An economics professor from the University of Wollongong, Alex Frino, has conducted research on the disclosure of cyber incidents by listed Australian companies between 2011 and 2021. His study revealed that a minority of the affected companies disclosed their breaches to the Australian Securities Exchange (ASX).
Frino compiled his database of cyber security incidents from three sources, including ASX announcements, the Dow Jones Factiva news database, and the Webber Insurance Database. His research revealed 36 cyber attacks, out of which only 11 were publicly disclosed via ASX announcements, while the rest were only reported in the press.
Frino also discovered that some companies delayed making breaches public, with substantial evidence of information leakage occurring up to 30 days before formal announcements. The mean average market value loss for companies that announced cyber attacks was six percent, which provides an indication of the expected cost of a breach to the victim company.
The study highlights the need for specific rules for companies to report cyber attacks to the market in Australia and the USA. The research paper is currently awaiting peer review.
