Abstract:Cybersecurity is a significant concern for businesses worldwide among management, stakeholders, and regulators. In this paper, we explore the spillover effect of customer firms’ data breaches on their upstream supplier firms’ cost management strategies, proxied by cost stickiness, a prevalent resource management strategy that occurs when firms cut costs less when demand falls than they increase for an equivalent demand increase. Our primary analyses suggest that data breaches suffered by customer firms are associated with a decrease in cost stickiness among supplier firms. Furthermore, the reductions in supplier cost stickiness are stronger if suppliers are managed by CEOs from national cultural groups with high uncertainty avoidance, low long-term orientations, and/or low individualism. In additional analyses, we provide evidence that our main findings are not influenced by either supplier product market competition or data breaches experienced by suppliers. To strengthen causality, using the passage of mandatory state-level data breach notification laws as natural experiments that generates plausibly exogenous variation in data breaches, we employ a staggered difference-in-differences approach. The results reveal that the adverse effect of customer data breaches on supplier cost stickiness is diminished after these laws became effective in the states in which the breached customer firms are headquartered. Our inferences also persist when utilizing the predicted probability of data breaches derived from a two-stage regression analysis. Finally, suppliers are found to be more likely to hire cybersecurity experts on the top management team following customer data breaches, even if the suppliers themselves have not encountered any cybersecurity issues. In sum, the findings contribute to both Information Systems (IS) and Operations Management (OM) disciplines in terms of data breach, cost management strategy, and the role of national culture in OM. In particular, the findings can facilitate the management and regulation of data breaches for managers and regulators.

The Effect of Cybersecurity Legislation on Firm Cost Behavior: Evidence from China

Financial Shared Service Centers and Corporate Misconduct: Evidence from China

Exploring the Cybersecurity Spillover Effect: How Customer Data Breaches Affect Supplier Cost Management Strategies

Constructing Cybersecurity Discourse Via Deconstructing Legislation

The Effect of Mandatory CSR Disclosure on Firm Profitability and Social Externalities: Evidence from China

Increasing Burdens or Reducing Costs: Influence of Corporate Social Responsibility on Cost Stickiness

Data Policy Restrictions and Cross-border E-commerce: Evidence from China

The impact of low-carbon city policy on corporate cost stickiness

The Impact of Mandatory CSR Disclosure on the Cost of Debt Financing: Evidence from China

The Effects and Moderators of Cyber-Loafing Controls: an Empirical Study of Chinese Public Servants

A Study of Chinese Policy Attention on Cybersecurity

Security Regulations, Access to Capital Markets, and Firm Performance: Evidence from China

Corporate social responsibility, the cost of equity capital and ownership structure: An analysis of Chinese listed firms

Reducing asymmetric cost behaviors: Evidence from digital innovation

Political uncertainty and cost stickiness: evidence from prefecture-city official turnover in China

Are Costs Really Sticky and Biased? Evidence from Manufacturing Listed Companies in China

Does Access to Capital Affect Cost Stickiness? Evidence from China

To alert or alleviate? A natural experiment on the effect of anti-phishing laws on corporate IT and security investments

Cybersecurity Law and Regulation in China: Securing the Smart State

Cost Stickiness, Corporate Future Losses and Audit Costs

The hidden cost of silence: How delayed cyberattack disclosure erodes firm profitability