclopedic dictionary of organizational behavior. London: SAGE.

    Google Scholar 

  • Martinko, M.J., and W.L. Gardner. 1987. The leader/member attribution process. Academy of Management Review 12 (2): 235–249.

    Article  Google Scholar 

  • Martinko, M.J., and N.F. Thomson. 1998. A synthesis and extension of the Weiner and Kelley attribution models. Basic and Applied Social Psychology 20 (4): 271–284.

    Article  Google Scholar 

  • Martinko, M.J., D.M. Breaux, A.D. Martinez, J. Summers, and P. Harvey. 2009. Hurricane Katrina and attributions of responsibility. Organizational Dynamics 38 (1): 52–63.

    Article  Google Scholar 

  • Martinko, M.J., P. Harvey, and M.T. Dasborough. 2011. Attribution theory in the organizational sciences: A case of unrealized potential. Journal of Organizational Behavior 32 (1): 144–149.

    Article  Google Scholar 

  • McWilliams, A., and D. Siegel. 1997. Event studies in management research: Theoretical and empirical issues. Academy of Management Journal 40 (3): 626–657.

    Article  Google Scholar 

  • Meynhardt, T., P. Strathoff, A. Fröhlich, and S.A. Brieger. 2019. Same same but different: The relationship between organizational reputation and organizational public value. Corporate Reputation Review 22: 144–158.

    Article  Google Scholar 

  • Millar, D.P., and R.L. Heath, eds. 2003. Responding to crisis: A rhetorical approach to crisis communication. New York: Routledge.

    Google Scholar 

  • Morgan, S. 2020. Cybercrime to cost the world $10.5 trillion annually by 2025. Cybercrime Magazine, November 13. https://cybersecurityventures.com/cybercrime-damages-6-trillion-by-2021/.

  • Munyon, T.P., M.T. Jenkins, T.R. Crook, J. Edwards, and N.P. Harvey. 2019. Consequential cognition: Exploring how attribution theory sheds new light on the firm-level consequences of product recalls. Journal of Organizational Behavior 40 (5): 587–602.

    Article  Google Scholar 

  • Okhmatovskiy, I., and R.J. David. 2012. Setting your own standards: Internal corporate governance codes as a response to institutional pressure. Organization Science 23 (1): 155–176.

    Article  Google Scholar 

  • Orlitzky, M., F.L. Schmidt, and S.L. Rynes. 2003. Corporate social and financial performance: A meta-analysis. Organization Studies 24 (3): 403–441.

    Article  Google Scholar 

  • Perez-Quiros, G., and A. Timmermann. 2000. Firm size and cyclical variations in stock returns. Journal of Finance 55 (3): 1229–1262.

    Article  Google Scholar 

  • Pfarrer, M.D., T.G. Pollock, and V.P. Rindova. 2010. A tale of two assets: The effects of firm reputation and celebrity on earnings surprises and investors’ reactions. Academy of Management Journal 53 (5): 1131–1152.

    Article  Google Scholar 

  • Pollock, T.G., and V.P. Rindova. 2003. Media legitimation effects in the market for initial public offerings. Academy of Management Journal 46 (5): 631–642.

    Article  Google Scholar 

  • RavenPack News Analytics. 2023. User guide and service overview. New York: RavenPack Institute.

    Google Scholar 

  • Rhee, M., and M.E. Valdez. 2009. Contextual factors surrounding reputation damage with potential implications for reputation repair. Academy of Management Review 34 (1): 146–168.

    Article  Google Scholar 

  • Rogers, R.K., J. Dillard, and K. Yuthas. 2005. The accounting profession: Substantive change and/or image management. Journal of Business Ethics 58: 159–176.

    Article  Google Scholar 

  • Romanosky, S., D. Hoffman, and A. Acquisti. 2014. Empirical analysis of data breach litigation. Journal of Empirical Legal Studies 11 (1): 74–104.

    Article  Google Scholar 

  • Rosati, P., M. Cummins, P. Deeney, F. Gogolin, L. Van der Werff, and T. Lynn. 2017. The effect of data breach announcements beyond the stock price: Empirical evidence on market activity. International Review of Financial Analysis 49 (1): 146–154.

    Article  Google Scholar 

  • Sellnow, T.L., M.W. Seeger, and R. Sheppard. 2022. Revisiting the discourse of renewal theory: Clarifications, extensions, interdisciplinary opportunities. In The handbook of crisis communication, 127–136. Hoboken: Wiley.

  • Shi, W., B.L. Connelly, and K. Cirik. 2018. Short seller influence on firm growth: A threat rigidity perspective. Academy of Management Journal 61 (5): 1892–1919.

    Article  Google Scholar 

  • Siering, M. 2013. Investigating the impact of media sentiment and investor attention on financial markets. In Enterprise applications and services in the finance industry: 6th International workshop, FinanceCom 2012, Barcelona, Spain, June 10, 2012. Revised Papers 6, 3–19. Berlin: Springer.

