We Care About Your Privacy (When It Matters): How Firms Strategically Respond to Data Breach Incidents

With a growing concern for consumer data and online privacy, regulators around the world are placing numerous measures to educate individuals with their privacy choices and to require firms to prioritize consumer privacy. Past studies have reported that privacy protection failure, mainly data breach incidents, negatively affects firms’ performances, but less is known about how firms change their business strategies. This paper studies how firms adjust their strategic emphasis, specifically between creating value for the consumers and appropriating value to protect their current businesses, after security incidents. Based on 70 data breach experienced by US public firms from 2005 to 2014, findings show that firms on average shift their strategic emphasis to fixing the problem through increasing R&D expenses relative to advertising expenses, moderated by the firms’ internal and external resource profiles. The research hopes to contribute to the growing marketing literature on privacy.