Theses and Dissertations

ORCID

0009-0002-5727-7759

Advisor

Warkentin, Merrill

Committee Member

Marett, Kent

Committee Member

Nehme, Alaa

Committee Member

Paul, Chinju

Committee Member

France, Stephen

Date of Degree

8-12-2026

Original embargo terms

Visible MSU Only 2 Years

Document Type

Dissertation - Campus Access Only

Major

Business Administration (Business Information Systems)

Degree Name

Doctor of Philosophy (Ph.D.)

College

College of Business

Department

Department of Management and Information Systems

Abstract

Data breaches have become increasingly prevalent, posing significant threats to both organizations and individuals. Organizations use legally required data breach notification letters (DBNLs) to notify affected customers and guide their actions. However, designing effective crisis communication messages that not only protect organizational reputation but also motivate individuals to engage in recommended preventive measures has become a critical yet underexplored issue in information security research. Although prior research has examined the role of some crisis response strategies (i.e., rebuild strategies) in shaping customers’ perceptions of organizations, limited attention has been given to how other strategies (i.e., denial, diminish, and bolstering strategies) influence corporate reputation and individuals’ behavioral responses. Drawing on Situational Crisis Communication Theory (SCCT), this dissertation examines how different crisis communication strategies influence both post-crisis corporate impression and customers’ intention to adopt preventive measures. Specifically, this study investigates five communication strategies (i.e., attack the accuser, scapegoating, excuse, justification, and ingratiation) representing denial, diminishing, and bolstering approaches. SCCT provides a theoretical foundation for understanding how organizations manage responsibility attributions and reputational outcomes. This research develops a comprehensive framework that captures both evaluative and behavioral responses to crisis communication. To test the model, this dissertation employs a factorial survey design in which participants are exposed to multiple experimentally manipulated DBNL scenarios. The results show that for post-crisis corporate impression, attack the accuser, scapegoating, and excuse have significant negative effects, while ingratiation has a positive effect and justification is not significant. In contrast, for the intention to adopt preventive measures, only justification has a significant negative effect, while the other strategies do not have significant effects. These findings suggest that communication strategies influence evaluative and behavioral outcomes through distinct mechanisms. While denial and diminish can harm corporate evaluations, they do not necessarily motivate protective actions. Conversely, strategies that enhance relational goodwill may improve organizational impressions but are insufficient to drive actions. This dissertation extends SCCT to the cybersecurity context. Overall, the findings highlight the importance of aligning communication strategies with specific objectives to effectively manage both organizational impressions and customer behaviors.

Download

Share

COinS