When the Data Are Out: Measuring Behavioral Changes Following a Data Breach.

This article examines user behavioral responses to a large-scale, highly sensitive data breach at a matchmaking website catering to individuals seeking extramarital affairs. Due to the absence of an unaffected control group—since all users were informed simultaneously—the authors develop a novel methodology called Temporal Causal Inference (TCI), which constructs control groups from earlier user cohorts matched on usage trajectories, and combine it with Temporal Causal Forests (TCF), a nonparametric causal inference technique to estimate both average and individual-level treatment effects. The analysis reveals that immediately following the breach announcement, users significantly increased photo deletions (a privacy-protective action) and decreased searching and messaging activities, with these negative effects attenuating by the third week post-announcement. The study also identifies heterogeneity in reactions, noting that married users and those with public profiles exhibited stronger behavioral changes, while users with higher preexisting privacy preferences reacted less strongly and later. Robustness checks using alternative causal inference methods support these findings, highlighting implications for firms and policymakers in managing privacy breaches and customer trust.