A Preemptive and Curative Solution to Mitigate Data Breaches: Corporate Social Responsibility as a Double Layer of Protection.

This article investigates how corporate social responsibility (CSR) functions as a strategic variable to both prevent and mitigate the financial harm of data breaches in publicly traded U.S. firms. Distinguishing between internal CSR (targeting primary stakeholders such as employees and customers) and external CSR (targeting secondary stakeholders like communities), the research finds that moderate to high levels of internal CSR significantly reduce the likelihood of data breaches, while external CSR has no preventive effect. Furthermore, only high levels of internal CSR are associated with superior short- and long-term financial recovery following a breach, whereas external CSR offers limited and short-lived financial protection. These findings suggest that genuine, operationally integrated CSR efforts focused on core stakeholders provide a dual layer of protection against data breaches, contrasting with more peripheral, image-focused CSR activities.