January 20th 2009 was an important date. It was the inauguration of America’s first black president, Barack Obama. It was also the day on which Heartland Payment Systems announced that its systems had been breached. Critics accused Heartland of using the auspicious date to try and bury bad news*.
But if that was the US-based payment processing firm’s intention, it failed. Within days of the announcement, Heartland’s share price fell by 50% and continued its sharp descent into early March 2009, losing 78% of its pre-breach value at its lowest ebb.
Even when sensitive data are not stolen, a data breach can have an impact on share price, as Sony learned after its European subsidiary’s websites were breached in June 2011. The data that were stolen were already in the public domain, but that did not stop 2% being knocked off the firm’s share price^.
Although data breaches are common, protecting data is important if an organisation wishes to maintain the trust of its customers, investors and other stakeholders. If a data breach breaks this trust, it can have a significant impact on share price, says Abbott Martin, senior director at Corporate Executive Board (CEB), a business advisory fi rm. But Mr Martin admits that the impact of an incident on share price is “difficult to quantify”.
One lesson that can be learned from the Heartland incident is that being open about a data breach is not detrimental in the long run. Heartland’s chief executive, Robert Carr, tried to be as open as possible about the breach and encouraged other firms to share information about cyber-attacks. He also cofounded the Payments Processing Information Sharing Council (PPISC), an organisation that encourages firms in the payments industry to exchange relevant information.
If Heartland’s share price took a plunge after the breach announcement, it has certainly rallied since then. On March 9th 2009, less than two months after the event, Heartland’s share price opened trading at US$3.98. By 2013 its shares were trading at more than ten times that value.