Data Breach Disclosure Laws and Social Responsibility Initiatives

1. Introduction

Corporate social responsibility (CSR) and environmental, social, and governance (ESG) principles have received significant attention from both academia and practitioners in recent years. Research has examined the factors that affect firms’ social responsibility initiatives, including institutional environment (El Ghoul et al., 2017; Kacperczyk, 2009; Liang & Renneboog, 2017), financial circumstances (Hong et al., 2012; Lys et al., 2015; Sun & Gunia, 2018; Xu & Kim, 2022), and risk management (Albuquerque et al., 2019; Dyck et al., 2019; Godfrey et al., 2009; Lins et al., 2017). In the meantime, the last few decades are recognized as the digital age, characterized by the rapid development of the digital economy and a substantial increase in digital assets (Baiyere et al., 2020; Loebbecke & Picot, 2015). However, it is not yet clear how social responsibility initiatives are evolving in the digitalization process.

This study investigated the influence of cybersecurity concerns on social responsibility initiatives in this digital age. With the widespread use of information and communication technologies in business practices, firms accumulate large volumes of digital assets (Hui et al., 2016; Verhoef et al., 2021), which in turn pose a challenge to cybersecurity and data breaches (Verizon, 2020). Such breaches can result in significant negative consequences, including damage to a firm’s reputation, financial losses, and legal liability (Akey et al., 2021; Garg, 2020; Gwebu et al., 2018; Huang & Wang, 2021; Kamiya et al., 2021; Romanosky et al., 2014). IBM, a leading IT industry entity, estimates that the average cost of a data breach in 2023 reached approximately USD 4.45 million.¹ Against this backdrop, previous research demonstrated that CSR activities can help generate moral capital and function as a form of insurance-like protection against negative events (Godfrey, 2005; Godfrey et al., 2009; Jia et al., 2020; Koh et al., 2014; Lins et al., 2017). Therefore, I predict that companies may engage in CSR activities to bolster their reputation and cultivate trust with stakeholders, thereby creating a buffer that can help mitigate the negative effects of future data breaches.²

To test the above prediction, I employed the staggered adoption of data breach disclosure laws across states and territories in the United States as the research setting. Given that data breaches result in negative consequences, firms tend to conceal information about such breaches (Amir et al., 2018). Data breach disclosure laws require firms to notify affected entities and local government in the event of a data breach (Ashraf & Sunder, 2023; Perkins Coie, 2020), which reduces the chance of firms hiding breach news and increases firms’ concern and awareness of cybersecurity challenges (Boasiako & Keefe, 2021).³ Therefore, I expect that firms will have stronger incentives to take precautionary actions to mitigate the negative effects of data breaches following the enactment of data breach disclosure laws. In addition, as firms are exposed to varying degrees of cybersecurity risk (Florakis et al., 2022), I posit that these laws will be especially relevant for firms with high cybersecurity risk.

However, this approach presents a dilemma. The introduction of these laws may drive firms to focus on enhancing cybersecurity and IT investments (Ashraf & Sunder, 2023), which could detract from CSR activities. Yet, I argue that CSR remains crucial for two reasons. First, given that data breaches cannot be entirely prevented (Barton, 2015), firms need to plan for effective response strategies. Second, CSR represents a distinct approach within the risk management paradigm, aiming to mitigate the impact of breaches, unlike IT investments that focus on prevention. Therefore, CSR should continue to be a key element of risk management, even alongside substantial IT investments.⁴

This study employed a difference-in-differences research design that leverages the differences in the timing of adopting data breach disclosure laws across states and the heterogeneity in firms’ exposure to cybersecurity risk. This research design essentially compares the change in CSR engagement between firms with high and low levels of cybersecurity risk in response to the adoption of data breach disclosure laws. A similar approach has been widely used in previous studies, such as those by Muehlenbachs et al. (2015) and Levine et al. (2018).

I first examined the impact of data breach disclosure laws and found that firms with high cybersecurity risk increase their CSR engagement to a greater extent than those with low risk following the adoption of such laws. These findings suggest that the improved disclosure requirements encourage firms to increase their social responsibility initiatives to alleviate the negative effects of data breaches. The cross-sectional findings provide further insight into the underlying mechanisms; CSR initiatives are more pronounced in firms that are more likely to suffer severe losses from data breaches. In addition, CSR initiatives are predominantly prominent in firms facing fewer financial constraints. I also analyzed the IT investments post-law adoption and concluded that they do not supplant CSR initiatives. The results remain robust across alternative model specifications, sample periods, and CSR measures. Moreover, an event study indicates that firms with superior CSR practices suffer less stock price impact when data breaches are publicized, underscoring CSR’s protective role. Evidence also points to firms’ concerns over the reputational damage from data breaches, highlighting the intrinsic link between cybersecurity and CSR.

This study’s findings contribute to CSR studies by highlighting the importance of cybersecurity concerns in driving firms’ engagement in CSR. Previous studies examined the factors that impact a firm’s involvement in CSR (e.g., Dyck et al., 2019; Hong et al., 2012; Kacperczyk, 2009; Sun & Gunia, 2018). However, the extent to which the digital economy and digitalization affect CSR has not been extensively explored. I address this gap by focusing on cybersecurity, which is a major challenge in the digital age (Florakis et al., 2022; Kamiya et al., 2021; Verizon, 2020). Furthermore, the magnitude of its economic impact surpasses that of most determinant factors documented in prior studies. By doing so, this study broadens the understanding on the determinants of CSR by offering a novel perspective of cybersecurity.

