{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,28]],"date-time":"2026-07-28T18:41:36Z","timestamp":1785264096968,"version":"3.55.0"},"reference-count":45,"publisher":"MIS Quarterly","issue":"1","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025,3,1]]},"abstract":"<jats:p>Given the rise in the frequency and cost of data security threats, it is critical to understand whether and how companies strategically adapt their operational workforce in response to data breaches. We study hiring in the aftermath of data breaches by combining information on data breach events with detailed firm-level job posting data. Using a staggered difference-in-differences approach, we show that breached firms significantly increase their demand for cybersecurity workers. Furthermore, firms\u2019 responses to data breaches extend to promptly recruiting public relations personnel\u2014an act aimed at managing trust and alleviating negative publicity\u2014often ahead of cybersecurity hires. Following a breach, the likelihood of firms posting a cybersecurity job rises by approximately two percentage points, which translates to an average willingness to spend an additional $61,961 in annual wages on cybersecurity, public relations, and legal workers. While these hiring adjustments are small for affected firms, they represent a large potential impact of over $300 million on the overall economy. Our findings underscore the vital role of human capital investments in shaping firms\u2019 cyber defenses and provide a valuable roadmap for managers and firms navigating cyberthreats in an increasingly digital age.<\/jats:p>","DOI":"10.25300\/misq\/2024\/18352","type":"journal-article","created":{"date-parts":[[2024,8,7]],"date-time":"2024-08-07T15:42:31Z","timestamp":1723045351000},"page":"367-388","source":"Crossref","is-referenced-by-count":5,"title":["Human Capital Acquisition in Response to Data Breaches"],"prefix":"10.25300","volume":"49","author":[{"given":"Sarah H.","family":"Bana","sequence":"first","affiliation":[{"name":"George L. Argyros College of Business and Economics, Chapman University, Orange, CA, and Stanford Digital Economy Lab, Stanford University, Stanford, CA, U.S.A."}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Erik","family":"Brynjolfsson","sequence":"additional","affiliation":[{"name":"Stanford Digital Economy Lab, Stanford University, Stanford, CA, and National Bureau of Economic Research, Cambridge, MA, U.S.A."}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wang","family":"Jin","sequence":"additional","affiliation":[{"name":"Stanford Digital Economy Lab, Stanford University, Stanford, CA, U.S.A."}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sebastian","family":"Steffen","sequence":"additional","affiliation":[{"name":"Department of Business Analytics, Carroll School of Management, Boston College, Chestnut Hill, MA, and Stanford Digital Economy Lab, Stanford University, Stanford, CA U.S.A."}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiupeng","family":"Wang","sequence":"additional","affiliation":[{"name":"D\u2019Amore-McKim School of Business, Northeastern University, Boston, MA, and Stanford Digital Economy Lab, Stanford University, Stanford, CA, U.S.A."}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"10933","published-online":{"date-parts":[[2025,3,1]]},"reference":[{"issue":"1","key":"2025082211030210300_b1-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1093\/qje\/qjac038","article-title":"When should you adjust standard errors for clustering?","volume":"138","author":"Abadie","year":"2023","journal-title":"The Quarterly Journal of Economics"},{"key":"2025082211030210300_b2-14_rn_10_25300_misq_2024_18352","unstructured":"Acquisti, A., Friedman, A., & Telang, R. (2006). Is there a cost to privacy breaches? An event study. In Proceedings of the International Conference on Information Systems. https:\/\/aisel.aisnet.org\/icis2006\/94"},{"key":"2025082211030210300_b3-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","DOI":"10.2139\/ssrn.3143740","volume-title":"Hacking corporate reputations (Rotman School of Management working paper)","author":"Akey","year":"2023"},{"issue":"2","key":"2025082211030210300_b4-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","first-page":"1","DOI":"10.2308\/TAR-2019-1033","article-title":"The role of peer events in corporate governance: Evidence from data breaches","volume":"97","author":"Ashraf","year":"2022","journal-title":"The Accounting Review"},{"key":"2025082211030210300_b5-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","DOI":"10.3386\/w23488","article-title":"The digital privacy paradox: small money, small costs, small