Data breaches are increasingly consequential for many business organizations. How firms address data breaches has substantial ethical and societal implications. However, there is still uncertainty regarding why certain organizations experience more severe consequences than others following data breaches and what actions firms can take to minimize the negative outcomes. To answer these questions, we leverage insights from the literature on crisis communication strategies and attribution theory to predict stock market reactions. We argue that those reactions, as reflected in shareholders’ responses following a breach, depend on the nature of attributional information and are contingent upon firms’ responses and media sentiment. Analyzing a sample of 287 data breach events in 95 publicly traded US firms over a decade, we found that when shareholders attribute the data breach to internal and stable causes, the firm appears “broken,” resulting in a decline in stock market returns. However, our findings also indicate that firms’ ceremonial responses and media sentiment mitigate this negative relationship. Our discussion explores the benefits of understanding the role of crisis communication strategies and applying attribution theory within corporate-level studies. We also suggest potential avenues for future research.

对于许多商业组织来说，数据泄露的后果日益严重。公司如何解决数据泄露问题具有重大的道德和社会影响。然而，为什么某些组织在数据泄露后会比其他组织遭受更严重的后果，以及企业可以采取哪些行动来最大程度地减少负面后果，仍然存在不确定性。为了回答这些问题，我们利用危机沟通策略和归因理论文献中的见解来预测股市反应。我们认为，这些反应（如股东在违规后的反应中所反映的那样）取决于归因信息的性质，并且取决于公司的反应和媒体情绪。通过对 95 家美国上市公司 10 年来发生的 287 起数据泄露事件进行样本分析，我们发现，当股东将数据泄露归咎于内部且稳定的原因时，公司就会显得“破产”，从而导致股市回报下降。然而，我们的研究结果还表明，企业的礼仪反应和媒体情绪减轻了这种负面关系。我们的讨论探讨了理解危机沟通策略的作用以及在企业层面的研究中应用归因理论的好处。我们还建议了未来研究的潜在途径。