This study is closely related to the expanding literature on the insurance-like protection function of CSR (e.g., Bartov et al., 2021; Godfrey, 2005; Koh et al., 2014; Lins et al., 2017) and extends this literature in two ways. First, it specifically focuses on the insurance-like protection function of CSR within the domain of cybersecurity. With firms navigating digitalization strategies, cybersecurity and data breaches are becoming an increasingly pressing issue. The findings offer valuable insights for firms formulating risk management strategies in this area. This paper represents one of the pioneering efforts to examine the insurance-like role of CSR through the lens of cybersecurity. Second, while existing studies predominantly assess the insurance-like function of CSR by evaluating its effectiveness in mitigating losses from negative events, this study took a novel approach in exploring how firms proactively enhance their CSR initiatives in response to potential cybersecurity threats. These proactive initiatives are mirrored in the work of Jia et al. (2020), who found that firms invest in CSR as a safeguard against the prospect of increased short selling in the stock market.

Two concurrent studies addressed the connection between cybersecurity and CSR from different perspectives. First, Akey et al. (2021) demonstrated that firms increase their charitable donations and social performance after data breaches to restore their reputations. This research focused on firms’ postevent CSR investments. In contrast, I investigated the proactive CSR strategies that firms employ in anticipation of potential data breaches. Second, Bamiatzi et al. (2023) showed that CSR mitigates the adverse effects of data breaches on firms’ operating profitability. While Bamiatzi et al. (2023) recognized the insurance function of CSR, their analysis adhered to the classical methodology prevalent in the literature and focused on the consequences following cybersecurity incidents. My study, however, took an innovative route by examining the precautionary CSR initiatives that firms take in the context of data breach disclosure legislation.

This study also enriches the discussion on data breach disclosure laws. First, previous research examined the effects of these laws on firms’ financing activities (Ashraf & Sunder, 2023; Boasiako & Keefe, 2021), yielding mixed results. This study focused on the real effect of data breach disclosure laws as reflected in firms’ social responsibility initiatives. Second, it offers valuable insights for countries considering the implementation of cybersecurity laws. The U.S. market is distinguished by its sophisticated IT infrastructure and well-established legal system. Policymakers from other countries could gain insights from the advantages and drawbacks linked to U.S. cybersecurity legislations. Moreover, results from this study may encourage subsequent studies to assess the influence of cybersecurity laws in countries with varying institutional frameworks.

The remainder of this paper is organized as follows. Section 2 explains the development of the hypothesis. Section 3 outlines the research design. In Section 4, I present the main results and cross-sectional analyses. Section 5 is dedicated to robustness tests. The additional analyses are discussed in Section 6, and Section 7 concludes.

2. Hypothesis Development

2.1. Data breaches and their consequences

Over the past decades, various information and communication technologies, such as the internet, email, software, applications, databases, and smart devices, have been integrated into business operations (Dewett & Jones, 2001; Nolan & McFarlan, 2005; Tanriverdi & Du, 2020). This integration provides firms with competitive advantages and leads to the accumulation of digital assets, including client lists, employee information, confidential contracts, and trade secrets (Hui et al., 2016; Verhoef et al., 2021). However, it could also result in data breaches, which is one of the most pressing challenges faced by businesses globally (Verizon, 2020).

Previous research has shown that data breaches result in significant negative consequences on corporate operations. For instance, Gwebu et al. (2018), Akey et al. (2021), and Kamiya et al. (2021) showed that data breaches can result in reputational losses and reduced sales growth. Cavusoglu et al. (2004) found that stock prices significantly decrease following data breaches, leading to negative stock returns. In addition, data breaches can lead to litigation issues (Romanosky, 2016; Romanosky et al., 2014). Studies by Garg (2020), Iyer et al. (2020), and Huang & Wang (2021) demonstrated the adverse impact of data breaches on financing activities. Specifically, these impacts are reflected in high cash holdings, low corporate bond returns, and unfavorable loan contracting. Moreover, the adverse impacts of data breaches are further evidenced by rising audit fees (Li et al., 2020; Rosati et al., 2019).

2.2. Insufficient disclosure and data breach disclosure laws

Given the negative consequences of data breaches, firms often choose to conceal information about such incidents. According to Amir et al. (2018), many data breaches are initially kept secret by management and only later uncovered by outside parties. These undisclosed breaches are often linked to more severe consequences and result in a larger decline in equity value. This raises the possibility that some data breaches remain undiscovered to this day, although this cannot be confirmed.

To tackle the problem of low voluntary disclosure of data breaches, state authorities in the United States gradually introduced data breach disclosure laws (Ashraf & Sunder, 2023; Boasiako & Keefe, 2021; Perkins Coie, 2020). California was the first state to approve a data breach disclosure law in 2002, and by 2018, all states had adopted similar laws, as shown in Figure 1. These laws require firms to promptly notify relevant parties and government agencies in case of a data breach (Perkins Coie, 2020). Firms that fail to comply with this obligation can face penalties.

