An Investigation of the Impact of Data Breach Severity on the Readability of Mandatory Data Breach Notification Letters: Evidence From U.S. Firms

Abstract

The aim of this article is to investigate the impact of data breach severity on the readability of mandatory data breach notification letters. Using a content analysis approach to determine data breach severity attributes (measured by the total number of breached records, type of data accessed, the source of the data breach, and how the data were used), in conjunction with readability measures (reading complexity, numerical intensity, length of letter, word size, and unique words), 512 data breach incidents from 281 U.S. firms across the 2012-2015 period were examined. The results indicate that data breach severity has a positive impact on reading complexity, length of letter, word size, and unique words, and a negative impact on numerical terms. Interpreting the results collectively through the lens of impression management, it can be inferred that business managers may be attempting to obfuscate bad news associated with high data breach severity incidents by manipulating syntactical features of the data breach notification letters in a way that makes the message difficult for individuals to comprehend. The study contributes to the information studies and impression management behavior literatures by analyzing linguistic cues in notifications following a data breach incident.

Delegation in a multi-tier court system: Are remands in the U.S. federal courts driven by moral hazard?

“…44 Diction has already been used in the literature to analyze texts from different fields, such as accounting (Arslan-Ayaydin et al, 2016;Cho et al, 2010), management (Sydserff and Weetman, 2002), political science (e.g. Hart and Childers, 2005), and -more recentlyalso legal disclosures (Jackson et al, 2019). As a recognized rigorous empirical method (for a review, see Patelli and Pedrini, 2014), it seems appropriate also for analyzing judicial decisions.…”

From an Authentication Question to a Public Social Event: Characterizing Birthday Sharing on Twitter

“…Even today, some organizations such as phone companies and banks still use DOB as one of several authentication questions when users phone in (Kaur et al 2020;Lee et al 2020;Robinson 2019). The treatment of DOB as private data can also be seen in the European GDPR regulation where DOB is legally considered to be personal data (Commission 2020) and is also regularly reported in data breach reports to the public as important personal information that may or may not have been lost during the breach (Jackson, Vanteeva, and Fearon 2019). Still, the use of DOB in authentication these days is significantly lower compared to a couple of decades ago before the spread of social media.…”