FYI.

This story is over 5 years old.

Tech

The Emotional Burden of Being Hacked

Hacking victims experience anxiety, stress and depression, and get very little support.
Illustration: Anna DeFlorian

On Edge

is a series about stress in 2017.


After hackers leaked naked photos of Jennifer Lawrence, the actress said it was a "sexual violation." At least two people outed in the infamous hack of adultery dating site Ashley Madison committed suicide.

Hacking can have serious repercussions for mental health, and the companies involved know very little about how to deal with the aftermath, and sometimes make things worse by leaving victims in the dark. And no wonder. While someone cracking your PayPal details to buy a new iPhone is irritating and invasive, our online accounts and digital devices often hold the keys to much more sensitive information than payment cards: our personal photos, home address, phone number and so much more.

Advertisement

The anxiety and trauma around these breaches are only exacerbated by the lack of legal process we have to handle them: a report by security firm Norton in 2010 revealed victims feel "powerless" because it seems unlikely online criminals will be brought to justice, though the top reactions were anger (58 percent), annoyance (51 percent), and the feeling of being "cheated" (40 percent).

Dr. Cassandra Cross, senior lecturer at the Queensland University of Technology, said authorities also need to treat those hit by hacking more gently and offer psychological support—they're victims, after all. "At the moment, the system can be as traumatic as the compromise itself," she said. "Secondary victimisation at the hands of the system is a huge issue that needs immediate action to improve the response to victims."

Such crimes can trigger stress, anxiety, and depression

Tanya's (name changed to protect her privacy) Facebook account was stolen, and used to buy games. "It was extremely upsetting to be locked out of my own account and how easy they did it," she told me. Another hacking victim who spoke to me, Matt (name changed to protect privacy) said his eBay was hacked and used to buy an iPhone. "It makes you feel pretty vulnerable," he said. "Someone managed to gain access to my eBay account and spend half a grand. That's deeply unsettling." It left him feeling he couldn't trust companies: "You don't feel quite as in-control of your world."

Advertisement

Such crimes can trigger stress, anxiety, and depression, said Dr. Cross. "However, there is a group of victims who will experience severe trauma and hardship and for these individuals who are not currently acknowledged, and there are limited services to assist," she said.

The severity of psychological effects depends on the nature of the attack, Cross said, including how serious it is and how quickly victims were made aware of it. A long gap between the breach and being notified, for example, is often worse than immediately being told, as victims may find out they were hacked only after being denied credit or, like Matt, getting a receipt for something they didn't purchase. "Victims can experience a strong sense of powerlessness and uncertainty in being able to establish what has occurred," Cross said.

The Equifax hack, for example, may not have yet led to any financial losses for the hundreds of millions of affected people, but it's caused stress, anxiety and more to victims, made worse by the months it took to notify victims. The longer companies wait to disclose—Uber, we're looking at you—the more powerless we're left feeling.

Another factor is the difficulty it takes to cleanup the fallout, Cross said, such as time it takes to contact authorities, setting up credit monitoring services, and correcting or updating related accounts, all of which need to be fit around your employment or other responsibilities.

Advertisement

Tanya says it took 24 hours to get her Facebook account back, and it wasn't an easy process: "It's very hard to contact Facebook.” Because Matt's credit card details were swiped, he had to cancel that card and get a replacement, and that in turn meant he had to update his payment details in every subscription service he used. The refund from PayPal took ten days, and all the time he spent on the phone ate up six days of back and forth—which may seem merely inconvenience, but is worsened by anxiety as you race to get protections in place and accounts updated before hackers can take advantage.

It's time to do more to reduce that burden on victims, said Cross. Companies can make it easier and faster to regain control of accounts, while data breach notifications regulations could help reduce the emotional impact on victims, ensuring we know as soon as possible that a company we use has been hacked—though there's a risk we start to feel overwhelmed by constant hack revelations.

There is progress being made. Australia has a counselling program for identity theft and cyber attacks called IDcare. "If someone has experienced a compromise of their identity in any way, they can seek assistance from IDcare, who will work with them to put together a tailored plan for recovery," Cross explained. "There are also trained counsellors who are able to work with victims through the emotional and psychological aspects of victimisation as well as the practical."

Read More: A Legal Startup Will Pay for You to Sue Equifax

Other hacking victims turn to online support groups on platforms like Facebook. In the UK, Victim Support offers help and advice after cybercrimes, even if you haven't reported it to the police. Victim Support Europe offers similar support, and is holding a conference to kick off a year of activity this month around how better to support victims after cyber crime. "There needs to be an increase in services like this, who can support victims through the process, in a holistic manner and who recognise the nature and severity of these incidents," Cross said.

Such efforts are necessary, because cybercrime and its effects—financial and psychological—aren't going away anytime soon. "Ultimately, it is an issue that will continue to persist into the future and one that needs greater recognition on the types and severity of harms sustained by victims and one that requires more holistic support to assist in recovery and help victims to move forward as best they can," said Cross.

Get six of our favorite Motherboard stories every day by signing up for our newsletter .