Data breaches involve information being accessed by unauthorized parties. Our research concerns user perception of data breaches, especially issues relating to accountability. A preliminary study indicated many people had weak understanding of the issues, and felt they themselves were somehow responsible. We speculated that this impression might stem from organizational communication strategies. We therefore compared texts from organizations with external sources, such as the news media. This suggested that organizations use well-known crisis communication methods to reduce their reputational damage, and that these strategies align with repositioning of the narrative elements involved in the story. We then conducted a quantitative study, asking participants to rate either organizational texts or news texts about breaches. The findings of this study were in line with our document analysis, and suggest that organizational communication affects the users' perception of victimization, attitudes in data protection, and accountability. Our study suggests some software design and legal implications supporting users to protect themselves and develop better mental models of security breaches. A data breach is a successful malicious attack which leads to the compromise or the loss of data [18] . Personally Identifiable Information (PII) is often stored in organization databases, and if disclosed is at risk of misuse. Depending on the size, scale, and type of stolen information, the potential consequences of a data breach can be huge. A data breach can put people at risk of identity theft, which often happens through fraudulent use of existing accounts like credit cards, online accounts, and Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from permissions@acm.org. insurance. It can also lead to financial loss and emotional distress [22] . Despite the increased awareness of organizations and great emphasis by experts on security mechanisms, many organizations still maintain insufficient security practices on data collection, processing, and storage, so are unable to prevent data breaches and consequent misuse of the data. Several recent occurrences follow this pattern, and data breaches at major companies, like Equifax, have exposed a massive number of consumers' records [17] . Although such events have become commonplace, there appears to be little indication that end-users feel urgency about holding companies to account. A 2016 study reports that by far most consumers kept doing business with companies after breaches [1] , and some high-profile commentary suggests "breach fatigue" has "set a new normal and instill a sense of fatalism -and complacency" [16] . In a small preliminary study, we even found that participants often thought that they themselves were somehow responsible for data breaches. According to Coombs [5] , the reputation of a company is based on the evaluation customers make about it. Customer evaluations can be affected by the behavior of a company when a crisis like a data breach happens. So, due to the significant financial loss and reputational damage caused by data breaches, companies try to reduce the damage using communication strategies in the after-breach notifications [9, 19] . The crisis response strategies aim to reduce the negative effects of the crisis by changing the level of crisis responsibility. For example, if a company frames themselves as victims of the situation and therefore positioned in what crisis communication theorists call the "victim cluster", they are likely to incur little blame for the crisis [5] . User understanding of data breach incidents are important because it allows development of mental models to support reasoning about behavior and accountability [3] . The goal of our research is to explore how breached companies and news media communicate with users, and how that might affect users' perception of a data breach incident. To do so, we apply Image Repair Theory (IRT) [2] and a narrative-semiotics method [8] to the analysis of Equifax crisis communications to see how this incident is reported in the company press releases and the news. We first conducted a communication study based on collected data from 58 stories related to this security breach crisis. We then conducted a questionnaire study with 100 participants testing the influence of companies' notifications and news on the general public. To the best of our knowledge, testing communication strategies' influence on users mental models of a data breach is original, and it shows HCI efforts on building user understanding of security can be undermined by organizational communication. Our results also suggest a need for the improvement of software design, and delicate attention of communication professionals and legal scholars to the notifications created during and after a data breach. The primary goal of our work was to explore how organization communications about data breaches might affect user perception. To do this, we first studied the nature of the communication itself. Using Image Repair Theory, we analyzed press releases posted on official company websites. We found that Equifax press releases had characteristics consistent with tactics to reduce reputational damage and therefore financial loss. Recognizing that the way the news media frames a crisis might be different to the framing in an organization's press releases, we next explored that issue. We used techniques from narrative semiotics to examine the structure of the stories being told, and found that the agents were not positioned the same way. Considering the first narrative story studied, our comparison of the Equifax press releases with news and GAO reports shows important differences with respect to the positioning of Equifax (see Figure 4) . In the press releases, there was emphasis on Equifax as a helper, presenting the company's protection actions. In the news and GAO reports there was emphasis on Equifax as an opponent, presenting the company's weak security protection of consumer data. Moreover, the new media had a focus on the company and its security failure, whereas the company appears to use scapegoating as its primary crisis response strategy [4] and suggesting responsibility lay with a single unnamed IT staff member. The ethics of scapegoating is doubtful [10] , suggesting a manipulative approach used deflect responsibility. The company's apparently lax attitude in crisis response was heavily criticized by the media. The news text suggests Equifax shares responsibility for this incident. However, Equifax positioned itself as a receiver to emphasize it is a victim, a strategy that consistent with an attempt to reduce its responsibility [5] . Equifax appears to map all their actions to the helper category, in a manner consistent with Image Repair Theory. For example, a bolstering strategy places the company in a helper position, deflecting responsibility by shifting the blame, scapegoating puts the company in victim position, and compensation strategies stress the company acts as a helper. However, when the news media narrates the story, the mapping of the actions and agents goes to the opponent category, since the media is not concerned with Image Repair. Our second step was to explore how the strategies used in the company press releases might influence the public understanding of data breaches. We conducted a questionnaire study to see if data breach incident descriptions from different sources, the company's and the news media, result in different perceptions of the incident. After reading the text extracted from the company's press release, participants tended to rate the company's after-breach action and security measures higher. They also thought that the company was helping their customers and did not put them at any risk. However, we got different results from participants who read the news texts reporting the same incident; participants disagreed that the company took the security seriously and their after breach protective actions were not acceptable to help the customers. The company was regarded as a victim after reading the company's description; however, the news approach in narrating the data breach resulted in a different perception of participants. This therefore confirmed our speculations based on our text analysis. It also confirms the effectiveness of IRT and its relevance in crisis communication. Of course, it is not surprising that companies tend to present themselves in a better light that the news media. Nor is it surprising that they used strategies that have been developed to help them to do this. However, our text study shows that their Image Repair strategies exhibit some important characteristics. In particular, they show differences in how agency is presented, which, in turn affects readers' understanding of what happened. In this paper, we presented our study on communication about data breach events which exposed private consumer data. We first analysed Equifax press releases and notifications to identify their the strategies, and then analysed news stories and government reports on the same events; we studied 58 stories in all. We found that the company used crisis communication strategies to reduce its reputational damage and financial loss. Our analysis also showed that there are differences between press releases, major newspaper and technical news when reporting the same data breach incident. In our narrative-semiotic analysis, we found the company mapped their after-breach actions into helper category; but the narrator of news reports mapped them into the opponent category. These narrative changes affected reader perception about these data breaches. Our questionnaire study revealed that the dissimilar approach detected in document analysis when narrating the same story from a different point of view (companies and news) has a considerable influence on the general public's perception of a data breach incident. Large scale data breaches are a serious matter, not just for organizations, but for the thousands or millions of users who have private data exposed, making them vulnerable to a range of consequences. Despite this, it is unclear if users understand what exactly has happened, where accountability lies, and how to proceed. In work on human factors in computer security, it has often been found that users have only weak mental models of online threats and defences, e.g. [20, 3] . When user data is exposed by a large scale data breach, communication with the user may well be primarily from the organization itself. Our research suggests that communication from organizations may misrepresent the data breach events leading to misleading perceptions of the crisis and the company's accountability. Design of software that stores sensitive personal information should support users in maintaining better awareness of data breaches.
"In this paper, we tested communication strategies' influence on users mental models of a data breach."
{"src": "scitldr-AIC_train", "paper_id": "790fK3eKe4"}