Learning from Digital Failures? The Effectiveness of Firms’ Divestiture and Management Turnover Responses to Data Breaches
References
- (2006) Is there a cost to privacy breaches? An event study. Proc. 27th Internat. Conf. Inform. Systems (ICIS), Milwaukee (Accosiation for Information Systems, Atlanta), 1563–1580.Google Scholar
- (1990) The chief technology officer. California Management Rev. 32(3):55–62.Crossref, Google Scholar
- (2017) Ecosystem as structure: An actionable construct for strategy. J. Management 43(1):39–58.Crossref, Google Scholar
- (2009) Strategic renewal of organizations. Organ. Sci. 20(2):281–293.Link, Google Scholar
- (2014) Big Four get serious on cyber security. Financial Times (June 8), https://www.ft.com/content/270d2894-ecb5-11e3-a754-00144feabdc0.Google Scholar
- (2009) Fixed effects models for events history data. Quantitative Applications in the Social Sciences: Fixed Effects Regression Models (Sage Publications, Thousand Oaks, CA), 70–86.Crossref, Google Scholar
- (2014) Event History and Survival Analysis: Regression for Longitudinal Event Data, volume 46 (Sage Publications, Thousand Oaks, CA).Crossref, Google Scholar
- (2019) Capital One cyber staff raised concerns before hack. Wall Street Journal (January 17), https://www.wsj.com/articles/capital-one-cyber-staff-raised-concerns-before-hack-11565906781.Google Scholar
- Anonymous (2017) Personal communication with the chief executive officer of an investment banking firm, April 3.Google Scholar
- Anonymous (2018) Personal communication with a senior marketing executive of a major discount retailer, October 25.Google Scholar
- (1993) Group and organizational learning curves: Individual, system and environmental components. British J. Soc. Psych. 32(1):31–51.Google Scholar
- (1999) Organizational Learning: Creating, Retaining, and Transferring Knowledge (Kluwer Academic, Boston).Google Scholar
- (1990) The persistence and transfer of learning in industrial settings. Management Sci. 36(2):140–154.Link, Google Scholar
- (2007) Aspiration performance and railroads’ patterns of learning from train wrecks and crashes. Organ. Sci. 18(3):368–385.Link, Google Scholar
- (1998) Survival-enhancing learning in the Manhattan hotel industry, 1898–1980. Management Sci. 44(7):879–1020.Link, Google Scholar
- (2017) Operational IT failures, IT value-destruction, and board-level IT governance changes. MIS Quart. 41(3):729–762.Google Scholar
- (2017) The empirics of learning from failure. Strategy Sci. 2(1):1–12.Link, Google Scholar
- (1999) Causes and effects of corporate refocusing programs. Rev. Financial Stud. 12(2):311–345.Crossref, Google Scholar
- (1995) Size and relatedness of units sold: An agency theory and resource‐based perspective. Strategic Management J. 16(3):221–239.Crossref, Google Scholar
- (2012) The transparency paradox: A role for privacy in organizational learning and operational control. Admin. Sci. Quart. 57(2):181–216.Crossref, Google Scholar
- (2010) Why do firms divest? Organ. Sci. 21(2):380–396.Link, Google Scholar
- (2013) When do firms divest foreign operations? Organ. Sci. 24(1):246–261.Link, Google Scholar
- (2017) The behavioral economics of why executives underinvest in cybersecurity. Harvard Bus. Rev. (June 7), https://hbr.org/2017/06/the-behavioral-economics-of-why-executives-underinvest-in-cybersecurity.Google Scholar
- (2006) What have we acquired and what should we acquire in divestiture research? A review and research agenda. J. Management 32(6):751–785.Crossref, Google Scholar
- (2014) A comparison of alternative measures of organizational aspirations. Strategic Management J. 35(3):338–357.Crossref, Google Scholar
- (2017) Crises and crisis management: Integration, interpretation, and research development. J. Management 43(6):1661–1692.Crossref, Google Scholar
- (2006) ChoicePoint to divest three units. DMNews (July 12), https://www.dmnews.com/data/news/13070929/choicepoint-to-divest-three-units.Google Scholar
- (2009) Selection capability: How capability gaps and internal social frictions affect internal and external strategic renewal. Organ. Sci. 20(2):294–312.Link, Google Scholar
- (2012) CEO relational leadership and strategic decision quality in top management teams: The role of team trust and learning from failure. Strategic Organ. 10(1):31–54.Crossref, Google Scholar
