Christoph Jaenicke

Against the background of increasing data privacy regulations in the US and EU, this study investigates the effect of privacy regulations on the reputational risk of cyber events. By extracting cyber events from the SAS Global OpRisk database, the world’s largest operational risk database, we found significantly larger cumulative abnormal returns (CAR) after the installation of privacy regulations. CARs are significantly influenced by firm size across the regulation regimes. Difference-in-differences regressions suggested a limited influence of regulation on key firm performance measures after a cyber incident. In the EU, return on assets is significantly reduced in contrast to the US. Overall, regulation amplifies the immediate consequences of an event compared with the pre-regulation era, but we find mixed evidence for these amplified consequences to be sustainable.