  A digital security breach, by which confidential information is leaked, does
not only affect the agent whose system is infiltrated, but is also detrimental
to other agents socially connected to the infiltrated system. Although it has
been argued that these externalities create incentives to under-invest in
security, this presumption is challenged by the possibility of strategic
adversaries that attack the least protected agents. In this paper we study a
new model of security games in which agents share tokens of sensitive
information in a network of contacts. The agents have the opportunity to invest
in security to protect against an attack that can be either strategically or
randomly targeted. We show that, in the presence of random attack,
under-investments always prevail at the Nash equilibrium in comparison with the
social optimum. Instead, when the attack is strategic, either under-investments
or over-investments are possible, depending on the network topology and on the
characteristics of the process of the spreading of information. Actually,
agents invest more in security than socially optimal when dependencies among
agents are low (which can happen because the information network is sparsely
connected or because the probability that information tokens are shared is
small). These over-investments pass on to under-investments when information
sharing is more likely (and therefore, when the risk brought by the attack is
higher).
