Another Day, Another Data Breach

Data breaches, which compromise the confidentiality of customer data that a company

stores, have become a common problem for many companies today. Due to sophisticated

attacks that are evolving constantly, companies have no chance to prevent data breaches

completely. Once a company becomes a victim of a data breach, it is legally obligated to

disclose the event to its affected customers. This announcement often leads to a financial

disaster due to public disclosure of a data breach that negatively impacts a company¿s

market value, as well as customers¿ relationship with the company, and in a worst-case

scenario, it can threaten the company¿s very existence.

Currently, recommendations and standards to minimize these losses are lacking, but

affected companies do not remain inactive and react ad hoc to the double-edged negative

consequences by developing strategies, the so-called response strategy, to limit damage

through the public announcement of the data breach. However, it remains unclear

whether and how these response strategies make an impact.

This dissertation analyzes response strategies¿ effects via four studies and clarifies

whether and how these strategies can impact negative consequences. The studies¿

results indicate that response strategies always comprise a combination of several

response actions. An examination of real response strategies can be used to clarify which

response actions currently are practiced to follow up with a detailed analysis. This

analysis indicated that the studied response actions justification, apology, and

compensation affect market value and customer relationships. Using expectationconfirmation

theory and signaling theory, these response actions¿ mechanism

subsequently is uncovered and explained: The mechanism is two-dimensional, and the

response actions elicit direct and side effects. These must be considered equally to

ensure successful implementation of response actions.