So many thing missing in this article. Stock prices reflect the shareholders trust in the company. So the real question should be: why would a shareholder stop

So many thing missing in this article. Stock prices reflect the shareholders trust in the company. So the real question should be: why would a shareholder stop trusting a company after a cyberattack? As the author clearly mentioned, it is considered nowadays as a systemic risk. The more mature companies even have budgets and provisions for a cyber incident, notwithstanding cyber-insurances. Another reason why shareholders would not worry is that a cyberattack of large magnitude in a very large company brings a lot of benefits if you look at the balance sheet: the company indeed spends a lot of money, but look how/where. We can see that compromised large companies spend money in cybersecurity consulting services and cybersecurity acquisitions (licenses, hiring new people). It all adds up to increasing the actual value of the company in the eye of the shareholders: people gained new knowledge, it hired new capable employees, and it has augmented its assets. The only sunk cost is the potential fines. As cyberattacks on a large company increases the value of the company. We can easily understand why shareholders are attracted to those. Now the final question is: in which cases should shareholders walk away from a compromised company? I would speculate on two hypotheses. First, I think shareholders don't like the idea of a company getting compromised a second time within a short timeframe. That would actually be symptomatic of bad management. Second I think that cashflow plays a major role: are the company's reserves large enough to withstand the costs of a cyberattack (and a potential fine in the EU, if there is personal data involved) or will it require borrowing lots of money? If yes, then shareholders should simply buy. Assuming my hypotheses have some value, we could say that stock prices will be more affected negatively when shareholders don't trust the company to do what it takes to deal with the cyberattack. To be honest I'm a bit frustrated that this article could be published on HBR. The analysis is too simplistic in my opinion, the author could have done more research.