The theft or leaking of data is definitely not viewed as a good thing by companies or their clients, but there may be one silver lining in such a situation, according to new research.

A data breach is an incident where personal information is accessed, disclosed without authorisation or is lost. In many jurisdictions, including Australia, firms have to disclose data breaches where it is likely to cause serious harm.

Any firm in any industry can be affected, from airlines to investment banks and even internet companies like Yahoo and eBay.

No ASX small cap has suffered a data breach – yet. Possibly the closest example is a mass loss of users, which happened to Dropsuite (ASX:DSE) last year. The company lost 50 per cent on that day and has not recovered one year on.

From a firm’s perspective a data breach results in a reputational hit and will require systems to be overhauled and trust to be regained.

But for many investors, the main thing is the share price response.

An analysis of US-listed firms by technology research company Comparitech has highlighted just what impact a data breach can have on a share price.

After reviewing 33 case studies, Comparitech found that of the US-listed firms that suffered a data breach, the average share price fall was 7.3 per cent and the company would hit a low point about 14 trading days after.

But, on the flipside, six months after the leak, these companies actually exceeded their performance before the event, growing 7.4 per cent as opposed to 4.1 per cent in the six months before the breach.

Companies also showed a positive performance at the one, two and three-year milestones, but in all cases underperformed the NASDAQ.

Most notably, after three years share prices gained 32.5 per cent but were down against the NASDAQ by 13.27 per cent.

Finance and payment companies fell the most, while health stocks fell the least. Firms that leaked highly sensitive information, particularly credit card and social security numbers, saw the biggest drops.

And older breaches actually saw a more negative reaction than newer breaches.

Comparitech found that the breaches that occurred in 2011 or earlier saw the share prices of the companies fall 3.7 per cent in the six months post-breach.

But those that occurred in 2016 or later resulted in an average 4.11 per cent gain for the company.

Firms that suffered large breaches (100 million records or more) suffered more in the short term.

But compared with smaller breaches (1-10 million) they were better off after six months. The former was up 11.7 per cent, but the latter lost 5.9 per cent.


Not all about share price

Comparitech’s Paul Bischoff admitted the study only covered the share price and that other factors could impact the company.

The first of these was any potential lawsuits against the company. This happened in some cases and cost millions of dollars. However, there was an insufficient number and too large a range to implement in the model.

The second was the impact on the company’s financial figures including profits, funds diverted to data security as well as a loss of revenue.