Research · Working paper
← Kovel QuorumMarket reaction to cyber-incident disclosure
An event study and cross-sectional analysis of public-company share-price behavior around mandatory and voluntary cyber-incident disclosures, drawn from the same corpus that powers the intelligence product. Work in preparation; the event-study results below are computed from the corpus, with each remaining analysis marked pending until produced.
Results generated 2026-06-16 · stage 1 N=97 · stage 2 N=97
Methodology
The analysis runs in two stages: an event study that measures the average market reaction to a cyber disclosure, and a cross-sectional regression that asks which disclosed characteristics move that reaction. The methods behind each follow.
Stage 1 · Event study
- Event timing
- Day 0 is the first trading session on or after each filing's EDGAR acceptance timestamp. Filings accepted after the 16:00 ET close roll to the next session; 68% of cyber 8-Ks file after hours, so this correction matters.
- Market model
- Expected return comes from regressing each issuer's daily return on the S&P 500 over a clean pre-event window of trading days −250 to −30. The abnormal return is realized minus expected; the cumulative abnormal return (CAR) sums it across the (−1,+1), (0,+3), and (0,+30) windows.
- Confounding
- Events with an earnings release (a 10-Q, 10-K, or 8-K Item 2.02) within three days are flagged, and the headline is re-estimated with those events removed.
- Inference
- Four tests run in parallel: a parametric t-test, a nonparametric sign test, the Patell standardized Z, and the Boehmer-Musumeci-Poulsen (BMP) cross-sectional test, which stays valid under event-induced volatility.
Stage 2 · Cross-section
- Specification
- On the original-disclosure sample, CAR(−1,+1) is regressed by OLS on the incident characteristics extracted from each filing: data exfiltration, disclosure basis (Item 1.05 versus voluntary 8.01), incident source, and materiality determination, with filing-year fixed effects.
- Standard errors
- Heteroskedasticity-robust (HC3), so a handful of high-variance events cannot drive the inference.
- Firm size
- Total assets as of the most-recent pre-incident period (SEC companyfacts XBRL) enter as log base 10, separating the size of the reaction from the size of the issuer.
- Reading the table
- Coefficients are percentage points of CAR. A low R-squared is expected; the question is which traits shift the average reaction, not how much variance they explain.
Sample composition
Live counts from the incident:v2 extraction set.
Form composition
Amendments (8-K/A) carry their own extraction. Event-study sample construction collapses each amendment chain to its parent 8-K as the event; that step is part of the data preparation tracked in the research README.
Of the 133 cyber-incident disclosures in the corpus, 130 are by issuers with publicly traded common stock and enter the equity event study. The remaining 3 have no tradeable share series and are excluded: Federal Home Loan Bank of New York, PROSPER MARKETPLACE, INC, Unicoin Inc..
Candidate covariates
The cross-sectional regressors, as distributed across the live incident corpus (a superset of the fitted event-study sample below). Sparse cells are themselves informative, and they cap how finely the cross-section can be cut.
Disclosure basis
Item 1.05 materiality determination vs. Item 8.01 voluntary disclosure: the central treatment variable.
Data exfiltrated
Data left the environment vs. unauthorized access alone. A candidate severity regressor.
Unauthorized access confirmed
Confirmed vs. only suspected at time of filing.
Incident source
Own systems vs. third-party vendor: vendor-origin incidents may price differently.
Operational materiality determination
Endogenous to expected market reaction; read as association, not effect (see README caveats).
DOJ 1.05(c) law-enforcement delay
Filing delayed under the Attorney-General national-security carve-out.
Market data
Results · Stage 1: Abnormal returns
Cyber-incident 8-Ks produce a significant negative market reaction. Across 97 original disclosures with a fitted market model, the cumulative abnormal return over the three-day window (−1,+1) averages -3.66%, significant under the strict cross-sectional (BMP) test and robust to excluding the 13 events with an earnings release in-window.
Each dot is one 8-K disclosure's CAR(−1,+1); 72% sit left of zero. 2 events below −25% clipped to the axis.
8-K original disclosures: market model
| Window | Mean CAR | % neg | t | BMP | p (BMP) |
|---|---|---|---|---|---|
| (-1,+1) | -3.66% | 72% | -4.16 | -4.65 | <.001 |
| (0,+3) | -3.32% | 72% | -3.54 | -3.86 | <.001 |
| (0,+30) | -4.62% | 63% | -1.72 | -1.83 | 0.068 |
8-K/A amendments: the information event is the original filing
| Window | Mean CAR | % neg | t | BMP | p (BMP) |
|---|---|---|---|---|---|
| (-1,+1) | +0.03% | 52% | 0.02 | 0.23 | 0.817 |
| (0,+3) | -1.02% | 59% | -1.22 | -1.78 | 0.075 |
| (0,+30) | -3.43% | 64% | -1.35 | -1.30 | 0.195 |
Amendments show no significant reaction at the disclosure window. By the time an incident is amended, it is already priced.
Results · Trading volume
Volume is a second reaction channel: it confirms the market processed the disclosure as information even where noisy small-cap returns are hard to read. Around the (−1,+1) window, 63% of issuers show elevated trading volume, significant under one-sided parametric and nonparametric tests and robust to confound-exclusion. The effect is modest for the median firm (relative volume near normal): a significant positive tilt, not a broad spike.
| Window | Median rel. vol | % elevated | 1-sided p | Wilcoxon p |
|---|---|---|---|---|
| (-1,+1) | 1.00x | 63% | <.001 | <.001 |
| (0,+3) | 0.97x | 62% | 0.003 | 0.004 |
| (0,+30) | 1.03x | 60% | 0.010 | 0.013 |
Abnormal volume is log share volume relative to the −250 to −30 day estimation baseline; tests are one-sided, since disclosure is expected to raise volume. Amendments show no volume reaction (63% elevated, one-sided p = 0.195), mirroring the return result.
Results · Stage 2: Cross-section
The cross-sectional variation tracks firm size, not the disclosed incident characteristics. Regressing CAR(−1,+1) on incident traits plus a size control (N=97, R²=0.109), larger issuers absorb a less-negative reaction, while exfiltration, vendor origin, materiality determination, and the Item 1.05-vs-8.01 basis are all nulls. The market prices the factof disclosure and the issuer's scale, not the legal characterization it selects. Coefficients are percentage points of CAR, HC3-robust.
| Regressor (CAR −1,+1) | Coef (pp) | Robust SE | p |
|---|---|---|---|
| Data exfiltrated | +1.21 | 1.59 | 0.447 |
| Voluntary 8.01 (vs 1.05) | -0.70 | 1.98 | 0.724 |
| Third-party / vendor origin | +2.49 | 1.56 | 0.110 |
| Materiality affirmed | +0.47 | 1.89 | 0.805 |
| Firm size (log₁₀ assets) | +1.65 | 0.68 | 0.015 ** |
Firm size is log₁₀(total assets) as of the most-recent pre-incident period, from the companyfacts panel (all 93 issuers). Low R² is expected for CAR cross-sections.
Still pending
Marked empty until computed: the working paper reports estimates, not placeholders.