From Shares to Shields: The Role of Employee Ownership in Mitigating Data Breach Risks

Employees have a comparative advantage in monitoring their peers and other employees—an advantage
that managers and executives do not have. I call this mutual monitoring and investigate whether it
can protect firms from risks where a small mistake by one individual could cause significant harm, such as
data breaches. To explore this, using AI(BERT models), I conduct a comprehensive textual analysis to
identify distinct data breach incidents reported by the same firm. I then examine how the ratio of active
participants in employee stock ownership plans (ESOPs) to total employees (the active ratio) affects the
probability of a data breach incident. My findings indicate that a higher active ratio is associated with a
lower probability of such incidents. Moreover, by analyzing the extensive and intensive margins of ESOP
ownership, I find that two firms with the same ESOP value per employee can experience different levels
of protection against data breaches due to variations in their active ratio; the distribution of ESOP assets
within the firm matters in protecting against data breach incidents. Next, using a staggered differencein-
differences model, I analyze how the first noticeable data breach in an industry impacts the active
ratio of peer firms within the same industry. I find that ESOP firms increase their active ratio by 3 to
4 percentage points following the industry shock, driven by a 7 to 10 percent increase in the number of
ESOP owners within those firms. Notably, this change remains persistent after excluding financial firms
and industry shocks coinciding with the years 2007 and 2008.