The Effect of Data Breach Announcement on Customer Behavior: Evidence from a Multichannel Retailer

Data breach incidents have become increasingly common and businesses incur enormous costs to recover from such events. In this study, the authors assess the effects of a data breach announcement by a multichannel retailer on customer behavior. They exploit a natural experiment and use individual customer transaction data from the retailer to conduct a detailed and systematic empirical examination of the effects of a data breach announcement on customer spending and channel migration behavior. For the identification of the data breach announcement effects, the authors compare the change in customer behavior before and after the data breach announcement between two groups of customers a treatment group (customers whose information is breached) and a control group (customers whose information is not breached) using the difference-in-differences modeling framework. They find that the data breach results in a significant decrease in customer spending. However, there is a silver lining for the focal multichannel retailer as they find that customers of the firm migrate from the breached to the unbreached channels of the retailer. The findings further reflect that customers with a higher retailer patronage are more forgiving as the negative effects of the data breach announcement are lower for customers with a higher level of patronage. By leveraging data on individual customers’ access to email communication from the retailer after the breach, the authors propose and empirically test for the role of customer data vulnerability as the behavioral mechanism that drives customer behavior subsequent to a data breach announcement. They perform a series of robustness checks (with alternative operationalization of variables, model specifications, and study time periods) and falsification tests to validate the findings. Based on the results, the authors offer prescriptions for managers on how to engage with customers following data breach announcements and elaborate on the role of multichannel strategy in absorbing negative demand shocks.