Intraday study of the market reaction to distributed denial of service (DOS) attacks on internet firms.
Rao, Arundhati ; Warsame, Mohamed ; Williams, Jan L. 等
INTRODUCTION
Computers have become an integral part of our personal and
professional lives. Some companies in fact conduct all of their business
solely through the use of computers; these firms are referred to as
"internet firms." Denial of access to computer networks even
for a brief period of time can result in a loss of business and can be
devastating to internet firms. Distributed denial of service (DoS)
attacks on internet firms encompass all conditions that deliberately
prevent users from accessing network resources through which the firms
conduct business, including the sale and purchase of products and access
to data for various reasons. The attacks may also go beyond shutting
down websites; it may damage computer software and systems, and
compromise firm and customer data.
During a DoS attack, internet firms lose revenue and also suffer
the consequences of exposure to their inherent "vulnerability"
with permanent loss of future revenue (some customers shy away from
internet businesses after news of a hacker attack). Using e-Bay as an
example, Duh et al. (2002) show that concern over online security is a
major impediment to the growth of internet businesses. They find that
DoS, privacy, and authentication are three major sources of business
risk for internet firms.
The impact of DoS attacks on market reaction remains questionable.
Several studies have examined the market reaction of such attacks; the
findings, however, are inconclusive. Hovav and D'Arcy (2003) and
Hovav, Andoh-Baidoo and Dhillion (2007) find that the market does not
significantly penalize internet companies that experience a DoS attack.
Ettredge and Richardson (2003), Cavusoglu, Mishra and Raghunathan
(2004), and Anthony, Choi and Grabski (2006), on the other hand, find a
negative market reaction to internet firms that experience web outages.
Each of these studies used an event study methodology and daily returns
data. Telang and Wattal's (2007) examination of the impact of
vulnerability announcements on security software vendors reveals that
these companies do suffer a drop in their stock prices.
The purpose of this study is to further examine the relation
between DoS attacks and market reaction. We build on the study by
Ettredge and Richardson (2003) and examine the effects of the same DoS
attacks at an intraday level using data obtained from the NASTRAQ
database. Using intraday data further allows us to investigate the
extent to which the DoS victim's stock prices are affected and the
related length of time. Additionally, we analyze the impact of DoS
attacks on other firms in the same industry by way of information
transfer. We hypothesize that a DoS victim's stock will trade
heavily; this increase in trading volume will become "news"
resulting in an increase in trading of other stocks in the same
industry. Furthermore, we examine the extent to which a DoS attack
affects the stock price of Internet Security Provider (ISP) firms at an
intraday level.
Our study advances the current knowledge of literature by using
intraday data. This data is advantageous since the NASDAQ market price
adjusts rapidly to new information on DoS attacks. The NASTRAQ database,
which is intended for academic research, contains trades and quotes for
NASDAQ stocks. The data must be extracted into spreadsheets. This poses
a major difficulty with the large volume of trading data within the
short window of interest in this paper. The seminal paper by Ball and
Brown (1968) shows that the market does not adjust fully to new
information and leads to a post announcement drift. Therefore, we
examine the market adjustment to a DoS attack, on an intraday basis as
trading occurs, and the cost of security in terms of price adjustment to
firms in the industry that have not been attacked. Another significant
contribution of this research will be the study of information transfer
based on trading volume.
LITERATURE REVIEW
The rational pricing and market value of internet firms has been
studied extensively. Schwartz and Moon (2000) find that high growth
rates in revenues appear to justify astronomically high prices of
technology firms during the internet bubble. This finding is reinforced
by Kamstra (2001). He finds that the value of an internet firm can be
determined by revenue, if the revenues are co-integrated with
fundamental value. Lazer et al. (2001) also show that internet websites
with higher traffic rates provide significantly higher returns than
sites with low internet traffic. Therefore, a DoS attack that reduces
the revenue of the internet firm directly by obstructing transactions
and diminishing customer confidence in the firm's trading platform
can have a major impact on its market value.
The market impact of different disclosures by internet trading
firms has been widely analyzed in the accounting and finance literature.
