  Media reports show an alarming increase of data breaches at providers of
cybersecurity products and services. Since the exposed records may reveal
security-relevant data, such incidents cause undue burden and create the risk
of re-victimization to individuals whose personal data gets exposed. In pursuit
of examining a broad spectrum of the downstream effects on victims, we surveyed
104 persons who purchased specialized devices for the secure storage of
crypto-assets and later fell victim to a breach of customer data. Our case
study reveals common nuisances (i.e., spam, scams, phishing e-mails) as well as
previously unseen attack vectors (e.g., involving tampered devices), which are
possibly tied to the breach. A few victims report losses of digital assets as a
form of the harm. We find that our participants exhibit heightened safety
concerns, appear skeptical about litigation efforts, and demonstrate the
ability to differentiate between the quality of the security product and the
circumstances of the breach. We derive implications for the cybersecurity
industry at large, and point out methodological challenges in data breach
research.
