## 2 Study Design  
The objective of this study was to examine individuals' emotional experiences of cybersecurity breaches on their IoT devices. This objective applies to both the online scenario study (Study 1) and the field experiment (Study 2). For this purpose, we constructed cybersecurity breach scenarios for five different IoT devices within the home, namely a security camera, a smart scale, a smart light, a digital photo frame plugged into a smart socket, and a smart speaker. The selection of the five IoT devices is strategic: these devices are prevalent in contemporary households and serve different functions that raise distinct privacy and security concerns. Our aim is to provide a comprehensive understanding of how users perceive security threats across various devices. Since we used the same devices in Study 1 as in Study 2, we were constrained in our selection by ethical considerations, including that the devices should not directly lower home security (e.g., no smart door lock) and should be non-medical. To minimize potential harm, we implemented strict controls over simulated breaches. For instance, activities were designed to avoid severe privacy violations, such as recording participants through the smart camera. Scenarios focused on less intrusive actions, like opening or closing the camera's shutter or triggering moderate-volume sounds from the smart speaker. Device use was limited to a dedicated tablet within the home. Participants were chosen for this study based on their psychological resilience, with their responses closely tracked using an online diary and questionnaires (details not included in this study). This approach allowed the research team to quickly identify and address any concerning situations as they arose. The cybersecurity breach on each device included two or three different cybersecurity breach intensity levels (independent variable; see Table A1 in Appendix A). The intensity increased by manipulating the duration, frequency, or volume of irregular device activity. The nature and the intensity of these breaches were influenced by ethical considerations, and all were approved by ethical committees of the involved research partners. Emotional reactions to a total of 18 cybersecurity breach scenarios (3 to 4 per device) were measured across two separate studies (independent variable; an online scenario-based study and a field experiment). For both studies, the independent variables included the type of IoT device (e.g., camera, smart scale) and the breach intensity (mild, moderate, severe). The dependent variables measured were emotional reactions: appraisals, action tendencies, bodily responses, expressions, and subjective feelings. For Study 1, the objective was to investigate how emotional responses vary across different IoT devices when participants imagine cybersecurity breaches of varying intensity. Study 1 was an online scenario study in which participants were presented with detailed descriptions of cybersecurity breaches. They were asked to imagine themselves experiencing the described situation (exposure). Then, participants were provided ample time to read, reflect (context), and report their emotions using the Cybersecurity GRID questionnaire (dependent variable), which probes into all emotion components. In Study 1, no real device was involved, and the emotional reactions were based on imagining the breach scenario (exposure). The objective of Study 2 was to observe how actual exposure to cybersecurity breaches in real-life settings impacts emotional responses, also across different IoT devices with varying intensities of simulated cybersecurity breaches. Study 2 was a field experiment in which participants experienced cybersecurity breaches on their actual IoT devices in their households. The intensity of the breaches increased progressively (e.g., the frequency of a smart light turning on/off) (context). Real, staged cybersecurity breaches on household IoT devices were implemented (exposure).