Subramani and Walden (2001) analyze the impact of e-commerce initiative
announcements and find significant positive cumulative abnormal returns
to investors. This result reveals that the market recognizes e-commerce
events as value relevant in determining the market value of internet
companies.
Several prior studies report a negative association between market
value and web outages. Ettredge and Richardson (2003) study this DoS
phenomenon over a three-day period, February 7, 2000 to February 9,
2000, and find that internet firms suffer a significantly negative stock
market reaction even when the firm is not subject to the DoS attack.
They also find that Internet Security Provider firms benefited from
these hacker attack events. Cavusoglu et al. (2004) conduct a
large-scale study on all types of security breaches (not just DoS
attacks) over a seven-year period, 19952001. They find a negative
relation between internet security breach announcements and market
value, regardless of the type of security breach. Anthony et al.'s
(2006) study of the stock market reaction to announcements of website
outages further report that internet firms have negative returns when
they experience internet outages.
Other studies, however, report that DoS attacks did not impact
market value. Hovav and D'Arcy's (2003) study of DoS attacks
over a 4.5 year period reveals that while internet firms had negative
abnormal returns during the five days following the announcement, they
were not significant. Hovav, Andoh-Baidoo and Dhillion (2007) further
explore whether various characteristics of security breaches impact
abnormal stock returns. This study examines the type of attackers,
objectives of the attack, the results of the attack, tools used to
attack and the access type. They report that not all attacks have the
same effect on abnormal returns. While the overall end result of the
attack had a significantly negative impact on market reaction, DoS
attacks, a category within end result, did not.
All these studies employ the event study methodology using daily
data. Event studies do not rely on expectations of accounting numbers
but adjust a firm's expected returns to a systematic measure of
risk, such as beta. Studies cited in Kothari (2001) show that short term
event studies are usually consistent with market efficiency. The studies
on market efficiency utilizing event study methodology face a variety of
econometric issues that are summarized in Kothari (2001), such as
expected returns mismeasurement, unusual and correlated samples of
firms' returns, survivorship bias, clustering in calendar time,
bias in the test statistics, model specification (such as the choice
between price and returns models), and the comparison of the information
content of alternative models. The incremental information content of a
particular accounting signal can be analyzed by including a dummy
variable for the accounting signal in a cross-sectional or time series
study.
The event study methodology, as used by Ettredge and Richardson
(2003), is not robust to clustering, which occurs when a significant
number of the events take place within a short period of time.
Harrington and Shrider (2007) also show that a short horizon event study
ignores cross-firm variation in the event effects, thereby inducing a
bias in the abnormal returns. Since DoS attacks by their dissimilarity
and severity will induce cross-firm variations on their effects across
other internet firms, we have expanded the dataset to use intraday data
instead of daily data. Furthermore, in order to overcome these issues
and improve the robustness of the results of the study, we utilize the
portfolio approach.
All of the above methodologies rely on a returns metric to
determine the market impact of the DoS attack. Cready and Hurtt (2002),
however, show that a volume based metric to measure investor response
provides more powerful tests than the measures based on abnormal stock
returns in the event studies. Cready and Hurtt (2002) also show that the
power of a returns based metric test can be improved by incorporating a
trading (volume) based measure. We hypothesize that after a DoS attack
the increased trading volume of the victim's stock will cause
investors to trade other stocks in the same industry. That is to say,
the reaction is to the increased trading volume and not to the DoS
attack event. Therefore, we will conduct additional tests to detect
investor responses based on event day trading volumes.
HYPOTHESIS DEVELOPMENT
In this section, we present the hypotheses that are examined in
this study. First we study the firm effect of a DoS attack. Yahoo
suffered a service failure that lasted nearly three hours when computer
hackers flooded Yahoo's network with a steady stream of data. Yahoo
received nearly one gigabyte of traffic per second for three hours; this
was estimated to be more data than most firms received over a one year
period. This information overload prevented Yahoo from exchanging data
with its customers and effectively shut down their site. While analysts
did not expect Yahoo's revenues to suffer, this DoS attack was more
than merely an inconvenience to the customers. The hackers sent a larger
message that nobody's computer was safe. Unfortunately, this was
just the start of the attacks; eBay and Amazon soon became victims too.