- (2004) The effect of Internet security breach announcements on market value: Capital market reactions for breached firms and Internet security developers. Internat. J. Electronic Commerce 9(1):70–104.Crossref, Google Scholar
- (2016) Sample selection bias and Heckman models in strategic management research. Strategic Management J. 37(13):2639–2657.Crossref, Google Scholar
- (1991) The link between resources and type of diversification: Theory and evidence. Strategic Management J. 12(1):33–48.Crossref, Google Scholar
- (2004) A theory of corporate spin-offs. J. Financial Econom. 72(2):259–290.Crossref, Google Scholar
- (2012) Business intelligence and analytics: From big data to big impact. Management Inform. Systems Quart. 36(4):1165–1188.Crossref, Google Scholar
- (2015) Back to basics: Checklists in aviation and healthcare. BMJ Quality Safety 24(7):428–431.Crossref, Google Scholar
- (1963) A Behavioral Theory of the Firm (Prentice Hall, Englewood Cliffs, NJ).Google Scholar
- (2018) Opportunity, motivation, and ability to learn from failures and errors: Review, synthesis, and ways to move forward. Acad. Management Ann. 12(1):252–277.Crossref, Google Scholar
- (2011) Mass media and massive failures: Determining organizational efforts to defend field legitimacy following crises. Acad. Management J. 54(2):263–278.Crossref, Google Scholar
- (2015) Learning through the distribution of failures within an organization: Evidence from heart bypass surgery performance. Acad. Management J. 58(4):1032–1050.Crossref, Google Scholar
- (2013) Learning from my success and from others’ failure: Evidence from minimally invasive cardiac surgery. Management Sci. 59(11):2435–2449.Link, Google Scholar
- (1984) Factors influencing divestment decision-making: Evidence from a field study. Strategic Management J. 5(4):301–318.Crossref, Google Scholar
- (2006) Firm responses to secondary stakeholder action. Strategic Management J. 27(8):765–781.Crossref, Google Scholar
- (2009) Cognition and renewal: Comparing CEO and organizational effects on incumbent adaptation to technical change. Organ. Sci. 20(2):461–477.Link, Google Scholar
- Ernst & Young (2019) Global corporate divestment study. Accessed April 28, 2020, https://assets.ey.com/content/dam/ey-sites/ey-com/en_gl/topics/divestment/2019/global_divestment_study_report.pdf.Google Scholar
- (2003) Impact of firm performance expectations on CEO turnover and replacement decisions. J. AccountingEconom. 36(1–3):165–196.Google Scholar
- (2016) Managerial compensation and corporate spinoffs. Strategic Management J. 37(10):2011–2030.Crossref, Google Scholar
- (2016) Corporate divestitures and family control. Strategic Management J. 37(3):429–446.Crossref, Google Scholar
- (2000) Downsizing in a learning organization: Are there hidden costs? Acad. Management Rev. 25(1):244–251.Crossref, Google Scholar
- (2010) Beyond the worst-case scenario: ‘Managing’ the risks of extreme events. Risk Management 12(1):1–8.Crossref, Google Scholar
- (2019) Safe or profitable? The pursuit of conflicting goals. Organ. Sci. 30(4):647–667.Link, Google Scholar
- (2013) Corporate structure and performance feedback: Aspirations and adaptation in M-form firms. Organ. Sci. 24(4):1102–1119.Link, Google Scholar
- (2016) Understanding and tackling societal grand challenges through management research. Acad. Management J. 59(6):1880–1895.Crossref, Google Scholar
- (1993) The textual approach: Risk and blame in disaster sensemaking. Acad. Management J. 36(6):1465–1514.Crossref, Google Scholar
- (2014) How newly appointed CIOs take charge. MIS Quart. Executive 13(3):159–173.Google Scholar
- (2011) An event study analysis of the economic impact of IT operational risk and its subcategories. J. Assoc. Inform. Systems 12(9):606–631.Google Scholar
- (1998) Performance, aspirations and risky organizational change. Admin. Sci. Quart. 43(1):58–86.Crossref, Google Scholar
- (2003) A behavioral theory of R&D expenditures and innovations: Evidence from shipbuilding. Acad. Management J. 46(6):685–702.Crossref, Google Scholar
- (2009) Renewal through reorganization: The value of inconsistencies between formal and informal organization. Organ. Sci. 20(2):422–440.Link, Google Scholar
