## 3 Methodology
### Data Collection
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Type of Attack** & **Compromised Resources** & **Impact of Data Breaches** \\ \hline \multirow{4}{*}{Ransomware} & Financial records, transaction databases, customer payment information of a leading banking institution & USD 3.2 M in ransom paid, 72 h of service disruption affecting 1.8 M customers, regulatory penalties of USD 850 K, 15\% stock price drop \\  & Patient healthcare records and insurance claims data from a major healthcare provider & 5.4 M personal health records exposed including sensitive diagnoses, USD 4.7 M spent on breach remediation, class action lawsuits totalling USD 12 M \\  & Government employee credentials and access to internal communication systems in ministry department & Unauthorised access to classified documents for 28 days, diplomatic communications compromised, estimated national security impact valued at USD 9 M \\  & E-commerce platform and payment processing systems of retail conglomerate & Revenue loss of USD 780 K during 36 h outage, customer trust erosion resulting in 22\% decline in transactions over following quarter \\  & Corporate email accounts and cloud storage of consulting firm with government contracts & Intellectual property theft affecting strategic projects, competitive intelligence compromised, estimated USD 5.3 M in future business loss \\  & Enterprise resource planning systems of technology service provider & Source code theft, 65 client organisations indirectly affected, remediation and client compensation costs exceeding USD \\  & Insider Threat & Customer databases and financial forecasts of telecommunications provider & 8.7 M customer records exposed, including billing information, regulatory fine of USD 1.2 M, mandatory security audits costing USD 650 K \\  & Learning management systems and student data from educational network & Personal data of 920 K students exposed, including 140 K minors, identity protection services costing USD 2.8 M, reputational damage affecting enrollment \\  & Smart grid infrastructure and operational technology of energy distribution company & Temporary control systems compromised affecting service to 42 K households, USD 1.5 M in emergency security measures, regulatory investigation \\  & Cloud computing resources of environmental monitoring organisation & 340\% increase in operational costs over 3 months, system performance degradation affecting critical environmental monitoring, remediation costs of USD 410 K \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Colombian organisations that suffered cyberattacks with data leaks (2024-2025). \begin{table}
\begin{tabular}{c c c} \hline \hline
**Category** & **Description** & **Guiding Questions for Qualitative Analysis** \\ \hline \hline \multicolumn{4}{c}{What technical vulnerabilities were identified after the cyberattack?} \\  & Focuses on technological and procedural measures the & What cybersecurity protocols were in place prior to the incident? \\
1. Technical Aspects for Mitigating Cyberattacks & programisation implements to prevent and mitigate future cyber incidents. & How were IT systems upgraded or restructured post-attack? \\  & & What role did external cybersecurity consultants or partners play? \\  & & How did employees describe their emotional reactions to the incident? \\
2. Impact on Employees: Emotional, Health, and Trust Dimensions & Explores the psychological and social effects of the cyberattack on internal staff, including trust in leadership and perceived job security. & Were there reported signs of stress, burnout, or anxiety following the attack? \\  & Analyses the communication tactics and reputation management strategies deployed after the data & Which image restoration strategies (e.g., denial, apology, corrective action) were used in public communications? \\
3. Post-Data Breach Response Strategies (Image Restoration and Crisis Communication) & breach, drawing from [PERSON]’s image restoration theory and [PERSON] situational crisis communication theory (SCCT).