Most DoS attacks are hard to trace, as hackers use several computers to
perpetuate the crime. In most cases, the computer used to cause the
attacks is hijacked through the internet.
If a DoS attack prevents firms from conducting business, the firms
will lose revenue. Knowledge of the DoS attacks may also deter customers
from conducting business online in the future. As such, firm value will
be negatively affected by DoS attacks. Therefore, our first hypothesis
is the following:
[H.sub.1]: The stock price of an internet firm will be negatively
affected by a DoS attack.
Next we explore the impact of DoS attacks on Internet Security
Providers (ISP) firms. DoS attacks draw attention to the vulnerability
of internet firms and raise the demand for increased security on the
internet. The demand for increased security will be predicated by the
services provided by ISP firms. Accordingly, DoS attacks will result in
higher revenue and an awareness of the need for ISP firms. Therefore,
our second hypothesis is the following:
[H.sub.2]: The stock price of an ISP firm will be positively
affected by a DoS attack in the internet industry.
Lastly, we investigate the impact of DoS attacks on market reaction
based on trading volume. If the market is frightened by a DoS attack,
investors will not purchase shares of the attacked firm's stock. On
the other hand, if the market is not frightened by the DoS attack,
investors will hold their stocks rather than sell them. Accordingly,
regardless of the market reaction to the DoS attack, investors will not
purchase additional stocks during the attack period. Therefore, trading
volume will decrease during the attack period. Using intraday data we
expect that unsophisticated investors will react to the DoS attack while
sophisticated investors (larger percentage of investors) will not
immediately react to the attack. Our third hypothesis is the following:
[H.sub.3] The trading volume of a firm subject to a DoS attack will
decrease during the attack period.
DATA AND METHODOLOGY
Data
The sample for this study consists of the three NASDAQ firms,
Yahoo, eBay and Amazon.com, that experienced DoS attacks during the
period February 7-9, 2000. Of the eight firms attacked during this
period, five were excluded from our study for the following reasons:
three firms were not listed (CNN, ZDNet and Excite), one firm (E*Trade)
was listed on the NYSE, and one firm (Buy.com) went public on the same
day it was attacked. Daily trades, volume and stock prices for February
2000, are obtained from the NASTRAQ database. The time and duration of
DoS attacks in February 2000 and the NASDAQ market's trading hours
are provided in Table 1 below. It is important to note that only the
Yahoo attack took place entirely within the regular trading hours; the
attack on eBay started during the regular trading hours and continued to
the extended hours and later; and the Amazon attack started after the
close of extended trading hours. This small sample size and the
proximity of the attacks limit our ability to control for the market
time in which the attack occurs.
The sample firms examined in this study are very unique. Yahoo,
eBay and Amazon are industry leaders, and are much larger than other
firms in the same industry. Due to the uniqueness of the sample firms,
it is difficult to establish a control sample based on firms in the same
industry with similar characteristics, such as market size, sales and
assets. Therefore, to measure abnormal returns we use a control sample
of internet firms that did not experience a DoS attack during the sample
period. Our control sample consists of these same internet firms
examined by Ettredge and Richardson (2003). They found that information
transfer was no different in industries where internet firms were
attacked than in internet industries not attacked. Likewise, we use the
internet firms that were not attacked as the control sample to measure
abnormal returns related to internet security providers. Our control
sample consists of 134 internet firms listed on
www.InternetStockList.com as of July 2000. The control sample was
obtained from Professor Richardson. The internet security provider
sample consists of10 firms that provide internet security products and
services.
In Table 2 we present descriptive statistics for the DoS attack
sample firms, control firms and internet security provider firms. The
DoS attack firms have mean sales of $817.72 million and mean assets of
$1,635.10 million. The DoS attack firms are significantly larger than
the control firms and the internet security provider firms at the 0.01
level. This is consistent with hackers choosing to attack the large
internet firms. The control firms have larger sales than the internet
service provider firms. However, they are similar in size according to
assets. Additionally, the standard deviations for control firms reflect
a wide range in firm size according to sales (1,098.06) and assets
(1,425.14).