The adoption of data breach disclosure laws imposes regulatory costs on firms that conceal information about such breaches, thereby intensifying their concern about cybersecurity. In the absence of regulations, firms may opt to underreport or hide data breaches, particularly severe ones (Amir et al., 2018). However, the mandatory disclosure requirements compel firms to promptly report detected data breaches (Boasiako & Keefe, 2021). These requirements hold firms accountable for non-compliance and subject them to penalties if they conceal breach information. Besides fixed penalties for non-disclosure, breached firms may also face penalties for delayed notification. Given the mandatory disclosure requirements and the resulting regulatory costs for non-compliance, the adoption of data breach disclosure laws heightens firms’ awareness and concern about cybersecurity, motivating them to take actions to mitigate the potential negative impact of data breaches.

2.3. The insurance-like protection function of CSR

This study builds on the literature exploring the insurance-like protection function of CSR. Godfrey (2005) first introduced the idea that CSR acts as an insurance mechanism that helps firms build up moral capital and positive stakeholder perceptions, thereby reducing the impact of negative events. This theory is supported by the finding of Godfrey et al. (2009), who conducted an event study and found that firms engaging in CSR activities, particularly those aimed at secondary stakeholders, experience a smaller drop in shareholder value when faced with legal or regulatory actions.

This theory was further investigated in a variety of contexts. For instance, Lins et al. (2017) found that firms with better CSR records experienced a smaller decline in stock prices during the 2008–2009 global financial crisis. Koh et al. (2014) studied the insurance value of CSR for firms facing litigation risks, while Bartov et al. (2021) showed the insurance function of CSR for firms experiencing unintentional earnings restatements. Shiu & Yang (2017) explored the distinction between subsequent negative events and initial ones, while Luo et al. (2018) tackled the related moral hazard problem.

However, these studies primarily focused on the effect of established CSR in mitigating external shocks. If CSR truly serves as a type of insurance, then firms should have incentives to proactively increase their CSR engagement when they anticipate future risks or uncertainties. This prediction is supported by the research of Jia et al. (2020), who studied the impact of an unexpected increase in short selling threats due to the 2005 Regulation SHO. In their study, some firms were randomly designated as pilot firms, and their restrictions on short selling were lifted. Their results showed that pilot firms significantly enhance their CSR engagement in response to the increased short selling threats.

2.4. Hypothesis

In developing my hypothesis on how data breach disclosure laws affect firms’ social responsibility initiatives, I considered the negative consequences of data breaches, the role of data breach disclosure laws, and the insurance-like protection function of CSR. Previous studies showed that data breaches can have substantial negative impacts on firm reputation (Akey et al., 2021; Gwebu et al., 2018), sales growth (Huang & Wang, 2021), shareholder value (Kamiya et al., 2021), legal liabilities (Romanosky et al., 2014), and financing activities (Garg, 2020; Iyer et al., 2020). Given these negative consequences, firms tend to conceal information about data breaches, especially the severe ones (Amir et al., 2018). To tackle this problem, state authorities in the United States gradually approved data breach disclosure laws (Ashraf & Sunder, 2023; Perkins Coie, 2020). The adoption of data breach disclosure laws decreases the likelihood of firms concealing information about data breaches, and thus cybersecurity becomes a more prevalent concern (Boasiako & Keefe, 2021). Under this background, I expect that firms will have stronger incentives to make strategic choices to mitigate the negative effects of data breaches.

I hypothesize that firms will increase their engagement in CSR as one specific strategic choice following the enactment of data breach disclosure laws. This hypothesis is based on prior literature suggesting that CSR activities can function as an insurance-like protection mechanism (Godfrey, 2005; Godfrey et al., 2009). By increasing their commitment to CSR, firms can accumulate moral capital and build trust with stakeholders, which may help mitigate negative effects of data breaches. Furthermore, as data breaches are more relevant to firms with high cybersecurity risk (Florakis et al., 2022), such firms are anticipated to exhibit a greater increase in CSR engagement compared to those with low cybersecurity risk. This reasoning supports the use of a difference-in-differences research design to leverage the differences in the timing of adopting data breach disclosure laws across states and the variation in firms’ exposure to cybersecurity risk. In conclusion, I propose the following hypothesis:

H${}_1$: Firms increase their engagement in CSR following the enactment of data breach disclosure laws, especially if they face high cybersecurity risk.

3. Research Design

3.1. Sample development

The sample development process is outlined in Table 1, Panel A. I began with the universe of U.S. non-financial firms in Compustat during the sample period 1996–2018, which was then merged with MSCI ESG KLD STATS (hereafter referred to as KLD) to acquire CSR performance measures. Firms’ historical business addresses were collected from the header information of 10-K filings, with 1996 being the starting year of the sample period. Firms that changed their business addresses or have missing data for CSR, cybersecurity risk, or control variables were excluded from the sample. The final sample consisted of 21,727 firm-year observations from 2675 unique firms.

It should be noted that the coverage of KLD varies over the sample period. Initially, it included companies listed in the S&P 500 and KLD 400 indices, then expanded to the Russell 1000 Index in 2001 and the Russell 3000 Index in 2003. This led to a varying number of observations across years, as shown in Panel B of Table 1. In the robustness tests, I used an alternative sample period (2003–2018) that only includes the Russell 3000 firms, and the results remain similar.

