Supplementary Material for the Paper "Phishing Susceptibility and the (In-)Effectiveness of Common Anti-Phishing Interventions in a Large University Hospital"

J. Tolsdorf, D. Langer, and L. Lo Iacono, “Phishing Susceptibility and the (In-)Effectiveness of Common Anti-Phishing Interventions in a Large University Hospital,” in Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security (CCS), Taipei, Taiwan: ACM, 2025. doi: 10.1145/3719027.3765164. Structure Archive.zip ├── Study I/ │ ├── emails/ # Phishing emails used in Study I │ |── panasx_data_study_i.csv # PANAS-X survey data elicited in Study I │ |── phishing_data_study_i.csv # Click and login data elicited in Study I │ └── script_ccs_study_i.R # Analysis script for Study I ├── Study II/ │ ├── emails/ # Phishing emails used in Study II │ |── phishing_data_study_ii.csv # Click and login data elicited in Study II │ └── script_ccs_study_ii.R # Analysis script for Study II └── README.md # This file Data The data files include the raw click and login data we obtained from the hospital. R-Scripts The provided R scripts allow you to reproduce the analyses and results presented in the paper. They produce the statistical tests, tables, and figures reported in the paper. To run, do the following: Install R (≥ 4.3) Run unzip Archive.zip In Study I, run: Run: Rscript script_ccs_study_i.R for Study I analysis In Study II, run: Run: Rscript script_ccs_study_ii.R for Study II analysis Note: Ensure to set setwd('path/to/Study I/') or setwd('path/to/Study II/') before running the scripts or when using RStudio. Emails We provide all emails used in our studies. For Study II, this includes the active warning triggered after the link in the email was clicked. Note that our study was conducted in German. We translated Emails used in Study II to English because we report screenshots in the paper. Emails in Study I are available in German only. All emails were anonymized to not reveal the organization.