Another Day, Another Data Breach

Data breaches, which compromise the confidentiality of customer data that a company stores, have become a common problem for many companies today. Due to sophisticated attacks that are evolving constantly, companies have no chance to prevent data breaches completely. Once a company becomes a victim of a data breach, it is legally obligated to disclose the event to its affected customers. This announcement often leads to a financial disaster due to public disclosure of a data breach that negatively impacts a company's market value, as well as customers' relationship with the company, and in a worst-case scenario, it can threaten the company's very existence. Currently, recommendations and standards to minimize these losses are lacking, but affected companies do not remain inactive and react ad hoc to the double-edged negative consequences by developing strategies, the so-called response strategy, to limit damage through the public announcement of the data breach. However, it remains unclear whether and how these response strategies make an impact. This dissertation analyzes response strategies' effects via four studies and clarifies whether and how these strategies can impact negative consequences. The studies' results indicate that response strategies always comprise a combination of several response actions. An examination of real response strategies can be used to clarify which response actions currently are practiced to follow up with a detailed analysis. This analysis indicated that the studied response actions justification, apology, and compensation affect market value and customer relationships. Using expectationconfirmation theory and signaling theory, these response actions' mechanism subsequently is uncovered and explained: The mechanism is two-dimensional, and the response actions elicit direct and side effects. These must be considered equally to ensure successful implementation of response actions.