However, stock prices and earnings reports are ultimately indirect measures. In addition, these measures are the products of innumerable variables, only some of which may have a direct bearing upon the issue of data breaches. But these are probably our only accessible sources of information.
It seems, then, that the current status of research concerning data breaches and reputational risk has not greatly advanced since Ken wrote his original paper in 2005. This does not mean that we must accept his suggestion that reputational risk is a reality, “only we really cannot talk about anything causally.” It is quite likely that certain individuals within an organization, especially within the marketing function, possess the requisite data to establish causal relationships between breaches and reputational damage. However, those data are not available for public dissemination.