Are data breaches the new norm? Exploring data breach trends, consumer sentiment, and responses to security invasions

• Published date: 01 July 2023
• Author: Ereni Markos,Priscilla Peña,Lauren I. Labrecque,Kunal Swani
• Date: 01 July 2023
• DOI: http://doi.org/10.1111/joca.12554

RESEARCH ARTICLE

Are data breaches the new norm? Exploring

data breach trends, consumer sentiment, and

responses to security invasions

Ereni Markos

1

| Priscilla Peña

2

| Lauren I. Labrecque

2

|

Kunal Swani

3

1

Sawyer Business School, Suffolk

University, Boston, Massachusetts, USA

2

College of Business, University of Rhode

Island, Kingston, Rhode Island, USA

3

Raj Soin College of Business, Wright

State University, Dayton, Ohio, USA

Correspondence

Lauren I. Labrecque, College of Business,

University of Rhode Island, Kingston, RI,

USA.

Email: lauren33@uri.edu

Abstract

Although data breaches are common, limited knowledge

exists regarding consumer sentiments towards them and

the personal actions taken following a breach. First, we

explore trends using a database chronicling 14 years of

breaches. Then, guided by Social Contract Theory, our

study analyzes a secondary dataset of survey responses

from 890 affected consumers to understand perceptions

of breaches, including attitudes towards businesses,

expected actions businesses take following a breach,

and protective actions. The integration of Social Con-

tract Theory with Privacy Calculus Theory and Protec-

tion Motivation Theory in the study of data breaches

provides a lens to examine how context-specific attri-

butes impact consumer actions following a breach. Our

findings show that data breaches are frequent, vary

across industries, and consumer attitudes and actions

vary by data type compromised.

KEYWORDS

consumer privacy, data breaches, information management

practices, privacy calculus, security invasions, social contract

theory

All authors contributed equally to this work.

Received: 29 July 2021 Revised: 10 May 2023 Accepted: 5 July 2023

DOI: 10.1111/joca.12554

© 2023 American Council on Consumer Interests.

J Consum Aff. 2023;57:1089–1119. wileyonlinelibrary.com/journal/joca 1089

1|INTRODUCTION

An ever-evolving digital marketplace is increasing the rate by which consumer data is collected

and used across businesses and industries. Consumers are using the Internet for a wide range of

activities like connecting with friends on social media, making doctors' appointments online via

healthcare portals, and a vast number of tasks sustained by the Internet of Things (connected

objects that can send, receive, and store consumers' data, also referred to as IoT). The

increased usage of IoT raises concerns since shared data becomes accessible to other devices

and companies that are at risk for potential data breaches (Aguirre et al., 2015;Markos

et al., 2018). Along with the benefits of a digitized economy and the convenience of the Inter-

net come harms and risks for consumers (Citron & Solove, 2022;Martinetal.,2017 ). One

growing challenge for current information collection and storage practices is data breaches—

when external parties gain unauthorized access to consumer information. Given that data

breaches are a seemingly regular occurrence, private information stored in company data-

bases is vulnerable to hacking, fraudulent activity, identity theft, and unauthorized use

(Chang, 2018; Privacy Rights Clearinghouse, 2019).

Data breaches can impact private citizens and businesses that risk financial and reputational

harm due to data loss (Kirk & Noguera, 2019; Martin et al., 2017). In most instances, the com-

pany responsible for the loss will incur a substantial payout, as Equifax did as part of a $500

million dollar settlement and Facebook with a $5 billion dollar fine (Federal Trade

Commission, 2019a,2019b). Data breach expenses can quickly accumulate, such as in the medi-

cal field, where the average cost of each patient's unauthorized records is $429, translating into

large sums across millions of patient records (Davis, 2019). The cost of data breaches is on the

rise with the average cost of a single data incident being $4.24 million (IBM, 2021). The implica-

tions of data breaches become more concerning as Big Tech companies increasingly add data

collection to their products. For example, Apple and Google started contact tracing programs to

track users' geolocation in response to the COVID-19 pandemic. Such new programs raise data

privacy concerns and skepticism around efficient safeguards. At the same time, the Covid-19

pandemic increased telehealth options and put a strain on existing regulations, and privacy

norms (Robbins, 2020).

Though data breaches are common, we know little about how consumers react in the face

of a privacy breach. Our research fills this void by offering insights into how consumers respond

to breaches in terms of their protection actions and expectations. Even more, we explore how

different information types can affect consumer responses following a data breach and find that

consumers act depending on the type of information breached. This is important because law-

makers can take this into consideration when creating and updating legislation for data breach

notifications policies and protocols (Solove & Hartzog, 2022). Integrating Privacy Calculus The-

ory, Social Contract Theory, and Protection Motivation Theory in the study of data breaches

allows us to examine how context-specific attributes impact consumer actions following a

breach. Social Contract Theory provides the underlying framework for understanding consumer

reactions following a data breach. A data breach facilitates the breaking of a social contract;

once broken, consumers must decide whether to take action to remedy the privacy breach or

not, and then decide if they will continue to do business (i.e., make a purchase or use a service)

with the company that broke the social contract. Following a data breach, consumers reevaluate

privacy calculations that consider the event as they consider what to do after such an event

(Privacy Calculus Theory), which includes potential protection behaviors (Protection Motiva-

tion Theory).

1090 MARKOS ET AL.