3.2. Measure of social responsibility initiatives

A firm’s social responsibility initiatives were measured using its CSR score as recorded in the KLD. KLD collects information on a firm’s CSR performance from various sources, such as annual reports, corporate websites, and news articles, and it has been widely used in prior research (e.g., Albuquerque et al., 2019; Deng et al., 2013; Ioannou & Serafeim, 2015; Jia et al., 2020; Kacperczyk, 2009; Servaes & Tamayo, 2013; Zhang et al., 2020). I focused on six categories of CSR (excluding corporate governance): community, diversity, employee relations, environmental performance, human rights, and product. In recent years, institutions such as KPMG advocated for the joint analysis of cybersecurity and ESG.⁵ This could potentially reshape the future landscape of ESG metrics. It is fortuitous that, within the sample period, the KLD dataset does not include a dedicated cybersecurity category. This facilitates an independent examination of CSR initiatives alongside cybersecurity concerns.

Each category of CSR measures in the KLD includes “strengths” and “concerns” indicators. “Strengths” refer to proactive efforts to do good, while “concerns” reflect passive harmful behaviors (Ioannou & Serafeim, 2015; Kacperczyk, 2009). The “strengths” or “concerns” indicator is set to 1 if a firm is viewed as having the described positive or negative behavior by the KLD. The number of indicators for each CSR category varies among observations. To ensure comparability, I divided the number of “strengths” and “concerns” by the maximum possible number of “strengths” and “concerns” in each category, following the method used in prior studies (e.g., Albuquerque et al., 2019; Deng et al., 2013; Servaes & Tamayo, 2013). Net CSR was calculated as the difference between the scaled “strengths” and the scaled “concerns.” Net CSR was used as the main dependent variable in most of the analyses. To examine the separate roles of “strengths” and “concerns,” I calculated both the CSR Strengths score and CSR Concerns score and compared their responses to the legislative change regarding data breach disclosure. Robustness tests used the environmental and social pillar scores from the Refinitiv Asset4 ESG database as alternative measures of social responsibility initiatives, and the results remain consistent.

3.3. Measure of adopting data breach disclosure laws

The adoption of data breach disclosure laws was measured based on the security breach notification chart collected by Perkins Coie (2020). As CSR can be viewed as a precautionary strategy (Godfrey, 2005; Jia et al., 2020), I defined the adoption of data breach disclosure laws based on the years of approval rather than the years they took effect.⁶ The indicator $DiscLa{w}_{st}$ takes the value 1 if a data breach disclosure law had been approved in a firm’s headquarter state s in year t, otherwise 0, following Boasiako & Keefe (2021) and Ashraf & Sunder (2023).⁷

3.4. Measure of cybersecurity risk

The measure of a firm’s exposure to cybersecurity risk was derived from Florakis et al. (2022), who assessed the exposure by comparing a firm’s disclosure of cybersecurity risk factors in the item 1A section of 10-K filings with those by firms that experienced data breaches. A firm’s exposure to cybersecurity risk was determined by the linguistic similarity — that is, the extent of overlap in word vectors — between the firm’s cybersecurity risk factors disclosure and that of breached firms, with a higher similarity indicating a greater risk exposure.⁸ Florakis et al. (2022) showed that this intuitive and straightforward measure can predict the occurrence of future data breaches. This method based on linguistic similarity has been extensively used in other studies. For example, Hoberg & Phillips (2010) and Hoberg et al. (2014) investigated firms’ textual similarity in product descriptions in 10-K filings.

The cybersecurity risk measure provided by Florakis et al. (2022) is available only for the period spanning 2007–2018, owing to data limitations. Despite this constraint, I assert that a firm’s exposure to cybersecurity risk is primarily influenced by its operational practices and technological infrastructure. This assertion finds support in Florakis et al. (2022) research, which illustrated that firms heavily reliant on information technology are more likely to encounter a high level of cybersecurity risk, whereas traditional firms typically exhibit lower vulnerability. Consequently, even though this measure of cybersecurity risk may experience variations over time, its cross-sectional disparities should remain relatively stable. To account for this, I averaged each firm’s cybersecurity risk measure over the period 2007–2018, which yielded a measure with cross-sectional variation but no time-series variation. This measure was employed as the firm-specific cybersecurity risk measure for the sample period from 1996 to 2018. I acknowledge the limitations of this approach, and hence in the robustness tests, the years 2007–2018 were used as an alternative sample period. Although the variation in the adoption of data breach disclosure laws is substantially reduced in this shortened sample period, the results remain similar.⁹

An indicator variable for high-level cybersecurity risk, Cybersecurity Risk, was defined based on the above firm-specific cybersecurity risk measure. The sample median was used as the threshold for high-level cybersecurity risk. Cybersecurity Risk takes the value 1 if a firm is exposed to high-level cybersecurity risk, 0 otherwise; this variable was used in the main analysis. Untabulated robustness tests (a) defined high-level cybersecurity risk based on the top tertile and top quartile and (b) used a continuous measure of cybersecurity risk; the results remain consistent.

