The Financial and Societal Costs of Institutional Data Breaches: Evidence from Government and Hospital Breaches

Author

Banks N. Osborne, University of Tennessee, KnoxvilleFollow

Date of Award

5-2025

Degree Type

Dissertation

Degree Name

Doctor of Philosophy

Major

Business Administration

Major Professor

Matthew A. Serfling

Committee Members

Zihan Ye, Larry Fauver, Daniel Pienta

Abstract

This dissertation examines how the effects of data breaches on governments and hospitals spill over to their stakeholders. The first chapter specifically considers the financial and societal costs of hacks on county governments. Using primary municipal bond market data, I find that hacks increase the cost of government debt and identify three mechanisms through which breaches influence investors’ risk premium. Following a hack, county governments suffer lower credit ratings and decreased revenues. Hacked governments also cut social and infrastructure spending, which I argue increases their reputation risk and dampens their long-run economic competitiveness. Overall, these results in the first chapter suggest that data breaches harm municipalities both financially and socially.

In the second chapter, I exploit a unique aspect of HIPAA to examine how medical data breaches affect hospital financing costs and influence both hospital and patient health. As in the first chapter, I find that data breaches increase hospitals’ cost of financing in primary municipal bond markets and increase hospitals’ credit risk. However, investors seem to ignore hacks, the worst events, when pricing new bonds after a hospital announces a hack. This is surprising given that I find only hacks harm hospital cash flows and patient health. The mispricing of hacked bonds contrasts what would be expected given both theory and previous empirical evidence in the corporate finance literature. Furthermore, I find that cyber risk premium in municipal healthcare bonds exists only when investor attention is already heightened due to public awareness on cyber risk. Altogether, the results in my second chapter show that investors are not fully informed regarding how medical data breaches should influence local borrowing costs and, inadvertently, require higher premiums than necessary for some healthcare bonds and lower premiums than necessary for others.

Recommended Citation

Osborne, Banks N., "The Financial and Societal Costs of Institutional Data Breaches: Evidence from Government and Hospital Breaches. " PhD diss., University of Tennessee, 2025.
https://trace.tennessee.edu/utk_graddiss/12400