In Table 3 we present the DoS attack firms and control firms by
industry. SIC code descriptions are obtained from the U. S. Department
of Labor Occupational Safety & Health Administration website
(www.osha.gov). Two of the attacked firms are in the catalog, mail order
houses industry (Amazon and eBay). The third DoS attack firm is in the
computer programming, data processing industry (Yahoo). The majority of
internet firms (69.8%) in the control firm sample are in the business
services industry.
METHODOLOGY
We use intraday data to examine investors' reaction to DoS
attacks that completely prohibit internet firms from conducting
business. We examine the market impact of DoS attacks by examining stock
price returns. Returns are calculated as follows:
[R.sub.i,t] = [P.sub.i,t] - [P.sub.i,t-1] / [P.sub.i,t-1]
where [R.sub.i,t], the return for the attack period, is calculated
as the percentage change in stock price between [P.sub.i,t], the average
price of the first 15-minute interval after the start of the attack and
[P.sub.it-1], the average price of the last 15-minute interval of the
attack period.
Portfolio Approach
We use a portfolio approach advocated by Campbell et al. (1993) to
further test the impact of DoS attacks. The main advantages of the
portfolio formation are that unique risk factors are diversified away
and errors caused by the cross correlation of the error terms are
mitigated. This approach estimates abnormal returns by comparing the
return of the DoS sample firm to the average return of a portfolio of
control firms for the same period. Our control sample consists of other
internet firms traded on NASDAQ that were not attacked during the sample
period. We choose these firms to overcome the intraday effects in stock
returns (see Chan, Christie and Schultz (1995)). To further test the
impact of DoS attacks, we also form a portfolio of internet security
provider firms in order to compare their returns to those of the DoS
attack firms.
We estimate abnormal returns for twenty 15-minute intervals before
and twenty 15-minute intervals after the attack to assess the
market's immediate reaction to the DoS attacks. The abnormal
returns are calculated as the return for the DoS attack firm minus the
average return for the control sample firms for the same period based on
the following formula:
[A.sub.i,t] = [R.sub.i,t] - E [([R.sub.c]).sub.i,t]
where [A.sub.i,t] denotes the abnormal return for the ith 15-minute
interval of day t, [R.sub.i,t] is the sample return for the ith
15-minute interval of day t and E(Rc) is the expected return of the
control portfolio of equally weighted internet firms not affected by the
DoS attacks for the ith 15-minute interval of day t. The equally
weighted portfolio for control firms was utilized due to the size
difference that could obscure the impact of the event in case of a value
weighted approach. The cumulative abnormal returns during the event
window are denoted as CARt, as shown below:
[CAR.sub.t] = [20.summation over (t=-20)] [A.sub.t]
Trading Volumes
We also examine trading volumes surrounding the DoS attacks to
further test investor response to DoS attacks. Cready and Hurtt (2002)
provide evidence that volume based metrics are more powerful in
detecting investor responses to public disclosures than returns based
methodology. In the literature, the alternative approaches on defining
and measuring market reaction consist of the use of returns or volume as
a measure of market reaction. Lee (1992) finds that the market reacts
quickly to new information both in adjusting returns and volumes.
To determine whether there is a significant change in trading
volume immediately surrounding the DoS attacks, we examine the
difference between the mean trading volume in the pre- and post-attack
periods. This methodology is used because we are unable to obtain the
total shares outstanding of control firms for the related intraday
periods, which would be necessary to standardize trading volume. The
pre-attack period consists of the twenty 15-minute intervals prior to
the attack and the post-attack period consists of the twenty 15-minute
intervals subsequent to the attack.
EMPIRICAL ANALYSIS AND RESULTS
We investigate the effects of DoS attacks on stock price and
abnormal returns. Although our primary interest is the impact of
abnormal returns around DoS attacks, we begin our analysis by
investigating stock price reactions surrounding the attacks. Figure 1
shows the stock prices and abnormal returns for twenty 15-minute
intervals before the attack to twenty 15-minute intervals after the
attack for each sample firm. The stock price for Amazon and Yahoo
reaches its peak in the period of the DoS attack ($83.69 and $356.56,
respectively) and declines after the attack. Amazon's stock price
declines for the following four 15-minutes intervals before it begins to
increase. Yahoo's stock price declines for the following two
15-minute intervals before it begins to increase. While Yahoo's
stock price recovers and surpasses the attack stock price at t+18,
Amazon's stock never reaches the peak of its DoS stock price in the
post-attack period. eBay's slow stock price decline in the
pre-attack period becomes more steady in the post-attack period.
