Out of sight, out of mind: consumer reaction to news on data breaches and identity theft

We use the 2012 South Carolina Department of Revenue data breach to study how data breaches and news coverage about them affect consumers? take-up of fraud protections. In this instance, we find that a remarkably large share of consumers who were directly affected by the breach acquired fraud protection services immediately after the breach. In contrast, the response of consumers who were not directly exposed to the breach, but who were exposed to news about it, was negligible. Even among consumers directly exposed to the data breach, the incremental effect of additional news about the breach was small. We conclude that, in this instance, consumers primarily responded to clear and direct evidence of their own exposure to a breach. In the absence of a clear indication of their direct exposure, consumers did not appear to revise their beliefs about future expected losses associated with data breaches.