Does intellectual capital curb the long-term effect of information security breaches on firms’ market value?

Information security (infosec) breaches are becoming increasingly common, putting businesses at risk. These could have a long-term impact on the financial performance and, consequently, publicly traded firms’ market value (MV). Despite its significance, prior research has concentrated mainly on the short-term effects of breached firms’ MV. In addition, a paucity of literature explores what can be done to mitigate the negative impact on MV of breached firms. Employing a novel method of 'one-to-one matching,' this study’s primary objective is to examine the long-term effect of infosec breaches on the MV of breached firms. Furthermore, in today’s knowledge-based economy, a lack of efficient intellectual capital (IC) that results in effective infosec risk mitigation strategies in the event of an infosec breach may amplify the loss of market value for breached firms. Hence, this research establishes a knowledge management indicator based on 'Value-Added Intellectual Capital' (VAIC™) to reflect firms' infosec risk management and resiliency. Thus, the secondary objective of this research is to examine the moderating influence of VAIC on the relationship between infosec breaches and the long-term MV of breached firms. Specifically, we envision how the firm’s efficiency in IC, which encompasses human capital efficiency, structural capital efficiency, and capital employed efficiency, mitigates this effect. A long-term examination of 220 infosec breaches demonstrated a significant negative impact on the MV of breached firms within 1 year of the breach and from 1 year prior to 2 years after the breach. However, firms with a higher level of IC will experience a less severe negative impact on MVs. In addition, firms with greater human and structural capital efficiencies are anticipated to recover from information security breaches more rapidly. The study is anticipated to greatly assist investors, managers, and scholars comprehend the long-term relationship between security breaches and firms' MV. In addition, managers are expected to be provided with sophisticated information that enables them to create and expose their firms' IC to investors to represent efficient infosec-risk management and resilience practices.