3.5. Model specification

The research design employed a difference-in-differences approach, taking advantage of the year variation in the adoption of data breach disclosure laws across states and the difference in firms’ exposure to cybersecurity risk. The model specification is as follows :

The dependent variable ${\mathrm{\text{CSR}}}_{it}$ represents firm i’s social responsibility initiatives in year t, and it is proxied by the Net CSR score in KLD. The coefficient of interest ${\beta }_1$ measures the impact of data breach disclosure laws on CSR, conditional on a firm’s exposure to cybersecurity risk. The model incorporates firm fixed effects ${\alpha }_i$ and state-year fixed effects ${\alpha }_{st}$ to account for time-invariant firm-specific factors, time trends, and the state-year-level variation.¹⁰ For instance, internet and digital assets have been increasingly popular over time, and this macro trend can be captured by the year element in state-year fixed effects ${\alpha }_{st}$. The level effects of $DiscLa{w}_{st}$ and $CybersecurityRis{k}_i$ are subsumed by state-year fixed effects ${\alpha }_{st}$ and firm fixed effects ${\alpha }_i$, respectively. In addition, the model includes a set of time-varying firm characteristics $X_{it}$ to further account for factors that may affect firms’ social responsibility initiatives. The detailed variable definitions are described in Appendix A.

3.6. Summary statistics

Table 2 presents summary statistics for the main variables. The mean of the dependent variable, Net CSR score, is 0.029, with a standard deviation of 0.124. CSR Strengths and CSR Concerns, which make up the Net CSR score, have means of 0.075 and 0.046, respectively. The variable Disc Law has a mean of 0.740, which indicates that data breach disclosure laws were adopted in 74% of the observations. The continuous Cybersecurity Risk measure has a mean of 0.252 and a standard deviation of 0.146.

4. Main Results

4.1. Data breach disclosure laws and CSR

Before delving into the main analysis, a univariate assessment was conducted to directly evaluate the impact of data breach disclosure laws across different groups. The results are reported in Appendix B. In the low Cybersecurity Risk group, CSR performance increased by 0.029 (from −0.014 to 0.015). In the high Cybersecurity Risk group, CSR performance experienced a more substantial increase of 0.055 (from 0.008 to 0.063). The magnitude of increase in the high-risk group is 0.026 greater than that observed in the low-risk group, which provides preliminary evidence to support my prediction.

Moving forward, the main regression analysis yielded the following results, as presented in Table 3. Column 1 corresponds to the main analysis based on regression equation (1) with firm fixed effects and state-year fixed effects. The coefficient for Disc Law×Cybersecurity Risk is 0.026, which is statistically significant at the 1% level. These findings align with the hypothesis and suggest that firms facing high cybersecurity risk exhibit a greater increase in their engagement with CSR compared to those with low cybersecurity risk when data breach disclosure laws are in place. Notably, the magnitude of the coefficient 0.026 in Column 1 represents 21% ($=0.026$/0.124) of the standard deviation of Net CSR, underscoring its economic significance.

To ensure robustness, Columns 2 and 3 exclude state-year fixed effects and firm fixed effects in a stepwise manner. The coefficient estimates for Disc Law × Cybersecurity Risk remain quantitatively similar in both columns.¹¹ Moreover, the coefficient estimates for Disc Law are 0.016 (Column 2) and 0.025 (Column 3), both statistically significant at the 1% level. This supports the first part of the hypothesis: firms’ engagement with CSR increases overall following the enactment of data breach disclosure laws.

I further evaluated the impact of cybersecurity on CSR relative to other determinants documented in the literature. A shift of one standard deviation in the independent variable Disc Law × Cybersecurity Risk corresponds to a 10.19% increase in CSR, calculated as $0.026\times 0.486$/0.124.¹² This magnitude surpasses those of most factors identified in prior studies. For instance, Dyck et al. (2019) results implied a 0.80% change in the social score and a 1.50% change in the environmental score. Comparable studies by Xu & Kim (2022), Hong et al. (2012), Sun & Gunia (2018), and Kacperczyk (2009) indicated changes of 0.76%, 5.74%, 9.44%, and 39.43%, respectively.¹³ The calculation of these economic magnitudes is detailed in Appendix C.

Table 4, Panel A, compares the two components of Net CSR, namely, CSR Strengths and CSR Concerns. The coefficient when regressing on CSR Strengths is statistically significant, and the coefficient estimate 0.029 represents 25% ($=0.029$/0.118) of the standard deviation of CSR Strengths. On the other hand, when regressing on CSR Concerns, the coefficient 0.001 is not statistically significant. This suggests that the improvement in CSR engagement after adopting data breach disclosure laws is primarily driven by firms’ proactive efforts to do good rather than a passive approach of avoiding harm.

Panel B of Table 4 provides a further analysis on each category of CSR. Out of the six categories, only the Human Rights category showed an insignificant result. This suggests that firms primarily focus on five categories of CSR: community, diversity, employee relations, environmental performance, and product. This aligns with previous studies, such as Jiao (2010) and Zhang et al. (2020), which excluded Human Rights when measuring the CSR performance. In a supplementary analysis, a dependent variable based on the above five categories of CSR was used, yielding similar results.

4.2. Mechanism analysis: The role of firms’ potential losses from data breaches

I explored the moderating effect of firms’ potential losses from data breaches, offering insight into the mechanism that drives their social responsibility initiatives. H${}_1$ posits that firms engage in CSR as a means to mitigate the adverse impact of data breaches. Consequently, if this holds true, I anticipated that firms facing the prospect of more substantial losses from such breaches would have stronger incentives to embrace CSR, thereby offsetting potential future losses.