  • Sirmon, D.G., J.L. Arregle, M.A. Hitt, and J.W. Webb. 2008. The role of family influence in firms’ strategic responses to threat of imitation. Entrepreneurship Theory and Practice 32 (6): 979–998.

    Article  Google Scholar 

  • Sjovall, A.M., and A.C. Talk. 2004. From actions to impressions: Cognitive attribution theory and the formation of corporate reputation. Corporate Reputation Review 7 (3): 269–281.

    Article  Google Scholar 

  • Smith, C. 2019. Capital One stock is falling because its data breach could cost more than $100 million. Barron’s. https://www.barrons.com/articles/capital-one-stock-data-breach-hacker-credit-card-applications-amazon-cloud-51564492172. Accessed 1 July.

  • SOCRadar Research. 2023, February 28. Security misconfigurations caused 35% of all time cyber incidents. SOCRadar Research. https://socradar.io/security-misconfigurations-caused-35-of-all-time-cyber-incidents/.

  • Stark, A., A. McConnell, and L.T. Drennan. 2014. Risk and crisis management in the public sector. New York: Routledge.

    Google Scholar 

  • Stevens, G. 2010. Federal information security and data breach notification laws. Darby: Diane Publishing.

    Google Scholar 

  • Steyn, B. 2004. From strategy to corporate communication strategy: A conceptualisation. Journal of Communication Management 8 (2): 168–183.

    Article  Google Scholar 

  • Szwajca, D. 2018. Dilemmas of reputation risk management: Theoretical study. Corporate Reputation Review 21 (4): 165–178.

    Article  Google Scholar 

  • Techcrunch. 2019. Marriott to face $123 million fine by UK authorities over data breach. https://techcrunch.com/2019/07/09/marriott-data-breach-uk-fine/. Accessed 4 Sep 2023.

  • Tetlock, P.C., M. Saar-Tsechansky, and S. Macskassy. 2008. More than words: Quantifying language to measure firms’ fundamentals. Journal of Finance 63: 1437–1467.

    Article  Google Scholar 

  • Trittin-Ulbrich, H. 2023. From the substantive to the ceremonial: Exploring interrelations between recognition and aspirational CSR talk. Business and Society 62 (5): 917–949.

    Article  Google Scholar 

  • Ulke, A.K., and L.M. Schons. 2016. CSR as a selling of indulgences: An experimental investigation of customers’ perceptions of CSR activities depending on corporate reputation. Corporate Reputation Review 19 (3): 263–280.

    Article  Google Scholar 

  • Ulmer, R.R., M.W. Seeger, and T.L. Sellnow. 2007. Post-crisis communication and renewal: Expanding the parameters of post-crisis discourse. Public Relations Review 33 (2): 130–134.

    Article  Google Scholar 

  • Ulsch, M. 2014. Cyber threat! How to manage the growing risk of cyber attacks. New York: Wiley.

    Google Scholar 

  • Vijayan, J. 2020. 2017 Data breach will cost Equifax at least $1.38 billion. DarkReaking. https://www.darkreading.com/attacks-breaches/2017-data-breach-will-cost-equifax-at-least-1-38-billion. Accessed 4 Sep 2023.

  • Wang, X., R.K. Reger, and M.D. Pfarrer. 2021. Faster, hotter, and more linked in: Managing social disapproval in the social media era. Academy of Management Review 46 (2): 275–298.

    Article  Google Scholar 

  • Weber, R.P. 1990. Basic content analysis. London: SAGE.

    Book  Google Scholar 

  • Weiner, B. 1979. On causes and causal dimensions: A reply to Falbo and Beck. Unpublished manuscript. Los Angeles: University of California.

  • Weiner, B. 1985. An attributional theory of achievement motivation and emotion. Psychology Review 92 (4): 548–573.

    Article  CAS  Google Scholar 

  • Weiner, B. 1995. Judgments of responsibility: A foundation for a theory of social conduct. New York: Guilford Press.

    Google Scholar 

  • Weiner, B. 2006. Social motivation, justice, and the moral emotions: An attributional approach. Mahwah: Lawrence Erlbaum Associates Press.

    Book  Google Scholar 

  • Weiner, B. 2019. Wither attribution theory? Journal of Organizational Behavior 40 (5): 603–604.

    Article  Google Scholar 

  • Weiner, B., I. Frieze, A. Kukla, L. Reed, S. Rest, and R.M. Rosenbaum. 1971. Perceiving the causes of success and failure. Morristown: General Learning Press.

    Google Scholar 

  • Wilson, B.J. 2018. Cornelissen, Joep: Corporate communication: A guide to theory & practice. Corporate Reputation Review 21: 179–180.

    Article  Google Scholar 

  • Wooldridge, J.M. 2003. Cluster-sample methods in applied econometrics. American Economic Review 93 (2): 133–138.

