People have looked at stock price impact from breaches & vulnerability disclosure before and found only very mild connections that revert themselves quickly. The only reason it seems to be working now is concentrated media attention, which doesn't seem like a repeatable strategy when the whole medical device sector is a tire fire when it comes to security. After the first few times the stock market should stop reacting to this sort of news.
1. The market is already geared to punish recalls.
2. Recalls, in some limited cases, can be very costly (for instance: in the very few cases in which hardware must be replaced, you may directly incur nosebleed-expensive medical bills).
3. The tort liability that comes from directly hurting people.
But mitigating these points:
1. Hack-and-short is only really interesting if it can be applied repeatedly. Routinizing the kinds of recalls needed to fix vulnerabilities will probably recondition the markets away from punishing these kinds of recalls.
2. Most vulnerabilities, even the most serious ones, don't incur hardware-replacing vulnerabilities.
3. In most (but not all) cases, a human death from a software flaw in a medical device will require deliberate action from, well, a murderer. Which is to say: these kinds of torts are unlikely to be common. Not that I believe that, were a button made available to 8chan that would enable them to kill people on a whim, it wouldn't be pushed regularly! Rather: it's very unlikely such a button will be created at all.
http://www.fda.gov/MedicalDevices/Safety/ListofRecalls/ucm48...
The risk is the business uses capital to acquire stock and defend against these attacks which is the right tactical thing to do.
The real danger though is hackers making secret deals with nefarious hedge funds to attack hard so the company can't defend. Can you imagine if someone made a wide scale assault against a company who's revenue was based purely on its cloud revenue?
The right tactical thing to do is for the company to manipulate it's own share price, so that after news breaks that they're selling defective products their share price won't go down?
>The real danger though is hackers making secret deals with nefarious hedge funds to attack hard so the company can't defend. Can you imagine if someone made a wide scale assault against a company who's revenue was based purely on its cloud revenue?
That might be 'a' real danger, but what you're describing is already illegal and it also doesn't require a hedge fund, you can just demand money directly from the company because you're already committing a crime.
What happened in this case is that a hedge fund made a deal with a firm that did research into a company's products and found that they were defective, the disclosure and the impact of the disclosure on the share price is the best possible outcome.
Of course a company will buy its shares if it sees it irrationally going down. Especially in terms of a vuln which could impact its rep. Finally you want to discourage hackers from profiting off,of,this nonsense.
Blackmailing a company directly is near impossible. Secret deals with a hedge fund are hard to track.
Well maybe if they have a load of extra cash laying around. If they're in the midst of a big recall while trying to keep the rest of the business going, that may not be the case.