I measured a firm’s potential losses from data breaches based on the extent of proprietary information it processes, which has been suggested to make firms more vulnerable to data breaches (Ettredge et al., 2018; Hughes et al., 2023). To measure the extent of proprietary information processing, I used two proxies: (a) Profit Margin and (b) Research and Development (R&D) Intensity. High profit margins are usually viewed as a signal of proprietary information (Huang et al., 2017), while R&D activities directly contribute to the accumulation of proprietary information and competitive advantages (André et al., 2016; Ellis et al., 2012). Profit Margin was measured as income before extraordinary items, divided by sales revenue, and R&D Intensity as R&D expenses divided by sales revenue. Firms with high Profit Margin or high R&D Intensity are likely to incur greater losses from data breaches.

Table 5 presents the results. For firms with a high Profit Margin (Column 2), the coefficient of Disc Law × Cybersecurity Risk is 0.035 and is statistically significant at the 1% level. In contrast, the coefficient in the subsample with low Profit Margin (Column 1) is 0.016 and is only statistically significant at the 10% level, indicating a weaker relationship. The one-tailed Wald test suggests that the coefficient in Column 2 is significantly larger than that in Column 1. The same pattern is observed in Columns 3–4, where the coefficient of 0.046 in the subsample with high R&D Intensity in Column 4 is significantly greater than the coefficient of 0.013 in the subsample of low R&D Intensity in Column 3. These results indicate that the potential losses from data breaches serve as a motivation for firms to engage in more CSR activities, thus confirming the mechanism outlined in the hypothesis development.

4.3. The role of firms’ financial constraints

Next, the influence of financial constraints on firms’ CSR initiatives following the disclosure laws was investigated. Previous research suggested that limited financial resources can impede a firm’s involvement in CSR (Hong et al., 2012; Sun & Gunia, 2018; Xu & Kim, 2022). Consistent with this literature, I anticipated that, in this study’s context, a firm’s financial situation may constrain its incentive to invest in CSR after the enactment of data breach disclosure laws.

To test this prediction, I employed two measures of financial constraints: (a) the Kaplan–Zingales Index (Kaplan & Zingales, 1997) and (b) the Size–Age Index (Hadlock & Pierce, 2010). Firms with a low Kaplan–Zingales Index or a low Size–Age Index are generally viewed as having greater financial resources and thus fewer financial constraints.

The results are reported in Table 6. In the subsample with a low Kaplan–Zingales Index in Column 2, the coefficient of Disc Law × Cybersecurity Risk is 0.031. This coefficient is significantly greater than the coefficient 0.013 in the subsample with a high Kaplan–Zingales Index in Column 1, as confirmed by the one-tailed Wald test. The same pattern is observed in the cross-sectional analysis of Size–Age Index in Columns 3–4. These results suggest that firms with greater financial resources are more inclined to respond to the adoption of data breach disclosure laws by increasing their engagement in CSR.

4.4. IT investments versus CSR initiatives

Finally, I explored the potential impact of data breach disclosure laws on IT investments and their subsequent effects on CSR initiatives. The adoption of data breach disclosure laws may serve as a catalyst for firms to reevaluate their IT capabilities and prevent cybersecurity incidents. However, the extent of this impact is unclear. Moreover, IT investments might potentially influence a firm’s CSR initiatives. When firms allocate resources to enhance their IT capabilities, it signals a commitment to cybersecurity. In this process, firms may intensify CSR efforts as well. However, on the other hand, substantial IT improvements might make extensive CSR initiatives redundant, potentially leading to reduced CSR engagement. Hence, it is unclear whether CSR initiatives can be replaced by IT investments.

To test the above conjecture, I utilized proxies for IT investments, specifically focusing on the presence of IT officers or board-level technology committees.¹⁴ These practices are recognized as effective mechanisms to manage IT resources (Ashraf & Sunder, 2023; Banker & Feng, 2019; Higgs et al., 2016; Huang & Wang, 2021). Given that financial commitments to cybersecurity investments are not publicly disclosed, IT investments were inferred based on the adoption of the aforementioned IT-related practices.

Table 7, Panel A, reveals an increase in both the appointments of IT officers and the formation of technology committees following the enactment of data breach disclosure laws. This trend suggests that firms proactively invested in IT resources to address growing cybersecurity concerns. Nonetheless, despite these investments, the firm-year-level Cybersecurity Risk remains unchanged. This finding highlights the limitations of IT investments in mitigating the likelihood of data breaches. Additionally, it underscores the relative independence between the variable Disc Law and Cybersecurity Risk in the research design.

Panel B examines the subsequent effects on CSR initiatives. The sample was partitioned based on the presence of IT officers and technology committees. Firms with IT officers, in Column 2, exhibit a coefficient estimate of 0.144 for Disc Law × Cybersecurity Risk. In contrast, this coefficient is 0.025 for the firms without IT officers, as shown in Column 1. Both coefficients are statistically significant at the 1% level. Similarly, in Column 4, firms with technology committees demonstrated a coefficient of 0.165, while it is 0.026 for firms without technology committees in Column 3. Both coefficients remain statistically significant.

