Does ransomware make investors “WannaCry”? On investors’ divergent reactions to ransomware hits and near misses


Schuetz, Sebastian ; Chen, Yan ; Förderer, Jens ; Ma, Yusi



DOI: https://doi.org/10.25300/MISQ/2024/18509
URL: https://misq.umn.edu/does-ransomware-make-investor...
Dokumenttyp: Zeitschriftenartikel
Erscheinungsjahr Online: 2025
Titel einer Zeitschrift oder einer Reihe: MIS Quarterly
Band/Volume: tba
Heft/Issue: tba
Seitenbereich: tba
Ort der Veröffentlichung: Minneapolis, MN
Verlag: MISRC
ISSN: 2162-9730
Sprache der Veröffentlichung: Englisch
Einrichtung: Fakultät für Betriebswirtschaftslehre > Lehrstuhl Wirtschaftsinformatik II (Förderer 2025-)
Fachgebiet: 004 Informatik
Abstract: In recent years, ransomware has become one of the most dangerous cyber threats, with successful attacks causing severe operational disruptions and staggering damages. Rationally speaking, investors should react negatively to firms’ ransomware disclosures, but this may not always be the case. Based on norm theory, we describe a paradoxical phenomenon wherein investors exhibit negative reactions to ransomware hits (i.e., events that led to operational disruptions) but positive reactions to near misses (i.e., events in which operational disruptions were narrowly avoided). The positive reactions occur due to an outcome bias in which near-miss events—events that are objectively negative but less severe than expected—are viewed positively instead of negatively. We test these predictions by reporting on a novel investigation of stock market reactions to disclosures of ransomware hits vs. near misses. To do so, we assembled an unparalleled dataset of ransomware incidents disclosed by U.S. public firms. Using the event study method, we estimated abnormal stock market returns and found evidence in support of our predictions. First, in line with expectations, ransomware hits that led to the expected severe impact resulted in stock price drops of -4.40%. However, near misses, where disruptions were avoided, were rewarded with gains of 2.87%, confirming positive instead of negative reactions. This offers new insights into investors’ biased responses to certain cybersecurity incidents. These positive reactions, however, are a call for caution, because, albeit seemingly favorable, they mask underlying risks




Dieser Eintrag ist Teil der Universitätsbibliographie.

Diese Publikation ist bisher nur Online erschienen. Diese Publikation nun als "Jetzt in Print erschienen" melden.




Metadaten-Export


Zitation


+ Suche Autoren in

BASE: Schuetz, Sebastian ; Chen, Yan ; Förderer, Jens ; Ma, Yusi

Google Scholar: Schuetz, Sebastian ; Chen, Yan ; Förderer, Jens ; Ma, Yusi

ORCID: Schuetz, Sebastian ; Chen, Yan ; Förderer, Jens ORCID: 0000-0002-3090-4559 ; Ma, Yusi

+ Aufruf-Statistik

Aufrufe im letzten Jahr

Detaillierte Angaben



Sie haben einen Fehler gefunden? Teilen Sie uns Ihren Korrekturwunsch bitte hier mit: E-Mail


Actions (login required)

Eintrag anzeigen Eintrag anzeigen