Reacting to Cyber Breaches: How People Are Affected By the Leaking of Data

Prof. Frederic Schlackl’s research examines how people react to news of data breaches, and, in particular, how specific a breach must feel before it changes attitudes or behaviour. His work addresses a gap in existing research by distinguishing between different ways people may be affected: hearing about a breach at a company they have no relation with, learning about a breach at a company they do business with, or being told that their own data has been compromised.

 

Through a series of online experiments, Prof. Schlackl and his team studied consumer reactions across scenario-based studies and real-world breaches, including cases in Canada and the Netherlands. Participants were asked about trust, attitudes toward companies, negative word of mouth, willingness to switch providers, and willingness to pay for products or services. The studies compared reactions across different experimental conditions, including people who could not be affected by a breach and people who might plausibly be affected.

 

A central finding is that consumers often do not react strongly to breaches at companies they already do business with unless there is a clear indication that their own data was compromised. Surprisingly, people may judge a company more critically when the breach occurs at a firm they do not do business with. These findings have implications for researchers, companies, and policymakers by showing that consumer reactions alone may not be strong enough to incentivize firms to improve data security, reinforcing the importance of regulation and careful reputation management.

While a paper is currently being written, the pilot study was published in the procedings of the 2024 Workshop on Information Security and Privacy. The study is available at the following link: https://aisel.aisnet.org/wisp2024/14/