When the Data Are Out: Measuring Behavioral Changes Following a Data Breach

Dana Turjeman () and Fred M. Feinberg ()
Additional contact information
Dana Turjeman: Arison School of Business, Reichman University, Herzliya 4610101, Israel
Fred M. Feinberg: Ross School of Business and Department of Statistics, University of Michigan, Ann Arbor, Michigan 48109

Marketing Science, 2024, vol. 43, issue 2, 440-461

Abstract: As the quantity and value of data increase, so do the severity of data breaches and customer privacy invasions. Although firms typically publicize their post hoc protective actions, little is known about the aftereffects of major breaches on users’ behaviors; do they alter their interactions with the firm, continue “business as usual,” or do something more subtle? We explore these questions in the context of a severe data breach to a matchmaking website for those seeking an (extramarital) affair. A challenge to measuring “treatment effects” for a massive and highly publicized breach is the lack of an obvious control group. To resolve this problem, we propose Temporal Causal Inference (TCI); each group of users who joined during a given time window is matched with an appropriate (control) group of users who had joined prior to it, helping to account for “usage trajectories” in both individual and temporal site behavior. Following the creation of the control groups, we adapt Causal Forests ( Athey et al. 2019 ) into Temporal Causal Forests (TCF). TCF allows for insights regarding both average and individual-level treatment (data breach) effects as well as both demographic and usage-based covariates that align with them. Our analyses reveal a decrease in the probability of searching and messaging on the website and a notable increase in the probability of deleting photos, the primary avenue for avoiding further personal identification. Moreover, these effects are broadly robust to a variety of causal inference methodologies, both with and without TCI or Causal Forests. Intriguingly, these initially negative reaction(s) did not persist; by the third week after the announcement, there were hints of “life returns to normal.” Despite the specificity of the setting, our analysis suggests both managerial and policy imperatives to help protect customers’ privacy.

Keywords: data breaches; privacy; exogenous shocks; usage trajectories; causal inference (search for similar items in EconPapers)
Date: 2024
References: View references in EconPapers View complete reference list from CitEc
Citations: View citations in EconPapers (1)

Downloads: (external link)
http://dx.doi.org/10.1287/mksc.2019.0208 (application/pdf)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:inm:ormksc:v:43:y:2024:i:2:p:440-461

Access Statistics for this article

More articles in Marketing Science from INFORMS Contact information at EDIRC.
Bibliographic data for series maintained by Chris Asher ().