Emotional reactions and coping responses of employees to a cyber-attack: a case study

Cybersecurity is a serious threat to information technology (IT) systems, with most organisations now relying on their IT systems to function day-to-day. Therefore, it is crucial that organisations ensure they are protected. This research investigates the emotional and coping responses of employees towards a cyber-attack. Data was collected through an in-depth case study approach (24 semi-structured interviews) conducted at a global manufacturing company, along with primary observations and a corpus of secondary materials. Our data analysis applied a grounded approach which was then refined using an emotion theoretic lens with the application of Technology Threat Avoidance Theory (TTAT). Drawing on structural appraisal theory, our findings indicate the IT security team in the case study oscillated between positive problemfocused coping and negative emotion-focused coping. A key explanatory feature or turnaround mechanism that mediated this oscillation was senior management empathy and resource mobilization. Building on the analyses, a conceptual model is developed called the Transformation of Coping through Empathic Leadership (T-CEL). The research suggests the crucial role that senior management play in transforming the emotional and coping capabilities of employees through their intervention and support. The study extends the IS Security theoretical background through a TTATlens for the analysis of cyber-attack incidents.