Data breaches are not only on the increase but firms struggle to detect, defend and respond to such breaches. A data breach opens a period of crisis for the affected firm, generates complex information, and requires providing information to a variety of stakeholders in a timely and proper manner. This article reports one of the first studies on the impact of social media exposure by affected firms on stock price reaction to a data breach announcement. Using an event study methodology on a sample of 87 data breaches from 73 US publicly-traded firms from 2011 to 2014, we find that use of social media exposure at the time of a data breach exacerbates the negative stock price to the announcement. Interestingly, we find that this negative association is contingent on traditional media visibility; the effect is positive for low-visibility companies. Based on our results, we posit that there is a need for a contingency model for social media communication during firm crises and such a model should be based at least on firm size, visibility and the type of crisis.