To test hypothesis 1, we examine the abnormal stock returns of the
three DoS attack firms. The results are presented in Table 4. All three
firms experienced negative returns related to the DoS attacks. Yahoo
experienced the greatest stock price decline of 2.6% while Amazon
experienced the smallest decline of 0.7%. The mean abnormal returns are
significantly negative at the 0.01 level for all three DoS attack firms.
These results also show that the negative abnormal returns due to a DoS
attack are in line with the duration and timing of the event. This is
consistent with our hypothesis that the stock price of an internet firm
will be negatively affected by a DoS attack.
[FIGURE 1 OMITTED]
Amazon and eBay show negative abnormal returns surrounding the
event. Amazon's abnormal returns are negative from the first
15-minute interval before the attack t-1 until the sixth 15-minute
interval after the attack t+6 while eBay's abnormal returns are
negative from the first 15-minute interval before the attack t-1 until
the third 15-minute interval after the attack t+3. Yahoo's abnormal
return, however, is only negative at the point of the attack, t. In
observing the twenty intervals before the attack to twenty periods after
the attack, all three firms experienced their lowest abnormal return in
the period immediately surrounding the DoS attack. These results suggest
that while the internet firms are affected by the DoS attack, they
appear to rebound and continue as normal shortly after the attack.
To test our second hypothesis that the stock price of an ISP firm
will be positively affected by a DoS attack in the internet industry, we
examine the differences between the mean returns for the ISP sample
firms and the control sample firms during the time of the DoS attacks.
Table 5 presents the mean returns for both samples along with the
abnormal returns for the ISP firms.
Using intraday data for the event period, we find results similar
to Ettredge and Richardson (2003) for the control sample firms. The mean
returns for internet firms that were not attacked (control sample firms)
are negative. This suggests that information about the attack is
transferred to other firms that also conduct business on the internet.
As we examine the differences between the ISP mean returns and the
control sample mean returns, however, we find mixed results. The
abnormal return is negative during the Amazon attack period and positive
during the eBay and Yahoo attack periods. The negative ISP firm abnormal
return during the Amazon attack period could be the result of this
attack occurring after trading hours. Furthermore, we note that none of
the abnormal returns are significant. This could be attributed to the
brevity of the attacks and the resolution of the attacks during the same
day. Overall, unlike Ettredge and Richardson (2003), we do not find that
ISP firms experience positive abnormal returns when internet firms are
attacked. To further ascertain the information impact of DoS attacks, we
examine another investor metric, trading volume. Table 6 presents the
mean volume of trades surrounding the DoS attacks. The pre-attack period
represents the twenty 15-minute intervals prior to the denial of service
attack. The post- attack period represents the twenty 15-minute
intervals subsequent to the denial of service attack.
The results support our hypothesis that trading volume will
decrease during the attack period. There is a significant decrease in
the volume of trades for Amazon and eBay at the 1% and 10% levels,
respectively. Amazon's volume of trades decreased 225,377 and
eBay's decreased 27,504. While Yahoo's volume increases by
10,987 trades, the increase is insignificant. This increase in the Yahoo
volume of trades could result from its DoS attack being resolved before
the end of trading on that day. Overall, our results provide evidence
that investors did not purchase significant shares of stock during the
DoS attacks.
CONCLUSION
This paper investigates the market impact of distributed denial of
service (DoS) attacks on internet firms and the information transfer
affecting the market value of other internet and internet security
firms. This study is unique in that we use intraday data obtained from
the NASTRAQ database to examine the market impact of the DoS attacks.