- (2012) Meta‐organization design: Rethinking design in interorganizational and community contexts. Strategic Management J. 33(6):571–586.Crossref, Google Scholar
- (1993) Why managers divest—Evidence from New Zealand’s largest companies. Strategic Management J. 14(6):479–484.Crossref, Google Scholar
- (1981) Barriers to entry and competitive strategies. Strategic Management J. 2(4):395–412.Crossref, Google Scholar
- (2002) Learning from complexity: Effects of prior accidents and incidents on airlines’ learning. Admin. Sci. Quart. 47(4):609–643.Crossref, Google Scholar
- (2015) Organizational oscillation between learning and forgetting: The dual role of serious errors. Organ. Sci. 26(6):1682–1701.Link, Google Scholar
- (1997) Explaining the premiums paid for large acquisitions: Evidence of CEO hubris. Admin. Sci. Quart. 42(1):103–127.Google Scholar
- (2006) De‐commitment to losing strategic action: Evidence from the divestiture of poorly performing acquisitions. Strategic Management J. 27(6):541–557.Crossref, Google Scholar
- (1994) Evolutionary trajectories in petroleum firm R&D. Management Sci. 40(12):1720–1747.Link, Google Scholar
- (2018) Dynamic and integrative capabilities for profiting from innovation in digital platform-based ecosystems. Res. Policy 47(8):1391–1399.Crossref, Google Scholar
- (2001) Not all events are attended equally: Toward a middle-range theory of industry attention to external events. Organ. Sci. 12(4):414–434.Link, Google Scholar
- (1998) The role of safety climate and communication in accident interpretation: Implications for learning from negative events. Acad. Management J. 41(6):644–657.Crossref, Google Scholar
- (1994) Corporate divestiture intensity in restructuring firms: Effects on governance, strategy, and performance. Acad. Management J. 37(5):1207–1251.Crossref, Google Scholar
- (2012) Divestiture of TEPCO for reparation for the Fukushima nuclear accident–A path to vertical unbundling. Energy Policy 51:207–212.Crossref, Google Scholar
- , eds. (2016) The Cybersecurity Social Contract: Implementing a Market-Based Model for Cybersecurity (Internet Security Alliance, Arlington, VA).Google Scholar
- (2016) More harm than good? How messages that interrupt can make us vulnerable. Inform. Systems Res. 27(4):880–896.Link, Google Scholar
- (1992) The voluntary restructuring of large firms in response to performance decline. J. Finance 47(3):891–917.Crossref, Google Scholar
- (2004) Innovating through acquisition and internal development: A quarter-century of boundary evolution at Johnson & Johnson. Long Range Planning 37(6):525–547.Crossref, Google Scholar
- (2017) Birds of a feather: Intra-industry spillover of the Target customer data breach and the shielding role of IT, marketing, and CSR. J. Acad. Marketing Sci. 45(2):1–21.Crossref, Google Scholar
- (1991) Organizational inertia and momentum: A dynamic model of strategic change. Acad. Management J. 34(3):591–612.Crossref, Google Scholar
- (2009) From a blame culture to a just culture in healthcare. Healthcare Management Rev. 34(4):312–322.Crossref, Google Scholar
- (2015) All aspirations are not created equal: The differential effects of historical and social aspirations on acquisition behavior. Acad. Management J. 58(5):1361–1388.Crossref, Google Scholar
- (2003) The organizational routines factor market paradox. Strategic Management J. 24(10):929–943.Crossref, Google Scholar
- (2018) Organizational goals: Antecedents, formation processes and implications for firm behavior and performance. Internat. J. Management Rev. 20(S1):S3–S18.Crossref, Google Scholar
- (2012) Identifying the latent failures underpinning medication administration errors: An exploratory study. Health Services Res. 47(4):1437–1459.Crossref, Google Scholar
- (2015) When is dependence on other organizations burdensome? The effect of asymmetric dependence on Internet firm failure. Strategic Management J. 36(13):2058–2074.Crossref, Google Scholar
- (2012) Attack hits Zappos accounts. Wall Street Journal (January 17), https://www.wsj.com/articles/SB10001424052970204468004577164754266555954.Google Scholar
- (1993) The myopia of learning. Strategic Management J. 14(S2):95–112.Crossref, Google Scholar
