# Individual Differences in Psychological Stress Associated with Data Breach Experiences
## 2 Materials and Methods
### Measures
#### 2.2.10 Data Breach Severity Index  
Data breaches vary in terms of the quantity of information accessed, the sensitivity of that information, and the difficulty of recovering from the breach. From the perspective of an affected individual, the severity of a data breach can be evaluated by taking these three factors into account. For example, a breach of an infrequently used hotel rewards account would typically be considered less severe than a breach of a frequently used smartphone, given the differences in the amount of information at risk, the sensitivity of that information, and the difficulty of recovering from the breach. Any analysis of an individual's psychological response to a data breach should take into account the severity of the data breach, as more severe breaches can be expected to elicit more substantial psychological responses. We developed a Data Breach Severity Index (DBSI) for this purpose (Appendix A). The DBSI consists of three subscales, which we refer to as Breach Extent, Sensitivity, and Recovery. Each participant's written description of their most severe data breach incident was scored using these three subscales, and these scores were summed to create a DBSI score. The DBSI score was intended to quantify the invasiveness and consequences of a data breach from the victim's perspective so that this information could be incorporated into our multiple regression analyses. By controlling for data breach severity in the analyses, we could identify demographic and psychological variables that accounted for variance in IESR-R scores not attributable to the severity of the data breach. The DBSI-Breach-Extent subscale captured the quantity of information accessed in a data breach. Each participant's data breach was assigned a score of low (1), medium (2), or high (3). For example, a breach that gained access to multiple accounts with many sources of personal information was assigned a score of 3 (e.g., a breach of multiple social media or email accounts, or of an entire phone or computer). A breach with limited access to information was assigned a score of 1 (e.g., breach of a single online shopping account, credit card, online gaming account), and intermediate cases were assigned a score of 2 (e.g., a breach of a single social media account). The DBSI-Sensitivity subscale captured the sensitivity of the information breached. We used a four-point score for this subscale to reflect the range of sensitivity of information accessed and the higher potential for distress created by unauthorized access to sensitive personal information. Data breaches that involved access to sexually explicit content of a personal nature (e.g., the [PERSON] breach) were assigned a score of 4 (very high), as were thefts of intimate photos and communications (emails/text messages). Breaches involving personal communications (e.g., text messages, social media communications, emails), private (not publicly accessible) photos, a social media account, bank accounts, or phone/computer access were assigned a score of 3 (high). Breaches that involved limited financial or personal information (e.g., the Equifax breach, a SIN/SSN, a driver's license) were assigned a score of 2 (medium). Breaches that involved unauthorized access to publicly available information or information of limited utility, such as access to online accounts that do not store sensitive personal or financial information (e.g., Netflix), were assigned a score of 1 (low). The DBSI-Recovery subscale captured the degree of difficulty recovering from a data breach incident. A score of 1 (low) was assigned to situations where the victim could recover from the breach without much effort and with little or no loss of time or money (e.g., changing a password; contacting a bank to reverse charges; using an online account recovery process).