• Type of data stolen - whether name and contact information or medical records;

• Scope - amount of data stolen;

• Motivation of the attack – profiteer, activist, or student;

• Organisational responsibility – the company’s diligence and disclosure;

• Consequences – the cost and who paid (i.e. the business or its customers); and

• Context – if the victim firm was a bank, government agency or non-profit.

The results show people distinguish between features of cybercrimes. People judged an attack as more serious when larger amounts of data were stolen. The motivation of the attacker also held significant weight in the perception of seriousness. If the intention was profit-making, the seriousness was perceived as greater. Also when the cost of consequences was higher or when the data breached more sensitive, such as personal health information, people perceived the attack as more harmful and recommended harsher punishment. Individual attitudes towards privacy, including experiences of identity theft and data protection, are related to views on the seriousness of crimes. Someone more concerned about privacy will tend to rank crimes as more harmful and wrongful, and thus recommend harsher punishment.

Public views suggest serious crime is perceived as acts that are wrongful and harmful, in particular those that have a widespread impact or are motivated by personal profit of the attacker. This suggests the types of crime that might be of greatest concern to consumers – such as those that breach sensitive information and have a high cost of remediation. In responding to a cybercrime, firms can employ breach disclosure strategically recognising that the details of a breach can impact public perception of a crime.