Hacking Corporate Reputations

How do firms respond to the destruction of intangible capital?  Recent research has highlighted the importance of intangible capital in the economy (e.g., Corrado and Hulten, 2010; Belo et al., 2014; Crouzet and Eberly, 2018; Corhay et al., 2020; Belo et al., 2022), but there is little work on how firms respond to the destruction of intangible capital. Indeed, in The Oxford Handbook on Reputation Jonathan Karpoff lists “how and when do firms rebuild damaged reputations?” as one of six questions deserving further research attention, writing “other than … anecdotes, we do not know whether firms tend to reinvest in reputation following a reputational loss, under what conditions they do so, and whether the reinvestment is successful.”

Our research aims to fill this gap in the literature.  We ask three different questions related to the loss and potential repair of corporate reputations. First, which stakeholders respond to events that impair a firm’s reputation?  Second, which actions might a firm take to repair its reputation?  Third, do firms tailor their responses in particular situations or to cater to stakeholders that are particularly important?

While there are many different definitions of reputation in the literature, we define reputation as the set of value-relevant firm characteristics that affect stakeholders’ perceptions about the firm. Building on the seminal work about competition by Friedrich Hayek, we argue that firms compete with each other along many dimensions on the basis of their reputations, and thus, any value-relevant characteristic that firms compete over should be included when defining the firm’s reputation.  We also argue that firms can possess different reputations among different sets of stakeholders; for example, Amazon likely has different reputations with its employees and investors. Thus, understanding how stakeholders and firms respond to reputation-impairing events requires us to examine many different types of corporate stakeholders.

We focus on two distinct empirical settings: data breaches (i.e., “hacks”) and a broader set of reputation-impairing events related to negative news about a firm’s ESG performance. We study data breaches because these events arguably affect corporate reputations while being plausibly unrelated to firms’ product quality or financial condition.  In addition, the timing of data breaches is largely random, and except in rare cases, the breaches themselves do not specifically affect the quality of the products or services offered by the affected company. For example, it is hard to imagine that the 2014 data breach of employee records at Coca-Cola by a disgruntled employee would affect the taste or smell of Coca-Cola’s products.  Moreover, data breaches impact nearly all sectors of the economy and companies of every size and profile and executives frequently list firm reputation as one likely casualty of a data breach. For example, a 2016 Economist Intelligence Unit survey found that C-level executives from 16 countries and various industries listed corporate reputation as the single most important company asset requiring protection from cyberattacks. However, these events also represent a very specific notion of lost reputation.  To ensure that our results could generalize to other events that impair corporate reputation, we complement our analysis with 2,700 events compiled by RepRisk where firms experience large, negative “shocks” to their reputation. We find that stakeholders respond similarly to data breaches and these other events.

Our findings strongly support the view that firms invest to repair their reputations following negative corporate reputation shocks. We begin by studying how several value-relevant corporate stakeholders such as managers, customers, and investors respond to reputation-impairing events.  Investors respond immediately to negative reputation shocks: we find negative equity returns on the order of 1–1.5% around both data breaches and RepRisk events.  Managers also respond in the short run to such events; for example, they discuss “reputation” and other reputation-related words more frequently in their conference calls with financial analysts, compared to peer firms that did not experience such events.  Consumer perception of a firm or its brands is also impacted by data breaches—survey-measures of brand strength are lower following a data breach and “customer churn” is higher following a RepRisk event.  Moreover, various measures of media coverage become more negative after firms experience a negative shock to their reputation. For example, coverage of a firm by local media outlets becomes more negative following data breaches, and social media “buzz” around firms that suffer a RepRisk event is also higher and substantially more negative following the event.

We find that firms take a variety of actions to repair their reputation with stakeholders. As one might expect, firms seem to increase their investment in IT security following a data breach.  Specifically, firms are 12 percentage points more likely to discuss IT security in their annual reports, our proxy for IT investment. Firms also respond across a variety of margins that are not directly related to their operations.  For example, firms’ spending on charitable contributions increases by roughly $1.85 million per year relative to unaffected firms in the four years following a reputation-impairing event, and such firms are also significantly more likely to  start a charitable foundation during this period.  This increased investment in socially responsible actions translates into increased CSR scores: CSR scores increase by 0.3–0.65 standard deviations in the years following reputation-impairing events.  Political contributions also increase significantly after negative reputation shocks.  In addition, firms increase annual employee wages following data breaches by up to $1,200 (per employee), suggesting that reputation repair is often needed across multiple groups of corporate stakeholders and can be very long-lasting in nature. 

Finally, we provide evidence that firms’ responses are tailored to specific stakeholders and types of reputation-impairing events. We find that consumer-facing firms in industries such as telecommunications, travel/leisure, and broadcast media increase their CSR-related investments more strongly than other firms, consistent with theories of CSR as a product differentiation tool.  Similarly, we show that firms with major government contracts increase their political contributions more than other types of firms, and that firms increase their political contributions more sharply after events classified as “violations” of government policies and regulations. Finally, we find that firms only increase employee wages after a data breach affects employee records.  Collectively, these results suggest that firms rationally target their responses to repair reputations to prioritize particularly important stakeholders or events.

To our knowledge, our paper is among the first to present direct evidence of tangible corporate investments in intangible capital following negative corporate reputation shocks.  The burgeoning literature on CSR has largely overlooked the factors that cause firms to increase direct investment in CSR, while the growing literature on intangible capital has largely overlooked the role of CSR as an effective form of intangible investment.  By describing how firms respond to the destruction of intangible capital, our paper links these two literatures and helps to improve our understanding of the within-firm catalysts that drive intangible investment decisions. Benjamin Franklin may have been right when he said that it only takes one bad deed to lose a good reputation, but our results suggest that firms can take tangible steps to repair their intangible missteps.