These results suggest that IT investments and CSR initiatives are distinct strategies for managing cybersecurity risk. Even when firms make substantial IT investments, their motivation to engage in CSR remains high. Although the relatively small sample size of firms with IT officers or technology committees may limit the statistical power of the tests, the overall pattern remains consistent.¹⁵ In summary, these findings indicate that firms recognize the importance of both IT investments and CSR. Importantly, CSR initiatives cannot be substituted by IT investments when managing cybersecurity risks.

5. Robustness Tests

5.1. Alternative model specifications

Two alternative model specifications were employed to ensure the robustness of the results. First, Akey et al. (2021) and Bamiatzi et al. (2023) found that following data breaches, firms tend to increase their engagement in CSR to repair their reputations. In this context, the occurrence of data breaches could potentially be a correlated omitted variable that might bias the estimations. To address this concern, observations from firms that experienced data breaches were excluded. As shown in Table 8, Panel A (Column 1), the results remain robust, with a coefficient of 0.023 for Disc Law × Cybersecurity Risk, which is quantitatively similar and statistically significant at the 1% level.

Second, in the staggered adoption of laws across states, groups previously designated as treatment may later become control (Baker et al., 2022). To address this concern, I employed the method proposed by Cengiz et al. (2019) and utilized a stacked sample. Specifically, for each state that adopts a data breach disclosure law in year t, a state that never adopted the laws within a 10-year window (from $t-5$ to $t+4$) was used as its control group, and then cohorts were stacked based on relative years. The results in Column 2 of Panel A show that the coefficient of Disc Law × Cybersecurity Risk remains of similar magnitude and statistically significant at the 1% level. This suggests that the findings are robust to the stacked sample specification.

5.2. Alternative sample periods

Robustness tests were conducted using two alternative sample periods. First, as noted in Panel B of Table 1, the coverage of KLD expanded to the Russell 3000 index in 2003; thus, 2003–2018 was used as an alternative sample period. The results in Panel B (Column 1) in Table 8 show that the coefficient of Disc Law × Cybersecurity Risk is 0.023 and statistically significant at the 1% level.

Second, the original calculation of the cybersecurity risk measure by Florakis et al. (2022) was done for the period from 2007 to 2018. Therefore, 2007–2018 was used as another alternative sample period. As reported in Column 2 of Panel B in Table 8, the coefficient of Disc Law × Cybersecurity Risk remains similar and statistically significant at the 5% level. This supports the approach of extending the use of the cybersecurity risk measure to a longer sample period.

5.3. Alternative measures of CSR

ESG scores from the Refinitiv Asset4 were used as alternative measures of CSR to address the concern regarding the disagreement of CSR measures (Christensen et al., 2022; Radhakrishnan et al., 2018). Asset4 is another database specializing in ESG ratings and has been widely utilized in prior studies, particularly those based on an international setting, such as Feng et al. (2015), El Ghoul et al. (2017), Liang & Renneboog (2017), and Dyck et al. (2019). Its U.S. version commenced data collection in 2002 and encompasses Russell 1000 firms in the United States, yielding 8723 firm-year observations during the period of 2002–2018. Consistent with previous literature, three measures were employed: the average environmental and social pillar score (ES Score), the environmental pillar score (Environmental), and the social pillar score (Social). As detailed in Panel C of Table 8, all three coefficients are statistically significant, and the results remain robust across these three measures.

5.4. Validating the parallel trend assumption

The validity of the parallel trend assumption was assessed following the methodology proposed by Bertrand & Mullainathan (2003). Specifically, indicators were incorporated corresponding to the years relative to the approval year of data breach disclosure laws. These indicators were then interacted with the measure of cybersecurity risk. As indicated in Table 9, prior to the enactment of these laws, there was no significant difference in CSR performance between firms with high and low levels of cybersecurity risk. This finding aligns with the parallel trend assumption.

5.5. Addressing the concern of legal adoption in subsidiaries

Lastly, this study examined the issue of legal adoption within a firm’s subsidiary states. Some firms operate beyond their headquarters, exposing them to data breach disclosure laws even before their home state enacts such legislation. To address this concern, I introduced the variable Disc Law Sub, which serves as an indicator of data breach disclosure law adoption in a firm’s subsidiary states. The subsidiary information was collected from Exhibit 21 of the firm’s 10-K filing. Given that a firm’s subsidiaries may span multiple states and Disc Law Sub cannot be subsumed by state-year fixed effects, Disc Law Sub× Cybersecurity Risk and Disc Law Sub were included in the regression. The results, presented in Table 10, reveal the following: First, the coefficients of Disc Law Sub× Cybersecurity Risk and Disc Law Sub are not statistically significant. This suggests that the adoption of laws in subsidiary states does not impact firms’ CSR initiatives. Second, the coefficient for Disc Law× Cybersecurity Risk is 0.028, which is statistically significant at the 1% level. This coefficient aligns quantitatively with the main analysis, reinforcing the robustness of the findings even when accounting for firms’ subsidiaries.

