Although spending on cybersecurity continues to grow, companies, government agencies, and nonprofit organizations are still being breached, and sensitive personal, financial, and health information is still being compromised. This report sets out the results of a study of consumer attitudes toward data breaches, notifications that a breach has occurred, and company responses to such events.

Consumer Attitudes Toward Data Breach Notifications and Loss of Personal Information

Lillian Ablon, Paul Heaton, Diana Catherine Lavery, Sasha Romanosky

ResearchPublished Apr 14, 2016

Data breaches continue to plague private-sector companies, nonprofit organizations, and government agencies. Despite the mounting rate of these breaches, the continuing harms imposed on consumers and firms, and over a decade of breach notification laws, very little research exists that examines consumer response to these developments. This report sets out the results of a nationally representative survey of the consumer experience with data breaches: the frequency of notifications of data breaches and the type of data taken; consumer attitudes toward data breaches, breach notifications, and company follow-on responses; and perceived personal costs resulting from the breach, with the goal to establish a baseline of information about consumer attitudes toward data loss and company practices in responding to such events. Key findings include: (1) Twenty-six percent of respondents, or an estimated 64 million U.S. adults, recalled a breach notification in the past 12 months; (2) 44 percent of those notified were already aware of the breach; (3) 62 percent of respondents accepted offers of free credit monitoring; (4) only 11 percent of respondents stopped dealing with the affected company following a breach; (5) 32 percent of respondents reported no costs of the breach and any inconvenience it garnered, while, among those reporting some cost, the median cost was $500; and (6) 77 percent of respondents were highly satisfied with the company's post-breach response.

Key Findings

Twenty-six percent of respondents, or an estimated 64 million U.S. adults, recalled receiving a breach notification in the 12-month period before the survey.

  • Higher-income and better-educated respondents were more likely to remember experiencing a breach; younger adults (ages 18–34) and senior citizens (ages 65+) were less likely.
  • More than one-half of those people (51 percent), or an estimated 36 million individuals, received two or more notifications in the year preceding the survey.

Of those who received a notification in their lifetime, 44 percent were already aware of the breach from a source other than the affected company; typically media reports or notifications from a third party.

Sixty-two percent of respondents accepted offers of free credit monitoring.

  • According to respondents, three main factors influenced their decision: (1) time and effort required, (2) quality perception and trust (both of the affected company and of the breach notification service), and (3) whether the offer duplicated other services the victim had.

Only 11 percent of respondents stopped dealing with the affected company following a breach.

  • Thirty-two percent of respondents reported no costs of the breach and any inconvenience it garnered; among those reporting some cost, the median cost was $500. Median dollar values were higher if health information ($1,000), social security numbers ($1,000), or other financial information ($864) was compromised.
  • Just under 6 percent said that the inconvenience cost them $10,000 or more. For these, the breach typically involved credit card or health information.

Seventy-seven percent of respondents were highly satisfied with the company's post-breach response.

  • Most respondents (77 percent) were highly satisfied with the company's breach response. The greatest difference was with ethnic minorities, who were less likely to be satisfied with the company's breach response and more likely to both place a higher dollar value on the inconvenience caused by the breach and cease doing business with the company.

Respondents recommended several steps companies could take to better protect their data.

  • The steps that would highly satisfy most respondents were (1) take measures to ensure that a similar breach cannot occur in the future (68 percent), (2) offer free credit monitoring or similar services to ensure that lost data is not misused (64 percent), and (3) notify consumers immediately (63 percent). All three of these actions were valued more highly than receiving financial compensation for the inconvenience.

Order a Print Copy

Format
Paperback
Page count
78 pages
List Price
$16.50
Buy link
Add to Cart

Topics

Document Details

  • Copyright: RAND Corporation
  • Availability: Available
  • Year: 2016
  • Print Format: Paperback
  • Paperback Pages: 78
  • Paperback Price: $16.50
  • Paperback ISBN/EAN: 978-0-8330-9312-7
  • DOI: https://doi.org/10.7249/RR1187
  • Document Number: RR-1187-ICJ

Citation

RAND Style Manual

Ablon, Lillian, Paul Heaton, Diana Catherine Lavery, and Sasha Romanosky, Consumer Attitudes Toward Data Breach Notifications and Loss of Personal Information, RAND Corporation, RR-1187-ICJ, 2016. As of April 7, 2025: https://www.rand.org/pubs/research_reports/RR1187.html

Chicago Manual of Style

Ablon, Lillian, Paul Heaton, Diana Catherine Lavery, and Sasha Romanosky, Consumer Attitudes Toward Data Breach Notifications and Loss of Personal Information. Santa Monica, CA: RAND Corporation, 2016. https://www.rand.org/pubs/research_reports/RR1187.html. Also available in print form.
BibTeX RIS

The research described in this report was conducted by the RAND Institute for Civil Justice, a part of RAND Justice, Infrastructure, and Environment.

This publication is part of the RAND research report series. Research reports present research findings and objective analysis that address the challenges facing the public and private sectors. All RAND research reports undergo rigorous peer review to ensure high standards for research quality and objectivity.

This document and trademark(s) contained herein are protected by law. This representation of RAND intellectual property is provided for noncommercial use only. Unauthorized posting of this publication online is prohibited; linking directly to this product page is encouraged. Permission is required from RAND to reproduce, or reuse in another form, any of its research documents for commercial purposes. For information on reprint and reuse permissions, please visit www.rand.org/pubs/permissions.

RAND is a nonprofit institution that helps improve policy and decisionmaking through research and analysis. RAND's publications do not necessarily reflect the opinions of its research clients and sponsors.