Our study suggests that the market reacts negatively to firms
experiencing DoS attacks. We report negative abnormal returns during the
DoS attack and a decline in stock price immediately following the DoS
attack. Additionally, we report negative returns for a control sample of
internet firms that were not attacked. As such, it appears that
information transfer exists among internet firms. In contrast, we
further report that Internet Security Provider firms do not experience
positive stock price affects from the DoS attacks. We also used volume
of trades as an investor metric to measure the impact of DoS attacks.
Our findings provide evidence that the volume of trades decreases during
the attack period. The implications of this study demonstrate that firms
that operate online can experience negative market effects from DoS
attacks, such as loss of sales, drop in stock price and market
capitalization unlike traditional retail stores.
This study can be extended by segregating DoS attacks by nature of
the attack (severity and ability to return network to normal operations
differ) to determine whether the market reacts differently depending on
the nature of the attack. There are also implications for the long-term
consequences and the cost of security to address these DoS attacks. A
second extension could segregate the firms attacked by size (i.e.,
market capitalization, revenue and internet traffic), since conceivably
the impact of a DoS attack could be greater for firms with higher
internet traffic resulting in higher revenue losses.
This study has two limitations that should be taken into account
when considering its contributions. First, our study consists of a small
sample size. In order to compare the immediate market reaction to the
same DoS attacks investigated by Ettredge and Richardson (2003), our
sample only consists of three firms. Second, one of the DoS attacks
occurred after trading hours while two of the attacks ended after
trading hours. Accordingly, we have taken steps in this study to
mitigate the effects of these limitations.
REFERENCES
Anthony, J., W. Choi & S. Grabski (2006). Market Reaction to
E-Commerce Impairments and Web-site Outages. International Journal of
Accounting Information Systems 7, (2): 60-78.
Ball, R. & P. Brown (1968). An empirical evaluation of
accounting numbers. Journal of Accounting Research 6 (2): 159-178.
Brown, S. & J. Warner (1985). Using Daily Stock Returns: The
Case of Event Studies. Journal of Financial Economics 14, 3-31.
Campbell, J., A. Lo & J. Wang (1993). Trading Volume and Serial
Correlation in Stock Returns. Quarterly Journal of Economics 107,
905-939.
Cavusoglu, H., B. Mishra & S. Raghunathan (2004). The Effect of
Internet Security Breach Announcements on Market Value: Capital Market
Reactions for Breached Firms and Internet Security Developers.
International Journal of Electronic Commerce 9, 69-104.
Chan, K., W. Christie & P. Schultz (1995). Market structure and
the intraday pattern on bid-ask spreads for NASDAQ securities. Journal
of Business 68(1): 35-60.
Cready, W. & D. Hurtt (2002). Assessing Investor Response to
Information Events using Return and Volume Metrics. The Accounting
Review 77 (4): 891-909.
Duh, R., S. Sunder & K. Jamal (2002). Control and Assurance in
E-Commerce: Privacy, Integrity, and Service at eBay. Taiwan Accounting
Review 3(1): 1-27.
Ettredge, M. & V. Richardson (2003). Information Transfer among
Internet Firms: The Case of Hacker Attacks. Journal of Information
Systems 17(2): 71-82.
Glover, S., S. Liddle & D. Prawitt (2001). eBusiness:
Principles & Strategies for Accountants. Upper Saddle River, NJ:
Prentice Hall.
Harrington, S. & D. Shrider (2007). All Events Induce Variance:
Analyzing Abnormal Returns When Effects Vary Across Firms. Journal of
Financial and Quantitative Analysis 42(1): 229-256.
Hovav, A, & J. D'Arcy (2003). The Impact of
Denial-of-Service Attack Announcements on the Market Value of Firms.
Risk Management and Insurance Review 6 (2): 97-121.
Hovav, A., F. Andoh-Baidoo & G. Dhillion (2007). Classification
of Security Breaches and their Impact on the Market Value of Firms.
Proceedings of the 6th Annual Security Conference.
Kamstra, M. (2001). Rational Exuberance: The Fundamentals of
Pricing Firms, From Blue Chips to Dot Com. Federal Reserve Bank of
Atlanta.
Kothari, S. P. (2001). Capital Markets Research in Accounting.
