“Suffered from sounds so dramatic, no one has died.” : A qualitative study on individuals perceptions, emotions, and affect after a cybersecurity crisis

With the rapid increase in cyberattacks resulting in cybercrisis, it becomes central to identify how individuals perceive, understand, and are affected by a cybersecurity crisis. Insight could benefit future communication efforts to increase cybersecurity awareness and behavior among individuals. While cybersecurity issues have risen on the Swedish political agenda, authorities still struggle with developing “cyberhygiene” in the general society. Previous research has investigated the interplay between behavioral recommendations and trust between organizations and individuals during and after a crisis. However, research on actual people in real-life settings affected by a cybersecurity crisis has been lacking due to the difficulty in operationalizing in a real-life scenario, especially after a crisis. The main objective of this qualitative study was to explore how individuals after a cybersecurity crisis understood and reflected on the crisis, with special attention paid to threat perception and emotions. Individuals from Vellinge municipality, who experienced a larger cyberattack knocking out central municipality IT systems, were interviewed. Data was gathered from indepth semi-structured interviews and analyzed through the lens of EPPM (the Extended Parallel Process Model). The analysis revealed that individuals shared common reasoning and perceptions. First, respondents are semi-dependent on interpersonal relationships for information on digital safety practices, and exhibit high trust towards experts and authorities, which is consistent with previous research; however, this dependence and trust can lead to maladaptive, avoidant behavior instead of engaging themself in cybersecurity. Secondly, individuals perceived cybercrisis through three primary emotions: anger, fear, and anxiety. Third, the respondents felt that the crisis had acted as a “wake-up” call, thus making them more aware of the threat severity and susceptibility; however, threat perceptions heavily depend on individual differences. The findings suggest that cyberattacks are mainly understood as a technological topic, and a lack of awareness leads to citizens being overwhelmed with inefficient psychological reactions. There is still a clear need to heighten cybersecurity awareness and safety practices in society through information that is easy to access and understand in all demographic contexts.