Let's rewrite your specification as follows,
$$
ln(F_{it}) = \delta B_{it} + \eta_g + \lambda_t + \epsilon_{it},
$$
where $F_{it}$ is total fees paid to external auditors by firm $i$ in year $t$. The parameters $\eta_g$ and $\lambda_t$ denote industry and year fixed effects, respectively. Firms are grouped by sub-industry, so they nest within the $g$ industries. The variable $B_{it}$ is, in essence, a dichotomous treatment variable representing a firm's "exposure" to a data breach. It's "turning on" (i.e., switching from 0 to 1) when firm $i$ experiences a breach in year $t$, 0 otherwise. According to your definition, we have data before and after the breach, and the timing of the breach varies across firms.
Firms may also experience industry-specific shocks. In such a setting, I suggest estimating the following,
$$
ln(F_{it}) = \delta B_{it} + \nu_{gt} + \epsilon_{it},
$$
where the parameter $\nu_{gt}$ is an industry-year fixed effect, which is computing counterfactual time trends for the industry-year pairs. This allows different industries to have different trends. Note also that we may suspect the industry, year, and industry-year effects to be correlated with other right-hand side variables, so it seems appropriate to estimate $\nu_{gt}$ directly. In practice, estimating $\nu_{gt}$ is akin to including a series of industry $\times$ year interactions.
$\beta_1$(Breach) measures the effect of the data breach on audit fees.
Correct.
The coefficient on the breach dummy is estimating the causal effect of the data breach on audit fees for those firms actually experiencing a data breach.
$\beta_2$(Breach*Year) measures if the effect of $\beta_1$ changes over time or if there is any "year-specific" effect.
Not quite.
To estimate how the effects vary with time since exposure, you should create separate dummies to allow the effects to vary by year. The model would look like the following,
$$
ln(F_{it}) = \sum^{-q}_{\tau = 0} \delta_{\tau} B_{i,t-\tau} + \nu_{gt} + \epsilon_{it},
$$
where we have an arbitrary number of $q$ lags of the breach dummy on the right-hand side. Maybe audit fees increase immediately following a breach, but they don't really persist beyond a few years. In that case, we should expect to see the coefficients on the $\delta_{\tau}$'s wane with the passing of time.
To estimate this in practice, you must create separate breach dummies for each year after the event. Say a firm is breached in 2009. The first lag of the breach variable (i.e., $B_{i,t-1}$) for this particular firm is a dummy that switches on in 2010, 0 otherwise. Likewise, the second lag of the breach variable (i.e., $B_{i,t-2}$) is a dummy that switches on in 2011, 0 otherwise. This is how we investigate whether the effect is varying over time.
But let's talk terminology for a second. It appears you're conflating "time-varying" effects with "year-specific" effects in general. The "year-specific" effects are the year fixed effects. They adjust for the common time shocks. In other words, they represent those yearly macro-shocks that affect all firms in all industries.
Nonetheless, I cannot confirm if it is the right model for measuring the year-specific effect.
The lags of the breach dummy (i.e., $B_{it}$, $B_{i,t-1}$, $B_{i,t-2}$, etc.) investigate "time-varying" effects. The parameter $\nu_{gt}$ is estimating "year-specific" effects, but we're allowing the year-specific effects to vary by industry.
The post you reference departs from your question in a fundamental way. It's addressing the issue of including "time-constant" regressors in a fixed effects model. If you acquired firm level regressors, then include them. The breach indicator is $i$- and $t$-subscripted; it varies over time and across firms. Even if the breach indicator was just a time-constant factor over the sample period, it's still estimable in this setting.
Maybe you want to include time-constant regressors at the level of one of the fixed effects. Say you want to adjust for industry-specific characteristics. Well, the model cannot distinguish between those time-constant, industry level regressors and the industry fixed effects. To get around this, I suggest interacting those fixed industry level variables with the year dummies and look at their effects over time. I will let you review this post for a deeper dive into this discussion.