    Article  Google Scholar 

  • Woon, E., and A. Pang. 2017. Explicating the information vacuum: Stages, intensifications, and implications. Corporate Communications: An International Journal 22 (3): 329–353.

    Article  Google Scholar 

  • Xia, J. 2011. Mutual dependence, partner substitutability, and repeated partnership: The survival of cross-border alliances. Strategic Management Journal 32 (3): 229–253.

    Article  Google Scholar 

  • Zavyalova, A., M.D. Pfarrer, R.K. Reger, and D.L. Shapiro. 2012. Managing the message: The effects of firm actions and industry spillovers on media coverage following wrongdoing. Academy of Management Journal 55 (5): 1079–1101.

    Article  Google Scholar 

  • Zhang, Y., and M.F. Wiersema. 2009. Stock market reaction to CEO certification: The signaling role of CEO background. Strategic Management Journal 30 (7): 693–710.

    Article  Google Scholar 

Download references

Acknowledgements

We wish to thank Corporate Reputation Review Editor in Chief Dr. Guido Berens and anonymous reviewer for their constructive feedback.

Author information

Authors and Affiliations

  1. Narendra Paul Loomba Department of Management, Zicklin School of Business, Baruch College, The City University of New York, 1 Bernard Baruch Way, New York, NY, 10010, USA

    Xinran Wang

  2. Department of Entrepreneurship and Corporate Innovation, Hankamer School of Business, Baylor University, 1621 S 3rd St, Waco, TX, 76706, USA

    Jiaju Yan

  3. Department of Management & Entrepreneurship, Haslam College of Business, The University of Tennessee, 1000 Volunteer Blvd, Knoxville, TN, 37916, USA

    Timothy P. Munyon & T. Russell Crook

Authors
  1. Xinran Wang
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Jiaju Yan
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Timothy P. Munyon
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. T. Russell Crook
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Xinran Wang.

Additional information

Publisher's Note

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Appendix: ITCV Analysis and Results

Appendix: ITCV Analysis and Results

We employed the Impact Threshold of a Confounding Variable (ITCV) analysis (for recent applications and more discussion, see also Busenbark et al. 2022) to assess how strong the effect of a hypothetical confounding variable needs to be in order to overturn current findings. It calculates the correlations that must exist between a hypothetical endogenous independent variable and the dependent variable in question for endogeneity to be an issue. Notably, we followed recent developments of ITCV by Busenbark et al. (2022) to calculate the square root of the product of partial correlations among all covariates and used it as the benchmark to compare with the ITCV value. We used the “konfound” command in Stata 17.

The ITCV first calculated the threshold for the percent of bias to invalidate/sustain the inference. Regarding our key variable of interest (i.e., attributional information), the results showed that to invalidate its inference, 99% of the 284 cases would have to be replaced with cases for which there is a zero effect. The ITCV then calculated the impact of an omitted variable necessary to invalidate/sustain an inference for a regression coefficient. The results showed such an impact of attributional information: an omitted variable would have to be correlated at 0.459 with the outcome and at − 0.459 with the predictor of interest (conditioning on observed covariates. Signs are interchangeable) to invalidate an inference. Correspondingly, an omitted variable’s impact, as defined in Frank (2000),Footnote 5 must be 0.459 ×  − 0.459 =  − 0.2108 to invalidate an inference. Detailed ITCV results are shown n in Table 5.

Table 5 GLMs’ regression results for the stock market’s reaction (CAR) using an alternative measurement of media sentiment
Full size table

To interpret the results of the ITCV analysis, we followed Busenbark et al.’s (2022) guidelines to compute the partial correlations among all covariates. The largest partial correlation between control variables and attributional information is 0.18, and the largest partial correlation between control variables and stock market performance is 0.14. These correlations are not outside the thresholds of − 0.459 and 0.459. Additionally, we calculated the absolute value of the square root of the product of these correlations, which equals 0.16. Notably, this value is smaller than the ITCV absolute value of 0.21. This comparison suggests that there are no control variables in the study exhibiting correlations stronger than what would be required for an omitted variable to invalidate causal inference. In sum, based on the ITCV analysis, we conclude that our results are relatively robust to potential endogeneity caused by confounding factors or omitted variables (Table 6).

Table 6 ITCV analysis correlation-based impact and replacement
Full size table

Rights and permissions

Springer Nature or its licensor (e.g. a society or other partner) holds exclusive rights to this article under a publishing agreement with the author(s) or other rightsholder(s); author self-archiving of the accepted manuscript version of this article is solely governed by the terms of such publishing agreement and applicable law.

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Wang, X., Yan, J., Munyon, T.P. et al. Breached But Not Broken: How Attributional Information Shapes Shareholder Reactions to Firms Following Data Breaches. Corp Reputation Rev (2024). https://doi.org/10.1057/s41299-024-00179-1

Download citation

  • Published:

  • DOI: https://doi.org/10.1057/s41299-024-00179-1

Keywords

Search

Navigation