Journal of Accounting and Economics 31 (1-3): 105-231.
Lazer, R, B. Lev & J. Levant (2001). Internet Traffic and
Portfolio Returns. Financial Analysts Journal 57(3): 30-40.
Lee, C. M. C. (1992). Earnings News and Small Traders. Journal of
Accounting and Economics 15(2-3): 265-302.
Schwartz, E. & M. Moon (2000). Rational Pricing of Internet
Companies. Financial Analysts Journal 56 (3): 62-75.
Subramani, M. & E. Walden (2001). The Impact of E-Commerce
Announcements on the Market Value of Firms. Info Systems Research 12
(2): 135-154.
Telang, R. & S. Wattal (2007). An Empirical Analysis of the
Impact of Software Vulnerability Announcements on Firm Stock Price. IEEE
Transactions on Software Engineering 33 (8): 544-557.
Arundhati Rao, Towson University
Mohamed Warsame, Howard University
Jan L. Williams, University of Baltimore
Table 1: Attack Periods and Trading Hours
Panel A: Denial of Service Attack Periods
Date Firm Start End
40580 Yahoo 0.42708333333 0.61458333333
40581 eBay 0.60416666667 0.8125
40581 Amazon 0.70833333333 0.86458333333
Panel B: NASDAQ Market Trading Hours
Open Close
Early Trading Hours 0.33333333333 0.39583333333
Regular Trading Hours 0.39583333333 0.6875
Extended Trading Hours 0.6875 0.77083333333
Table 2: Descriptive Statistics (in Smillions)
n Mean Median
Panel A: DoS Attack Firms
Total Sales 3 817.72 588.61
Total Assets 3 1635.1 1469.82
Panel B: Control Firms
Total Sales 126 159.86 32.73
Total Assets 126 430.43 130.82
Panel C: Internet Security Provider Firms
Total Sales 10 88.36 85
Total Assets 10 369.96 157.68
Standard Range
Deviation
Panel A: DoS Attack Firms
Total Sales 734.85 224.72-1,639.84
Total Assets 767.27 963.94-2,471.55
Panel B: Control Firms
Total Sales 1098.06 0.36-12,154.00
Total Assets 1425.14 2.99-14,725.00
Panel C: Internet Security Provider Firms
Total Sales 76.41 4.97-218.12
Total Assets 571.79 9.78-1,512.12
Table 3: Firms by Industry
Attacked Firms
Catalog, mail-order houses 2
Computer programming, data processing 1
Total 3
Control Firms
Oil & Gas Extraction 2
Fabricated Metal Products Manufacturers 1
Industrial & Commercial Machinery Manufacturers 2
Electronic & Other Electrical Equipment Manufacturers 5
Miscellaneous Manufacturing Industries 1
Transportation Services 2
Communications 4
Wholesale Trade 3
Miscellaneous Retail 8
Depository Institutions 1
Non-depository Institutions 1
Security & Commodity Brokers 2
Insurance Agents Brokers & Services 1
Real Estate 1
Business Services 88
Amusement & Recreation Services 2
Engineering, Accounting Management Services 1
Total 126
Table 4: Abnormal Returns OF Denial of Service Attack
Amazon eBay Yahoo
Attack Period Abnormal
Return(t0) -0.007 -0.014 -0.026
Std Deviation 0.019 0.025 0.039
t-stat -2.430 *** -3.580 *** -4.260 ***
*** represents significance at the 1% level.
Table 5: Abnormal Returns for Internet Service Providers
Control
Sample
ISP Mean Mean
Return (%) Return (%) Difference t-stat
Amazon -0.166 -0.047 -0.119 -0.28
eBay -0.105 -0.258 0.153 0.51
Yahoo 0.029 -0.179 0.208 1.15
Table 6: Mean Volume of Trades Surrounding the Denial of Service
Attacks
Amazon eBay Yahoo
Post-Attack Period 305138 64735 113627
Pre-Attack Period 530515 92239 102640
Difference -225377 -27504 10987
t-stat -2.56 *** -1.41 * 0.16
***, ** and * represent significance at 1%, 5% and 10% levels,
respectively.