Another Day, Another Data Breach

Data breaches, which compromise the confidentiality of customer data that a companystores, have become a common problem for many companies today. Due to sophisticatedattacks that are evolving constantly, companies have no chance to prevent data breachescompletely. Once a company becomes a victim of a data breach, it is legally obligated todisclose the event to its affected customers. This announcement often leads to a financialdisaster due to public disclosure of a data breach that negatively impacts a company¿smarket value, as well as customers¿ relationship with the company, and in a worst-casescenario, it can threaten the company¿s very existence.Currently, recommendations and standards to minimize these losses are lacking, butaffected companies do not remain inactive and react ad hoc to the double-edged negativeconsequences by developing strategies, the so-called response strategy, to limit damagethrough the public announcement of the data breach. However, it remains unclearwhether and how these response strategies make an impact.This dissertation analyzes response strategies¿ effects via four studies and clarifieswhether and how these strategies can impact negative consequences. The studies¿results indicate that response strategies always comprise a combination of severalresponse actions. An examination of real response strategies can be used to clarify whichresponse actions currently are practiced to follow up with a detailed analysis. Thisanalysis indicated that the studied response actions justification, apology, andcompensation affect market value and customer relationships. Using expectationconfirmationtheory and signaling theory, these response actions¿ mechanismsubsequently is uncovered and explained: The mechanism is two-dimensional, and theresponse actions elicit direct and side effects. These must be considered equally toensure successful implementation of response actions.