Kenneth Belva, a New York-based information security officer, has written an interesting review of the effect of privacy and security breaches on the stock prices of the companies involved (How It's Difficult to Ruin A Good Name: An Analysis of Reputational Risk). The purpose of the report is to "begin the conversation", but it does note some interesting trends: the closer privacy and security is to your core business, the greater the impact upon stock prices.

"In the cases were there was a temporary loss or no loss at all [in share price], it appears that the breach was not in an area that effected [sic] the core business. In other words, even though Citigroup and UPS lost 3.9 million customer records, Citigroup was still able to lend money and UPS could continue shipping packages.

I am willing to leave an open hypothesis on the table: The greater the financial impact or potential financial impact from the information security incident, the greater the reputational damage; the less the financial impact or potential financial impact from an information security incident, the less the reputational damage."

I might add something to the conversation (which I am basing only on my gut): consumers are more fickle than companies and companies are more afraid of the bad reputation of associated companies rubbing off on them. A credit card issuer won't get a big hit when one of their service providers loses data, but it is very easy and likely prudent for the credit card company to cut the service provider loose. If a company like CardSystems loses contracts with two of three major credit card issuers, that's the death of the company. The further down the chain you go, the greater the impact of these incidents. It makes sense if you look at the impact of these incidents on potential revenues: the person at a credit car company who recommends service providers has a number of companies to choose from, puts her personal reputation on the line when she recommends a provider and does due diligence on all prospective providers. A provider with a big blemish sticks out and doesn't get chosen. Consumers as a group are less discerning than the handful of people who make business-critical decisions. Simply put, if you are a critical service provider to other businesses, your reputation matters more.

Also, as Belva points out in his report, stock price may not be the only indicator of the hit companies take if they are associated with a privacy/security incident. It is just the most visible measure.

Greg Keizer at Information Week has an article on Belva's report that's worth reading: InformationWeek > Security > Report: Security Slip-Ups Don't Ding Stock Prices For Long > September 23, 2005.

Labels: cardsystems, information breaches