# Individual Differences in Psychological Stress Associated with Data Breach Experiences
### The Present Study  
Only a few studies have examined data breaches from a psychological perspective, but these investigations have contributed to researchers' understanding of some of the individual differences associated with psychological responses to a data breach. Previous studies also share several limitations, however, the first being the difficulty of making cause-and-effect inferences between a data breach incident and subsequent psychological reactions (e.g., increased anxiety). This is because previous studies have not assessed participants' psychological responses to their own data breach experiences. Instead, they have measured anxiety in response to imagined data breaches [18] or media reports of data breach incidents [1, 19]. Although some studies did inquire about participants' personal experiences with a data breach [21], participants' psychological reactions to their own experiences were not examined. A second limitation of previous studies is the focus on anxiety. While the possibility of heightened anxiety is a potentially significant consequence of a data breach experience, many other psychological reactions could be evaluated (e.g., stress, worry, depression, fear, and anger). A third limitation is that psychological differences among participants, particularly those that could moderate responses to data breach incidents (e.g., individual differences in propensity to worry), have not been examined. A more multi-dimensional evaluation is necessary to build and expand on previous research and further researchers' understanding of the breadth of reactions to data breach experiences. With this goal in mind, the present study examined the psychological stress experienced after a personal experience with a data breach incident and individual differences that could moderate that stress. Stress has a significant influence on mood, well-being, and health, and chronic stress is associated with both depression and anxiety [22, 23], thus making it an important psychological response to consider. The study recruited individuals who had experienced a data breach and asked them to describe their most serious data breach in detail. They then completed the Impact of Events Scale--Revised (IES-R) [24, 25] to answer specific questions about the types of stress they experienced due to their data breach (e.g., \"I felt irritable and angry\"; \"I had waves of strong feelings about it\"). The IES-R is a widely used self-report measure of event-specific stress with good psychometric properties. Data breaches vary in terms of how personal/sensitive the stolen data are and whether there are actual or potential financial repercussions, and thus the nature of a data breach should be taken into account when trying to understand individual differences in participants' reactions (e.g., unauthorized access to sensitive digital photos would be expected to create more psychological stress than unauthorized access to a hotel membership account). To do so, we created a Data Breach Severity Index (DBSI) to quantify the severity of each participant's data breach based on their description of the incident. We expected that data breaches with higher DBSI scores would be associated with more psychological stress (higher IES-R scores). Controlling for data breach severity in the analyses assisted with identifying individual differences that moderated data-breach-induced stress independently of the stress attributable to the data breach itself. We hypothesized that several individual differences would moderate the stress participants experienced due to their data breach. First, because previous studies have documented associations between data breach anxiety and a history of data breach victimization [1, 17], we hypothesized that participants with higher levels of trait anxiety (as measured by the GAD-7) would report greater data-breach-induced stress (higher IES-R scores).