talk","author":"Athey","year":"2017","journal-title":"National Bureau of Economic Research"},{"key":"2025082211030210300_b6-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","DOI":"10.2139\/ssrn.3616893","volume-title":"The future of work: Work from home preparedness and firm resilience during the COVID-19 pandemic","author":"Bai","year":"2020"},{"key":"2025082211030210300_b7-14_rn_10_25300_misq_2024_18352","unstructured":"Bana, S., Brynjolfsson, E., Rock, D., & Steffen, S. (2023). work2vec: Measuring the Latent Structure of the Labor Market. In Proceedings of the American Economic Association Annual Meeting. https:\/\/www.aeaweb.org\/conference\/2023\/program\/1310"},{"issue":"3","key":"2025082211030210300_b8-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","first-page":"309","DOI":"10.2308\/isys-52532","article-title":"The impact of information security breach incidents on CIO turnover","volume":"33","author":"Banker","year":"2019","journal-title":"Journal of Information Systems"},{"key":"2025082211030210300_b9-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","DOI":"10.3386\/w31984","article-title":"Online job posts contain very little wage information","author":"Batra","year":"2023","journal-title":"National Bureau of Economic Research"},{"issue":"3","key":"2025082211030210300_b10-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","first-page":"729","DOI":"10.25300\/MISQ\/2017\/41.3.04","article-title":"Operational IT failures, IT value destruction, and board-level IT governance changes","volume":"41","author":"Benaroch","year":"2017","journal-title":"MIS Quarterly"},{"issue":"1","key":"2025082211030210300_b11-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","first-page":"249","DOI":"10.1162\/003355304772839588","article-title":"How Much Should We Trust Differences-In-Differences Estimates?","volume":"119","author":"Bertrand","year":"2004","journal-title":"The Quarterly Journal of Economics"},{"issue":"1","key":"2025082211030210300_b12-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","first-page":"339","DOI":"10.1162\/003355302753399526","article-title":"Information Technology, Workplace Organization, and the Demand for Skilled Labor: Firm-Level Evidence","volume":"117","author":"Bresnahan","year":"2002","journal-title":"The Quarterly Journal of Economics"},{"issue":"4","key":"2025082211030210300_b13-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","first-page":"217","DOI":"10.1057\/s11369-021-00224-5","article-title":"The power of prediction: Predictive analytics, workplace complements, and business performance","volume":"56","author":"Brynjolfsson","year":"2021","journal-title":"Business Economics"},{"key":"2025082211030210300_b14-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","DOI":"10.2139\/ssrn.3258599","author":"Buckman","year":"2018","journal-title":"Fool me twice: An analysis of repeat data breaches within firms"},{"issue":"2","key":"2025082211030210300_b15-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","first-page":"200","DOI":"10.1016\/j.jeconom.2020.12.001","article-title":"Difference-in-differences with multiple time periods","volume":"225","author":"Callaway","year":"2021","journal-title":"Journal of Econometrics"},{"key":"2025082211030210300_b16-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","DOI":"10.6028\/NIST.SP.800-61r2","article-title":"Computer security incident handling guide: Recommendations of the National Institute of Standards and Technology","author":"Cichonski","year":"2012","journal-title":"National Institute of Standards and Technology"},{"issue":"S1","key":"2025082211030210300_b17-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","first-page":"S337","DOI":"10.1086\/694106","article-title":"Skill requirements across firms and labor markets: Evidence from job postings for professionals","volume":"36","author":"Deming","year":"2018","journal-title":"Journal of Labor Economics"},{"key":"2025082211030210300_b18-14_rn_10_25300_misq_2024_18352","unstructured":"Executive Order No. 13800, 82 Fed. Reg. 22391 (May\u200816, 2017). https:\/\/www.federalregister.gov\/d\/2017-10004"},{"key":"2025082211030210300_b19-14_rn_10_25300_misq_2024_18352","unstructured":"Executive Order No. 14028, 86 Fed. Reg. 26633 (May\u200812, 2021). https:\/\/www.federalregister.gov\/d\/2021-10460"},{"issue":"10","key":"2025082211030210300_b20-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","first-page":"7298","DOI":"10.1287\/mnsc.2021.4264","article-title":"Data breach announcements and stock market reactions: A matter of timing?","volume":"68","author":"Foerderer","year":"2022","journal-title":"Management