Risk and Anxiety: A Theory of Data Breach Harms

Concepts, Methodologies, Tools and Applications

As information technology has become more ubiquitous and pervasive, assurance and security concerns have escalated; in response, we have seen noticeable growth in public policy aimed at bolstering cybertrust. With this growth in public policy, questions regarding the effectiveness of these policies arise. This chapter focuses on policy analysis of the state data breach disclosure laws recently enacted in the United States. The state data breach disclosure laws were chosen for policy analysis for three reasons: the rapid policy growth (the United States have enacted 45 state laws in 6 years); this is the first instantiation of informational regulation for information security; and the importance of these laws to identity theft and privacy. The chapter begins with a brief history in order to provide context. Then, this chapter examines the way in which historical, political and institutional factors have shaped our current data breach disclosure policies, focusing on discovering how p...

International Journal of Engineering Applied Sciences and Technology

Data breach has become one of the serious problems in recent years as with the increase in technology the threat of data security is increasing. This paper mainly focuses on giving information about causes of data spill and prevention methods an organisation or individual should adopt to prevent themselves from such a threat.

Business & Information Systems Engineering, 2014

In an experiment, the authors distinguish between the impact of privacy violations and security breaches on the subjects' trust and behavior. They focus on first-order effects and thus the direct consumer reaction. While privacy is of prime importance for building trust, the actual behavior is affected less and customers value security higher when it comes to actual decision making. Evidence is found for the so-called "privacy paradox" which describes that people do not act according to their privacy concerns.

Journal of Information Policy, 2020

This article investigates the relationship between data breaches and identity theft, including the impact of Data Breach Notification Laws (DBNL) on these incidents (using empirical data and Bayesian modeling). We collected incident data on breaches and identity thefts over a 13-year timespan (2005–2017) in the United States. Our analysis shows that the correlation is driven by the size of a state. Enacting a DBNL still slightly reduces rates of identity theft; while publishing breaches notifications by Attorney Generals helps the broader security community learning about them. We conclude with an in-depth discussion on what the European Union can learn from the US experience.

MIS Quarterly, 2022

Companies may face serious adverse consequences as a result of a data breach event. To repair the potential damage to relationships with stakeholders after data breaches, companies adopt a variety of response strategies. However, the effects of these response strategies on the behavior of stakeholders after a data breach are unclear; differences in response times may also affect these outcomes, depending on the notification laws that apply to each company. As part of a multi-method study, we first identify the adopted response strategies in Study 1 based on content analysis of the response letters issued by publicly traded U.S. companies (n = 204) following data breaches; these strategies include any combination of the following: corrective action, apology, and compensation. We also find that breached companies may remain silent and adopt a no action strategy. In Studies 2 and 3, we examine the effects of various response strategies and response times on the predominant stakeholders affected by data breaches: customers and investors. In Study 2, we focus on customers and present a moderated-moderated-mediation model based on the expectancy violation theory. To test this model, we design a factorial survey with 15 different conditions (n = 811). In Study 3, we focus on investors and conduct an event study (n = 166) to examine their reactions to company responses to data breaches. The results indicate the presence of moderating effects of certain response strategies; surprisingly, we do not find compensation to be more effective than apology. Further, the magnitude of the moderating effects of response strategies is contingent upon response time. We also find that the negative effects of data breaches disappear after 6 months. We interpret the results and provide implications for research and practice.

Proceedings of the 53rd Hawaii International Conference on System Sciences, 2020

This preliminary research addresses the technology use uncertainties that arise when users are presented with protective technologies following a data breach or privacy violation announcement. Prior studies have provided understanding of determinants of technology use through several perspectives. The study complements prior research by arguing that, beyond individual dispositions or technology features, data breach announcements bring users' focus on the actions of the breaching organization. Fair process and information practices provide avenue for organizations to alleviate users' concerns and increase service usage. We draw on organizational justice theory to develop a model that explicates the effect of organizational fairness process and use of technologies. We test this model using data from 200 Facebook users recruited from Amazon MTurk. We found that procedural and informational justice have differential effect on users' desire to use protective technologies. Our findings have both theoretical and practical implications.

Zenodo (CERN European Organization for Nuclear Research), 2022

In this Digital world, Data has become one of the most crucial parts in every field. To protect this sensitive piece of information many methods and technologies are coming into existence. A data breach reveals sensitive, protected and confidential information to an unauthorized person. Increasingly opportunities exist for information to leak out as our computers and mobile devices become more associated. Data leaks pose a serious threat to companies and can cost them significantly either financially and reputationally. The long-term effects of a data breach can spread throughout a company, having an effect on all parties involved, including the user base, staff, and cybersecurity teams in charge of repair. By giving priority to the most frequently attacked industries, this article will advance understanding about data hacking incidents and aid in securing corporate data.

arXiv preprint arXiv:1203.3870, 2012

Abstract: Every time the customer (individual or company) has to release personal information to its service provider (eg, an online store or a cloud computing provider), it faces a trade-off between the benefits gained (enhanced or cheaper services) and the risks it incurs (identity theft and fraudulent uses). The amount of personal information released is the major decision variable in that trade-off problem, and has a proxy in the maximum loss the customer may incur. We find the conditions for a unique optimal solution to exist for ...

2014

With hackers being active in their attempts to steal customer information, prior research has focused on how information breach influences firms at an aggregate level. We examine consumers' decision at the individual level and find that consumers would feel safer to stay with the breached firm if attack is random.

2020

This study clarifies the characteristics of the perceived risk of personal data release and the required protection as a preliminary step toward a comprehensive understanding of data sensitivity, and has long been regarded as the key parameter distinguishing data that should be protected from data that should be utilised. Few studies have empirically considered the cognitive characteristics of data sensitivity. It is essential to consider both perceived risk and desired protection when seeking a comprehensive understanding of data sensitivity. Thus, we quantitatively examined the characteristics of both components using four types of personal data (two of which are considered sensitive under Japanese law). The authors surveyed 420 Japanese subjects and analysed the results using the Friedman test and the Mann-Whitney Utest. The perceived risks and desired protections differed significantly among the four types of data, and legally defined data sensitivities did not always explain the observed differences. The extent of interest in personal data increased the perceived risk and the desire for protection. The effects of various personal factors including gender and the tendency to self-protect were relatively weak, so further analysis is required. We discuss the remaining issues and future research directions.