A Double-edged Sword of Involvement: On the Tension Between Customers' Group Value and Self-interest in Data Breach Response Processes

As data breaches continue to rise, customers exhibit heterogeneous expectations regarding the company's response. Universal responses can show backfire effects since they fail to meet the expectations. Thus, the challenge arises that customer expectations must be known to mitigate the consequences while time is limited to publish the data breach announcement. By drawing on service failure, data breach, and justice research, we theorize that customer involvement provides a viable approach to this challenge. We argue that active customer involvement allows customers to formulate their expectations. Thus, enabling companies to leverage these expectations to provide tailored data breach responses. We test our hypotheses in a digital experiment (n=304). Our results provide a first indication that active customer involvement in a data breach drives positive group value and negative self-interest effects. We contribute to the data breach literature by revealing that customer involvement constitutes a suitable mechanism for identifying customer expectations.