Reactions by Actual Data Breach Victims over Time: Evidence from Facebook’s Cambridge Analytica Breach

When a data breach happens, both victims, whose data were breached, and nonvictims react negatively but not equally so. In this study, we used Facebook’s Cambridge Analytica data breach to identify to what extent reactions of data breach victims go beyond those of nonvictims. Our findings reveal that victims initially lose more trust, feel more violated, feel more strongly that a psychological contract has been breached, feel less belonging on Facebook, and intend to continue using Facebook less. However, these effects are short-lived, disappearing within six months. Intuitively, one might assume that this is because people are locked in on Facebook and are forced to change their attitudes because they cannot change their behavior by leaving it. Surprisingly, a follow-up experiment shows that this is not the case as we found people who are less locked in to improve their attitudes more over time. Our study adds to the mounting evidence that consumers are unable to act when their data are breached and their privacy is violated and that regulation may be needed to better protect data. The short-lived nature of victims’ reactions we identified in this case also raises questions about the role of postbreach compensation in different contexts.