Science"},{"issue":"9","key":"2025082211030210300_b21-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","first-page":"3307","DOI":"10.1257\/aer.20180609","article-title":"Pre-event trends in the panel event-study design","volume":"109","author":"Freyaldenhoven","year":"2019","journal-title":"American Economic Review"},{"issue":"2","key":"2025082211030210300_b22-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","first-page":"254","DOI":"10.1016\/j.jeconom.2021.03.014","article-title":"Difference-In-Differences with Variation in Treatment Timing","volume":"225","author":"Goodman-Bacon","year":"2021","journal-title":"Journal of Econometrics"},{"issue":"1","key":"2025082211030210300_b23-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","DOI":"10.1093\/cybsec\/tyaa005","article-title":"Integrating cost-benefit analysis into the NIST cybersecurity framework via the Gordon-Loeb model","volume":"6","author":"Gordon","year":"2020","journal-title":"Journal of Cybersecurity"},{"issue":"2","key":"2025082211030210300_b24-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","first-page":"85","DOI":"10.1509\/jm.16.0124","article-title":"The effect of a data breach announcement on customer behavior: Evidence from a multichannel retailer","volume":"82","author":"Janakiraman","year":"2018","journal-title":"Journal of Marketing"},{"issue":"3","key":"2025082211030210300_b25-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","first-page":"719","DOI":"10.1016\/j.jfineco.2019.05.019","article-title":"Risk management, firm reputation, and the impact of successful cyberattacks on target firms","volume":"139","author":"Kamiya","year":"2021","journal-title":"Journal of Financial Economics"},{"key":"2025082211030210300_b26-14_rn_10_25300_misq_2024_18352","unstructured":"Kaspersky Lab\n          . (2018). Survey finds that 84% of CISOs in North America believe cybersecurity breaches are inevitable. https:\/\/usa.kaspersky.com\/about\/press-releases\/2018_survey-finds-that-84-of-cisos-in-north-america-believe-cybersecurity-breaches-are-inevitable"},{"issue":"2","key":"2025082211030210300_b27-14_rn_10_25300_misq_2024_18352","first-page":"25","article-title":"Data security: A new concern for PR practitioners","volume":"50","author":"Kelly","year":"2005","journal-title":"Public Relations Quarterly"},{"issue":"1","key":"2025082211030210300_b28-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","DOI":"10.1080\/23311975.2017.1354525","article-title":"Lessons from the five data breaches: Analyzing framed crisis response strategies and crisis severity","volume":"4","author":"Kim","year":"2017","journal-title":"Cogent Business & Management"},{"issue":"1","key":"2025082211030210300_b29-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","first-page":"317","DOI":"10.25300\/MISQ\/2022\/15713","article-title":"Where is IT in information security? The interrelationship among IT investment, security awareness, and data breaches","volume":"47","author":"Li","year":"2023","journal-title":"MIS Quarterly"},{"issue":"3","key":"2025082211030210300_b30-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","first-page":"758","DOI":"10.1080\/07421222.2020.1790190","article-title":"Centralized IT decision making and cybersecurity breaches: Evidence from U.S. higher education institutions","volume":"37","author":"Liu","year":"2020","journal-title":"Journal of Management Information Systems"},{"issue":"1","key":"2025082211030210300_b31-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","first-page":"44","DOI":"10.1177\/1094670510383409","article-title":"Evaluating customer information breaches as service failures: An event study approach","volume":"14","author":"Malhotra","year":"2011","journal-title":"Journal of Service Research"},{"issue":"1","key":"2025082211030210300_b32-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","first-page":"36","DOI":"10.1509\/jm.15.0497","article-title":"Data privacy: Effects on customer and firm performance","volume":"81","author":"Martin","year":"2017","journal-title":"Journal of Marketing"},{"issue":"4","key":"2025082211030210300_b33-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","first-page":"829","DOI":"10.1007\/s12525-021-00490-3","article-title":"What to do after a data breach? Examining apology and compensation as response strategies for health service providers","volume":"31","author":"Masuch","year":"2021","journal-title":"Electronic Markets"},{"key":"2025082211030210300_b34-14_rn_10_25300_misq_2024_18352","unstructured":"Ponemon Institute\n          . (2020). The economic value of prevention in the cybersecurity lifecycle (Ponemon Institute research