Birds of a feather: intra-industry spillover of the Target customer data breach and the shielding role of IT, marketing, and CSR

The press release reporting Target Corporation’s fourth quarter 2013 results can be obtained from http://​pressroom.​target.​com/​news/​target-reports-fourth-quarter-and-full-year-2013-earnings. Target Corp. continued to incur expenses related to the data breach in subsequent quarters. For example, on August 20, 2014, the company reported incurring breach-related expenses of $148 million in the second quarter of 2014.

The full text of the interview can be found at http://​www.​cnbc.​com/​2014/​01/​13/​cnbc-exclusive-cnbc-transcript-target-chairman-ceo-gregg-steinhafel-speaks-with-becky-quick-today-on-cnbc.​html.

We also used the natural logarithm of the retailer’s sales revenue, and natural logarithm of the retailer’s number of stores at the end of 2012 (obtained from S&P Compustat’s Retail Industry-Specific Database), as alternative measures of firm size, with no significant change in our overall results.

For details of this methodology please see Hoberg and Phillips (2010), and Hoberg et al. (2014). To download firms’ TNIC product market similarity scores please see: http://​cwis.​usc.​edu/​projects/​industrydata/​industryclass.​htm.

Another option was to operationalize CSP by considering both social strengths and social concerns separately, rather than by taking their difference. We explored the robustness of our results to this alternative operationalization (Appendix 2).

We also calculated the 6-month buy-and-hold return (BHR) of our sample firms starting from December 19, 2013, the day of the Target breach announcement, and found this 6-month BHR to be statistically the same as that of a control sample of firms from other industries matched by size. While this result suggests only a short-term contagion effect of the Target breach, other firm actions after the news of the Target breach may have helped our sample firms, on average, rebound from the contagion effect of the Target breach. We consider the question of if and when a customer data breach impacts the long-term shareholder wealth of rival firms in the industry as an interesting question which requires further exploration.

One may expect the correlation between CMO presence and marketing capability to be higher than the correlation shown in Table 2, i.e., .01. However, note that marketing capability is a stock measure based on the efficiency of the firm’s marketing inputs during the years 2008–2012, while CMO presence is a point measure based on whether the CMO was present at the time of the Target breach on December 19, 2013. Thus, the years on which the marketing capability was based pre-date the year on which CMO presence was measured. Some CMOs who were present on December 19, 2013, were not present in their firms through the complete duration of 2008–2012. The presence or absence of a CMO in a retailer’s TMT at the time of the Target data breach, therefore did not necessarily influence the retailer’s marketing capability leading up to the Target breach, possibly resulting in a low correlation between CMO presence and marketing capability.

In unreported analyses, we repeated the analyses of Models 1 and 2 of Table 3, but accounted for the possibility of heteroscedasticity in error terms by employing Huber-White robust standard errors. Our results remained robust to the use of these robust standard errors.

In unreported analysis, we re-ran Model 3 of Table 3 but also included a dummy variable which took the value one if the retailer was included in the list of “Best Retail Brands” by Interbrand (a measure of strong brand equity) at least once during 2009–2013. The coefficient of this variable was positive and reached close to significance at .10 level (t = 1.47, p = .14), using OLS standard errors and became significant at .05 level if we assumed robust standard errors (t = 1.99, p = .04). Thus, contagion effects experienced around a major retail data breach may be lower for retailers with strong brands. Our overall conclusions remained robust to the inclusion of this variable in all our models. We report our results without inclusion of this dummy variable for the sake of parsimony. In addition, 9 of our 168 sample firms (5.4%) had experienced a data breach prior to the Target breach. Thus, we also re-ran Model 3 of Table 3 by including a dummy variable which took the value one if the retailer had been involved in a customer data breach prior to the Target breach. We found no significant relationship between this variable and ARs, and for the sake of parsimony do not include this superfluous variable in our analyses.

For each j = 1, 2 …, J two-digit SIC code, if there were i = 1,2,…, N_j firms in the code, the peer CIO prevalence variable for firm i was calculated as the number of firms with a CIO in code j other than firm i divided by N_{j - 1}.