- (2010) Opportunity costs and non‐scale free capabilities: Profit maximization, corporate scope, and profit margins. Strategic Management J. 31(7):780–801.Crossref, Google Scholar
- (1988) Organizational learning. Annual Rev. Sociol. 14(1):319–338.Crossref, Google Scholar
- (2006) Organizational design and restructuring in response to crises: Lessons from computational modeling and real-world cases. Organ. Sci. 17(5):598–618.Link, Google Scholar
- (2010) Failing to learn? The effects of failure and success on organizational learning in the global orbital launch vehicle industry. Acad. Management J. 53(3):451–476.Crossref, Google Scholar
- (1987) Managerial perspectives on risk and risk taking. Management Sci. 33(11):1404–1418.Link, Google Scholar
- McAfee Labs (2016) McAfee Labs threat reports. Report, McAfee Labs, Santa Clara, CA. Accessed April 28, 2020, https://www.mcafee.com/enterprise/en-us/assets/reports/rp-quarterly-threats-sep-2016.pdf.Google Scholar
- (2012) Big data: The management revolution. Harvard Bus. Rev. 90(10):60–68.Google Scholar
- (2017) Networks, platforms, and strategy: Emerging views and next steps. Strategic Management J. 38(1):141–160.Crossref, Google Scholar
- (2001) Talking about routines in the field. Dosi G, Nelson R, Winter S, eds. The Nature and Dynamics of Organizational Capabilities (Oxford University Press, New York), 27–50.Crossref, Google Scholar
- (1982) An Evolutionary Theory of Economic Change (Belknap, Cambridge, MA).Google Scholar
- Neter J, Kutner M, Wasserman W, Nachtsheim C, eds. (1996) Applied Linear Statistical Models (McGraw-Hill, Chicago).Google Scholar
- (1995) The enactment of economic adversity: A reconciliation of theories of failure-induced change and threat-rigidity. Res. Organ. Behav. 17:287–331.Google Scholar
- (1991) Strategic responses to institutional processes. Acad. Management Rev. 16(1):145–179.Crossref, Google Scholar
- (1985) Diversification strategy, profit performance and the entropy measure. Strategic Management J. 6(3):239–255.Crossref, Google Scholar
- (1992) Transforming the Crisis-Prone Organization (Jossey-Bass, San Francisco).Google Scholar
- (1998) Reframing crisis management. Acad. Management Rev. 23(1):59–76.Crossref, Google Scholar
- (1993) From crisis prone to crisis prepared: A framework for crisis management. Acad. Management Perspect. 7(1):48–59.Crossref, Google Scholar
- (1984) Normal Accidents: Living with High Risk Technologies (Princeton University Press, Princeton, NJ).Google Scholar
- (1991) Corporate performance and CEO turnover: The role of performance expectations. Admin. Sci. Quart. 36(1)1–19.Google Scholar
- (2014) What’s “new” about new forms of organizing? Acad. Management Rev. 39(2):162–180.Crossref, Google Scholar
- (2009) Integrating acquired capabilities: When structural integration is (un)necessary. Organ. Sci. 20(2):313–328.Link, Google Scholar
- (2006) Organizing for innovation: Managing the coordination-autonomy dilemma in technology acquisitions. Acad. Management J. 49(2):263–280.Crossref, Google Scholar
- (2016) Capability erosion dynamics. Strategic Management J. 37(4):649–672.Crossref, Google Scholar
- (2003) The effects of discontinuous change on latent errors in organizations: The moderating role of risk. Acad. Management J. 46(5):608–617.Crossref, Google Scholar
- (2007) Healthcare work environments, employee satisfaction, and patient safety: Care provider perspectives. Healthcare Management Rev. 32(1):2–11.Crossref, Google Scholar
- (2010) Diversification, coordination costs, and organizational rigidity: Evidence from microdata. Strategic Management J. 31(8):873–891.Google Scholar
- (2009) Attentional triangulation: Learning from unexpected rare crises. Organ. Sci. 20(5):876–893.Link, Google Scholar
- (2009) Contextual factors surrounding reputation damage with potential implications for reputation repair. Acad. Management Rev. 34(1):146–168.Crossref, Google Scholar
- (2016) Examining the costs and causes of cyber incidents. J. Cybersecurity 2(2):1–15.Google Scholar
- (2014) Empirical analysis of data breach litigation. J. Empirical Legal Stud. 11(1):74–104.Crossref, Google Scholar
- (2007) Is crisis management (only) a management of exceptions? J. Contingencies Crisis Management 15(2):105–114.Crossref, Google Scholar
