Breached and Denied: The Cost of Data Breaches on Individuals as Mortgage Application Denials

Abstract

While a large body of information systems (IS) literature has investigated the antecedents and consequences of data breaches in organizations, we do not have a good understanding of whether a data breach has a material impact on individuals whose private information is compromised and how much damage it causes. We overcome empirical challenges in investigating the impact of data breaches on individual victims by utilizing a unique natural experimental setting that allows us to credibly identify treated and controlled populations—the breach of South Carolina (SC) taxpayer records in 2012. With residents in SC as the treatment group and those in Georgia and North Carolina as the control group, our difference-in-differences estimations find that after the breach at the SC Department of Revenue, there was a significant increase in denials to SC residents’ residential mortgage applications for refinance and home improvement. We also find that the adverse impact of the breach was more profound for Black and Hispanic residents. Our study provides significant theoretical and policy implications with respect to the harm and costs of a large-scale data breach.