My thesis consists of two distinct, but related, essays on the consequences of data breaches. Chapter 1 presents the literature review on data breaches. While the first essay (Chapter 2) focuses on the impact of data breaches on managers’ voluntary disclosure behaviors, the second essay (Chapter 3) focuses its impact on credit risk perceived by CDS market participants. Specifically, Chapter 2 examines whether, and if so, how data breaches influence management earnings forecasts. Data breaches are normally associated with information leakage, tight regulatory oversight, and shareholders’ concerns on corporate governance and firm values. These negative consequences increase firm litigation exposure and therefore predict less optimistic earnings forecasts from breached firms in the post-breach periods. Using a difference-in-differences estimation, I find a reduction in earnings forecasts optimism bias after data breaches. Results from path analysis further suggest that the data breaches affect corporate disclosure through precipitated breached litigation. The cross-sectional analyses show that the reduction of the optimism bias is more salient for firms with higher ex-ante litigation risk, those reporting negative earnings, and with higher visibility, which corroborates the litigation concern view. Further analysis suggests the result is more salient when the loss from data breaches is severe, e.g., when the data breaches involve a large number of records leakages; trigger the negative market reaction and cause financial information loss. Moreover, the reduction of optimism bias is more salient for managers located in the lower social norm regions. Finally, I find that the breached firms exhibit less positive tone and increase risk factor disclosure in their 10K/Q filings in the post-breach periods. My main findings are robust to a battery of robustness tests.

Chapter 3 examines the relation between reported data breaches and the pricing of credit risk. Given that data breaches trigger volatile earnings, customer loss, business termination, and signal financial reporting deficiency, I predict breached firms are more likely to default on their debts and are subject to higher information risk. Accordingly, credit default spreads of breached firms will increase following data breaches. In cross-sectional analyses, I further document that the effect of data breaches is more pronounced when firms with higher leverage, firms with higher revenue loss, which could imply that the CDS traders charge the default risk premium. The effect of data breaches is more pronounced when firms with more volatile stock returns, more dispersed analyst forecasts, which could imply that the CDS markets charge the information risk premium. Further analyzes suggest that an effective internal control system could moderate the CDS traders’ negative perception on the breached firms.