Firm value and the role of CSR: evidence from the market reaction to data breach announcements

Purpose This paper investigates the “insurance-like” role of corporate social responsibility (CSR) activities in mitigating the market’s negative view of a firm’s data breach. Design/methodology/approach Using a sample of US data breaches and two major sources of CSR ratings, the authors utilize an event study framework and regression analysis to examine how breached firms’ CSR performance impacts the market’s assessment of their data breach announcements. Findings The authors find that firms with higher pre-breach CSR performance, measured using environmental, social and corporate governance (ESG) scores, experience a significantly less negative stock market reaction to data breach announcements than their counterparts with lower pre-breach CSR performance. The results suggest that CSR performance insures companies against unexpected adverse events such as information security incidents. The variations in the extent to which the market assesses CSR performance for valuation purposes should concern investors and other stakeholders. Practical implications The findings would help investors better understand public firms’ CSR performance and provide guidance on how to value firms using their non-financial performance. Originality/value This study adds to the literature on CSR performance by using data breaches to examine whether CSR activities pay off in the face of adversity.