What to do after a data breach? Examining apology and compensation as response strategies for health service providers

Abstract

Innovative IT-enabled health services promise tremendous benefits for customers and service providers alike. Simultaneously, health services by nature process sensitive customer information, and data breaches have become an everyday phenomenon. The challenge that health service providers face is to find effective recovery strategies after data breaches to retain customer trust and loyalty. We theorize and investigate how two widely applied recovery actions (namely apology and compensation) affect customer reactions after a data breach in the specific context of fitness trackers. Drawing on expectation confirmation theory, we argue that the recovery actions derived from practice, apology, and compensation address the assimilation-contrast model’s tolerance range and, thus, always lead to satisfaction with the recovery strategy, which positively influences customers’ behavior. We employ an experimental investigation and collect data from fitness tracker users during a running event. In the end, we found substantial support for our research model. Health service providers should determine specific customer expectations and align their data breach recovery strategies accordingly.

Functional or financial remedies? The effectiveness of recovery strategies after a data breach

“…Based on these two recovery strategies, most privacy breach literature investigates the impacts of apology and compensation on consumers' coping responses to a data breach (e.g. Wang et al, 2022;Masuch et al, 2022;Hoehle et al, 2021;Masuch et al, 2021;Chatterjee et al, 2019;Nikkhah and Grover, 2022;Schlackl et al, 2022). For example, Masuch et al (2020) argued that compensation and remorse positively influence users' confirmation and satisfaction.…”

“…Furthermore, although a few studies have shed light on the effectiveness of recovery strategies in mitigating the adverse impact of data breaches on consumers (e.g. Chen and Jai, 2021; Labrecque et al ., 2021; Masuch et al ., 2021), limited research has examined the potential boundary conditions that may influence the relative effectiveness of different recovery strategies. Drawing on expectation confirmation research (e.g.…”

Threat Actors’ Tenacity to Disrupt: Examination of Major Cybersecurity Incidents

“…The data about major data breach incidents as we observed in this study, suggests that the likelihood major incident will lead to a major data breach incident is certain. In addition to a thorough investigation, and incident response plan, it is also highly recommended that every organization have a recovery VOLUME 4, 2016 plan in place to address data breach incidents when it happens [30], [61], [62].…”