Hacked and paying up: the impact of cyber-attacks on payout policy

Abstract

This study examines the impact of cyber-attacks on corporate payout policy using a difference-in-differences framework with a matched sample. We find that attacked firms increase both dividends and repurchases, with a stronger reliance on repurchases, supporting the substitution hypothesis. The effects differ across regulation, industry, governance, and ownership structures, indicating that institutional contexts shape payout flexibility. Overall, the findings highlight the strategic role of payout policy in managing uncertainty and restoring confidence in the wake of cybersecurity shocks, offering insights for both managers and policymakers.