How does end users attribute blame following a security breach among the responsible stakeholders?

What is it about?

This paper investigates users' attribution of blame among different entities (e.g., the negligent user, the service provider) following a data breach, and discusses the implications of blame attribution for (pre and post security breach) risk communications.

Featured Image

Photo by Max Bender on Unsplash

Photo by Max Bender on Unsplash

Why is it important?

Attribution of self-blame and self-responsibility has been noted to be a predictor of positive coping response behavior following a negative incident (such as a data breach). Despite being widely studied in psychology, healthcare, and other domains, this relevant construct is comparatively less investigated in the field of usable cybersecurity. This can give a new perspective on how end-users assign responsibility of account security and how they would likely react following a security breach. Would they feel that service providers are the solely responsible stakeholders for their account security, or do they (the end-users) share responsibility for protecting their accounts? Understanding blame attribution following a data breach can help increase our knowledge of user security behavior and how end users will react/take care of their account security following a security breach. The paper includes a discussion and implications of the findings in pre- and post-security breach risk communication.