When the Data Are Out: Measuring Behavioral Changes Following a Data Breach

As the quantity and value of data increase, so do the severity of data breaches and customer privacy invasions. Although firms typically publicize their post hoc protective actions, little is known about the aftereffects of major breaches on users’ behaviors; do they alter their interactions with the firm, continue “business as usual,” or do something more subtle? We explore these questions in the context of a severe data breach to a matchmaking website for those seeking an (extramarital) affair. A challenge to measuring “treatment effects” for a massive and highly publicized breach is the lack of an obvious control group. To resolve this problem, we propose Temporal Causal Inference (TCI); each group of users who joined during a given time window is matched with an appropriate (control) group of users who had joined prior to it, helping to account for “usage trajectories” in both individual and temporal site behavior. Following the creation of the control groups, we adapt Causal Forests ( Athey et al. 2019 ) into Temporal Causal Forests (TCF). TCF allows for insights regarding both average and individual-level treatment (data breach) effects as well as both demographic and usage-based covariates that align with them. Our analyses reveal a decrease in the probability of searching and messaging on the website and a notable increase in the probability of deleting photos, the primary avenue for avoiding further personal identification. Moreover, these effects are broadly robust to a variety of causal inference methodologies, both with and without TCI or Causal Forests. Intriguingly, these initially negative reaction(s) did not persist; by the third week after the announcement, there were hints of “life returns to normal.” Despite the specificity of the setting, our analysis suggests both managerial and policy imperatives to help protect customers’ privacy.