- (2009) Capabilities unveiled: The role of ordinary activities in the evolution of product development processes. Organ. Sci. 20(2):384–409.Link, Google Scholar
- (2005) Testing for mediating variables in management research: Concerns, implications, and alternative strategies. J. Management 31(3):330–353.Crossref, Google Scholar
- (2005) What constrains or facilitates divestitures of formerly acquired firms? The effects of organizational inertia. J. Management 31(1):50–72.Crossref, Google Scholar
- (1987) Bhopal: Anatomy of a Crisis (Ballinger, New York).Google Scholar
- (1992) Learning through failure: The strategy of small losses. Res. Organ. Behav. 14:231–266.Google Scholar
- (2003) The chief technology officer: Strategic responsibilities and relationships. Res. Tech. Management 46(4):28–36.Crossref, Google Scholar
- (1993) Back from the brink—Post-crisis management. Long Range Planning 26(1):28–38.Crossref, Google Scholar
- (1988) Challenger: Fine‐tuning the odds until something breaks. J. Management Stud. 25(4):319–340.Crossref, Google Scholar
- (2009) Organizational path dependence: Opening the black box. Acad. Management Rev. 34(4):689–709.Crossref, Google Scholar
- (2009) Disintegrating information technology in corporate divestures: Implications for regulatory compliance risks and costs. Proc. 30th Internat. Conf. Inform. Systems (ICIS) (Association for Information Systems, Atlanta), 50.Google Scholar
- (2009) Technology, identity, and inertia: Through the lens of “The Digital Photography Company”. Organ. Sci. 20(2):441–460.Link, Google Scholar
- (2000) Capabilities, cognition, and inertia: Evidence from digital imaging. Strategic Management J. 21(10–11):1147–1161.Crossref, Google Scholar
- (1986) Technological discontinuities and organizational environments. Admin. Sci. Quart. 31(3):439–465.Crossref, Google Scholar
- (1992) Effectiveness of organizational responses to technological change in the production process. Organ. Sci. 3(3):301–320.Link, Google Scholar
- (1990) Autonomy, interdependence, and social control: NASA and the space shuttle Challenger. Admin. Sci. Quart. 35(2):225–257.Crossref, Google Scholar
- (1999) The dark side of organizations: Mistake, misconduct and disaster. Annual Rev. Sociol. 25(1):271–305.Crossref, Google Scholar
- Verizon (2016) Data breach investigations report. Report, Verizon, New York. Accessed April 28, 2020, https://enterprise.verizon.com/resources/reports/DBIR_2016_Report.pdf.Google Scholar
- Verizon (2017) Data breach investigations report. Report, Verizon, New York. Accessed April 28, 2020, https://enterprise.verizon.com/resources/reports/2017_dbir.pdf.Google Scholar
- (2015) Adding by subtracting: The relationship between performance feedback and resource reconfiguration through divestitures. Organ. Sci. 26(4):1101–1118.Link, Google Scholar
- (1990) The vulnerable system: An analysis of the Tenerife air disaster. J. Management 16(3):571–593.Crossref, Google Scholar
- (1999) Organization and development. Spence JT, Darley JM, Foss DJ, eds. Annual Rev. Psych. 50:361–386.Crossref, Google Scholar
- White House (2015) Cyber Threat Intelligence Integration Center. Fact sheet, The White House, Office of the Press Secretary, https://obamawhitehouse.archives.gov/the-press-office/2015/02/25/fact-sheet-cyber-threat-intelligence-integration-center.Google Scholar
- (1995) The effects of leveraged buyouts on corporate growth and diversification in large firms. Strategic Management J. 16(6):447–460.Crossref, Google Scholar
- (2013) Executive turnover in the stock option backdating wave: The impact of social context. Strategic Management J. 34(5):590–609.Crossref, Google Scholar
- (2017) Organizational response to adversity: Fusing crisis management and resilience research streams. Acad. Management Ann. 11(2):733–769.Crossref, Google Scholar
- (1992) Spin-off performance: A case of overstated expectations? Strategic Management J. 13(6):433–447.Crossref, Google Scholar
- (2013) The divestiture of acquired subunits: A resource dependence approach. Strategic Management J. 34(2):131–148.Crossref, Google Scholar
- (2000) Focusing the corporate product: Security analysts and de-diversification. Admin. Sci. Quart. 45(3):591–619.Crossref, Google Scholar