6. Additional Analyses

6.1. The role of CSR in mitigating stock price declines after data breaches

I conducted an event study to demonstrate that CSR performance helps mitigate the stock price declines after data breaches. Prior studies showed that announcements of a data breach incident lead to a decrease in the firm’s stock price (Cavusoglu et al., 2004; Kamiya et al., 2021). If CSR performance serves as an insurance-like protection against data breaches, it should help mitigate the decrease in stock price.¹⁶ To test this prediction, I first calculated the cumulative abnormal returns (CAR) for firms surrounding data breach announcements and then compared the CARs between firms with high and low levels of CSR performance.

The results are reported in Table 11. Panel A outlines the sample creation process. Data breach announcements were obtained from the Privacy Rights Clearinghouse spanning from 2005 to 2018. By cross-referencing these with Compustat, 1016 data breaches involving U.S. public firms were identified. After removing observations not covered by both CRSP and KLD, 413 data breaches remained in the final sample. Panel B demonstrates that CARs surrounding data breach announcements are significantly negative, corroborating prior literature and underscoring the adverse impact of data breaches on stock prices.¹⁷ Panel C contrasts the CARs between firms with high and low CSR performance. The findings reveal that firms with high Net CSR experience a smaller decline in stock prices. This bolsters the argument that CSR functions as an insurance-like protection against data breaches. A closer look at the two components of Net CSR (i.e., CSR Strengths and CSR Concerns) indicates that the safeguarding effect primarily stems from firms’ proactive endeavors, as captured by CSR Strengths. Conversely, the CARs in firms with high and low levels of CSR Concerns do not exhibit a significant difference.

6.2. Firms’ concern about the reputational impact of data breaches

The link between cybersecurity and CSR initiatives was further examined by drawing insights from textual discussions found in risk factor disclosures in item 1A of Form 10-K filings. My primary objective was to identify narratives in which firms assert their CSR efforts aim to alleviate the negative consequences of potential data breaches. However, risk factor disclosures typically focus solely on the risks faced by firms, rarely addressing countermeasures. Thus, inspired by the research of Gwebu et al. (2018) and Akey et al. (2021), I explored the extent to which firms anticipate that a potential data breach will impact their reputation. Akey et al. (2021) proposed that firms engage in CSR after a data breach to rebuild their reputation. Therefore, if a firm expresses concern about reputational damage resulting from potential data breaches, it signals an inclination toward proactive CSR initiatives.

I manually reviewed risk factor disclosures from the top 10 firms with the highest level of cybersecurity risk. Remarkably, all these firms acknowledge the reputational harm caused by potential data breaches. The pertinent narratives are cataloged in Appendix D. For example, Town Sports International Holdings’ fiscal year 2010 filing explicitly states: “Any compromise of our security could harm our reputation or financial condition and, therefore, our business.” These findings underscore a direct link between cybersecurity, reputational concerns, and CSR initiatives.

7. Conclusions

This study investigated how firms employ CSR activities as a precautionary strategy to address increased cybersecurity concerns after the enactment of data breach disclosure laws in the United States. As the laws improve the disclosure of data breach incidents and increase the attention toward cybersecurity, I expect that firms will have stronger incentives to take precautionary actions to mitigate the negative effects of data breaches. The analyses show that following the enactment of data breach disclosure laws, firms with high cybersecurity risk increase their CSR engagement to a greater extent than those with low risk. This improvement is mainly attributed to firms’ proactive efforts to do good rather than a passive approach of avoiding harm. These findings suggest that data breach disclosure laws encourage firms to engage in more precautionary CSR activities. The results are more pronounced for firms that are likely to encounter substantial losses from data breaches and those with fewer financial constraints. The event study analysis confirmed that better CSR performance alleviates the stock price decline surrounding data breach announcements. This study also highlights firms’ concern about the reputational damage resulting from potential data breaches, as elaborated in their risk factor disclosures, thus signaling firms’ inclination to engage in CSR. Collectively, this study demonstrated that the concern for cybersecurity serves as a significant driver force for social responsibility initiatives in this digital age.

In addition to its contribution to academic research, this study offers valuable insights for practitioners and policymakers. First, the findings underscored an additional benefit of strong CSR performance in the face of cybersecurity challenges, offering additional motivation for firms to actively engage in CSR and ESG activities. Second, the results revealed an unintended positive impact of data breach disclosure laws on CSR in the United States. This suggests that the heightened requirements surrounding data breach disclosure not only enhance firms’ operational transparency but also increase the well-being of stakeholders. Consequently, this study supports the argument for strengthening data breach disclosure regulations globally. However, it is important to consider the specific institutional context when exploring this research question in different country settings.

Acknowledgments

I am grateful to Kirstin Becker, Melanie Feldhues, Sumair Hussain, Fatma Jemaa, Bjørn N. Jørgensen, Weizhi Meng, Luc Paugam, Thomas Plenborg, Thomas Poulsen, Dario Pozzoli, Gabriel Priess, Kasper Regenburg, Grazia Santangelo, Ole Vagn Sørensen, Tao Tang, Steen Thomsen, Wenjun Wen, Liandong Zhang, and the participants of the CBS Workshop on Quantitative Approaches to Green Transitions Research, as well as the seminars at Copenhagen Business School and Technical University of Denmark, for their valuable comments. I also acknowledge the financial support from Copenhagen Business School and the National Social Science Foundation of China (#22BJY254). The standard disclaimer applies.

Notes

ORCID

Yanlei Zhang  https://orcid.org/0000-0003-1580-4813