LABScon Talk Tests Whether Public Breach Signals Can Predict Stock-Market Moves

Summary

A LABScon25 presentation examines whether public indicators of cyber breaches can anticipate market reactions, testing a “15/30” trading hypothesis with breach disclosures and time-series analysis. Results were mixed.

Key points

• The talk explores whether public signals—including regulatory filings, executive posts, and social media—can reveal breach activity before formal disclosure.
• The speakers tested a strategy of shorting a stock after a breach becomes visible, then going long as the market recovers.
• They used AI-assisted collection to build a dataset of public disclosures about material breaches at U.S. companies.
• They compared an intuition-led model with time-series analysis using a Hidden Markov Model.
• A comparison of two casino operators affected by ransomware illustrates how response, disclosure, and investor perceptions can influence market outcomes.
• The speakers report highly mixed results and question assumptions about how markets value cyber incidents.

People

Countries

Industries