Nav: Home

Few consumers penalize companies after data breach, study finds

April 14, 2016

About a quarter of American adults reported that they were notified about their personal information being part of a data breach in the previous year, but only 11 percent of those who have ever been notified say they stopped doing business with the hacked company after the event occurred, according to a new RAND Corporation study.

The findings are from one of the first examinations of consumers' experiences with data breaches and the impact it has on their relationships with the companies that lose their personal information.

"While data breaches have become an alarmingly common part of American life, most people appear satisfied with companies' responses to data breaches and few decide to take their business elsewhere," said lead author Lillian Ablon, a cybersecurity and emerging technologies researcher at RAND, a nonprofit research organization. "It's unclear whether this response will induce companies to improve their breach notification practices."

The RAND survey found that among those who remembered receiving a data breach notification at any time over their lifetime, about 44 percent said they were aware of the hack even before they received notification. About 10 percent discovered the breach by identifying suspicious activity themselves.

Surprisingly, 62 percent of consumers reported they accepted offers of free credit monitoring. This counters claims made by others that consumers are experiencing "breach fatigue" -- where consumers become desensitized to the notices and either discount them or ignore important information contained in the notices.

The three main reasons for declining such offers were the time and effort required to register for the service, concerns about the hacked company or the breach notification service, and whether the offer duplicated services the victim already had.

More than three-quarters of those surveyed (77 percent) said they were highly satisfied with the company's post-breach response. However, ethnic minorities were less likely to report being satisfied with the company's breach response, placed a higher dollar value on the inconvenience caused by the breach and were more likely to cease doing business with the related company.

"Our research shows the importance of legislation that requires companies to notify individuals when a breach occurs," Ablon said. "Data breach notification laws empower consumers to take quick action to reduce risk and create incentives for companies to improve data security. Unfortunately, data breach laws are not uniform or even present for every state."

While most states have laws requiring that consumers be notified of data breaches, three states -- Alabama, New Mexico and South Dakota -- have no such legislation. Survey participants in those three states reported lower rates of having ever received a data breach notice as compared to people from states with notification laws, although the difference was not statistically significant.

The survey questioned a nationally representative sample of 2,038 adults who participate in the RAND American Life Panel, an Internet-based survey panel.

The survey was fielded between May 15 and June 1, 2015, and designed to provide a snapshot of the frequency of breach notifications and the types of data compromised, as well as consumer reactions to the breach, the notification process and the affected company. The survey also examined estimates regarding the perceived personal cost of the breach, as well as suggestions regarding future notifications and data protection measures.

Among those experiencing a data breach during their lifetime, people with higher income and those with more education were more likely to recall being notified of a breach, as compared to younger adults (ages 18-34) and senior citizens (ages 65 and older). More than 12 percent of those surveyed received two or more notifications in the year preceding the survey.

Ablon said the low proportion of consumers who penalized a company for a data breach may highlight that while a consumer always can to choose to shop at another retailer, it is more difficult to make a switch when a data breach hits a person's health insurer, mortgage company or employer.

Among survey participants who estimated a dollar-equivalent cost for the inconvenience caused by a data breach, the median amount was $500. Thirty-two percent felt the breach imposed no dollar loss to them. Median dollar values were higher if health information ($1,000), social security numbers ($1,000) or other financial information ($864) was compromised. Just under 6 percent of those who had ever received a data breach notification (or an estimated 6 million U.S. adults) felt that the inconvenience cost them $10,000 or more. Of those who experienced an extreme inconvenience, the breach typically involved credit card or health information.

Respondents recommended several steps companies could take to better protect personal information. The steps that would highly satisfy most respondents included taking measures to ensure a similar breach cannot occur in the future, offering free credit monitoring to make sure lost data is not misused and notifying consumers immediately. All three were valued more highly than receiving compensation for financial loss or an apology from the company.
-end-
The study, "Consumer Attitudes Toward Data Breach Notifications and Loss of Personal Information," can be found at http://www.rand.org. Other authors of the study include Paul Heaton, Diana Lavery and Sasha Romanosky.

The study was funded by and conducted within the RAND Institute for Civil Justice, a program that is dedicated to improving the civil justice system by supplying policymakers and the public with rigorous and nonpartisan research. Its studies identify trends in litigation and inform policy choices concerning liability, compensation, regulation, risk management and insurance.

RAND Corporation

Related Consumers Articles:

Should patients be considered consumers?
No, and doing so can undermine efforts to promote patient-centered health care, write three Hastings Center scholars in the March issue of Health Affairs.
Consumers choose smartphones mostly because of their appearance
The more attractive the image and design of the telephone, the stronger the emotional relationship that consumers are going to have with the product, which is a clear influence on their purchasing decision.
When consumers don't want to talk about what they bought
One of the joys of shopping for many people is the opportunity to brag about their purchases to friends and others.
As consumers, how do we decide what's 'best' when it's not clear?
Imagine you are choosing between two resorts for your island vacation.
Effects of ethnocentrism on consumers
Aitor Calvo-Turrientes, winner of the prize for End-of-Degree Project in Sustainability in 2015 awarded by the Faculty of Economics and Business of the UPV/EHU-University of the Basque Country in Vitoria-Gasteiz, is the author of the paper 'The valuation and purchase of food products that combine local, regional and traditional features: The influence of consumer ethnocentrism,' published recently by the prestigious journal Food Quality and Preference.
Organic consumers mean business
Groundbreaking research from Aarhus BSS shows that organic consumers are standing fast and are buying more and more organic products following an increasingly predictable pattern.
Perfect mannequins a turnoff for some consumers
Mannequins' long legs, tiny waistlines and perfect busts can sour some shoppers on the products they're wearing, especially consumers who don't like the look of their own bodies.
What's in a name? For young Chinese consumers, it's about culture mixing
Younger, more cosmopolitan Chinese consumers tend to favor brand translations that keep both the sound and the meaning of the original name, says U. of I. business professor and branding expert Carlos J.
Why do consumers participate in 'green' programs?
From recycling to reusing hotel towels, consumers who participate in a company's 'green' program are more satisfied with its service, finds a new study co-led by a Michigan State University researcher.
Consumers care about carbon footprint
How much do consumers care about the carbon footprint of the products they buy?
More Consumers News and Consumers Current Events

Top Science Podcasts

We have hand picked the top science podcasts of 2019.
Now Playing: TED Radio Hour

Accessing Better Health
Essential health care is a right, not a privilege ... or is it? This hour, TED speakers explore how we can give everyone access to a healthier way of life, despite who you are or where you live. Guests include physician Raj Panjabi, former NYC health commissioner Mary Bassett, researcher Michael Hendryx, and neuroscientist Rachel Wurzman.
Now Playing: Science for the People

#544 Prosperity Without Growth
The societies we live in are organised around growth, objects, and driving forward a constantly expanding economy as benchmarks of success and prosperity. But this growing consumption at all costs is at odds with our understanding of what our planet can support. How do we lower the environmental impact of economic activity? How do we redefine success and prosperity separate from GDP, which politicians and governments have focused on for decades? We speak with ecological economist Tim Jackson, Professor of Sustainable Development at the University of Surrey, Director of the Centre for the Understanding of Sustainable Propserity, and author of...
Now Playing: Radiolab

An Announcement from Radiolab