report). https:\/\/www.ponemon.org\/research\/ponemon-library\/security\/the-economic-value-of-prevention-in-the-cybersecurity-lifecycle.html"},{"issue":"3","key":"2025082211030210300_b35-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","first-page":"227","DOI":"10.2308\/isys-52379","article-title":"Much ado about nothing: The (lack of) economic impact of data privacy breaches","volume":"33","author":"Richardson","year":"2019","journal-title":"Journal of Information Systems"},{"issue":"1","key":"2025082211030210300_b36-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","first-page":"74","DOI":"10.1111\/jels.12035","article-title":"Empirical analysis of data breach litigation","volume":"11","author":"Romanosky","year":"2014","journal-title":"Journal of Empirical Legal Studies"},{"issue":"2","key":"2025082211030210300_b37-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","first-page":"117","DOI":"10.1287\/stsc.2020.0106","article-title":"Learning from digital failures? The effectiveness of firms\u2019 divestiture and management turnover responses to data breaches","volume":"5","author":"Say","year":"2020","journal-title":"Strategy Science"},{"issue":"3","key":"2025082211030210300_b38-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","first-page":"501","DOI":"10.1162\/rest_a_00953","article-title":"Interpreting OLS estimands when treatment effects are heterogeneous: Smaller groups get larger weights","volume":"104","author":"S\u0142oczy\u0144ski","year":"2022","journal-title":"The Review of Economics and Statistics"},{"issue":"2","key":"2025082211030210300_b39-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","first-page":"175","DOI":"10.1016\/j.jeconom.2020.09.006","article-title":"Estimating dynamic treatment effects in event studies with heterogeneous treatment effects","volume":"225","author":"Sun","year":"2021","journal-title":"Journal of Econometrics"},{"issue":"2","key":"2025082211030210300_b40-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","first-page":"417","DOI":"10.1111\/lsi.12303","article-title":"Data breach, privacy, and cyber insurance: how insurance companies act as \u201ccompliance managers\u201d for businesses","volume":"43","author":"Talesh","year":"2018","journal-title":"Law & Social Inquiry"},{"key":"2025082211030210300_b41-14_rn_10_25300_misq_2024_18352","unstructured":"Toth, P.\n           (2018, October\u20084). Cybersecurity starts with your employees. National Institute of Standards and Technology\u2014Manufacturing Innovation Blog. https:\/\/www.nist.gov\/blogs\/manufacturing-innovation-blog\/cybersecurity-starts-your-employees"},{"issue":"2","key":"2025082211030210300_b42-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","first-page":"440","DOI":"10.1287\/mksc.2019.0208","article-title":"When the data are out: Measuring behavioral changes following a data breach","volume":"43","author":"Turjeman","year":"2024","journal-title":"Marketing Science"},{"key":"2025082211030210300_b43-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","DOI":"10.1515\/rle-2023-0038","article-title":"Do US state breach notification laws decrease firm data breaches?","author":"Vaaler","year":"2023","journal-title":"Review of Law & Economics"},{"key":"2025082211030210300_b44-14_rn_10_25300_misq_2024_18352","unstructured":"Woods, D. W., B\u00f6hme, R., Wolff, J., & Schwarcz, D. (2023). Lessons lost: Incident response in the age of cyber insurance and breach attorneys. In Proceedings of the 32nd USENIX Security Symposium (pp. 2259-2273). https:\/\/www.usenix.org\/system\/files\/usenixsecurity23-woods.pdf"},{"key":"2025082211030210300_b45-14_rn_10_25300_misq_2024_18352","doi-asserted-by":"publisher","DOI":"10.1145\/3498891.3501257","article-title":"Blessed are the lawyers, for they shall inherit cybersecurity","author":"Woods","year":"2021"}],"container-title":["MIS Quarterly"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/misq.umn.edu\/misq\/article-pdf\/49\/1\/367\/1806\/14_rn_10.25300_misq_2024_18352.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/misq.umn.edu\/misq\/article-pdf\/49\/1\/367\/1806\/14_rn_10.25300_misq_2024_18352.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T15:03:10Z","timestamp":1755874990000},"score":1,"resource":{"primary":{"URL":"https:\/\/misq.umn.edu\/misq\/article\/49\/1\/367\/80\/Human-Capital-Acquisition-in-Response-to-Data"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,3,1]]},"references-count":45,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2025,3,1]]},"published-print":{"date-parts":[[2025,3,1]]}},"URL":"https:\/\/doi.org\/10.25300\/misq\/2024\/18352","relation":{},"ISSN":["0276-7783","2162-9730"],"issn-type":[{"value":"0276-7783","type":"print"},{"value":"2162-9730","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,3,1]]}}}