* Kornei et al. (2010) Kornei, K. a., Shapley, A. E., Erb, D. K., et al. 2010, The Astrophysical Journal, 711, 693
  * Krogager et al. (2017) Krogager, J.-K., Møller, P., Fynbo, J. P. U., & Noterdaeme, P. 2017, Monthly Notices of the Royal Astronomical Society, 469, 2959
  * Kunth et al. (2003) Kunth, D., Leitherer, C., Mas-Hesse, J. M., Östlin, G., & Petrosian, A. 2003, The Astrophysical Journal, 597, 263
  * Kusakabe et al. (2020) Kusakabe, H., Blaizot, J., Garel, T., et al. 2020, Astronomy & Astrophysics, 638, A12
  * Kusakabe et al. (2019) Kusakabe, H., Shimasaku, K., Momose, R., et al. 2019, Publications of the Astronomical Society of Japan, 71, 1
  * Lake et al. (2015) Lake, E., Zheng, Z., Cen, R., et al. 2015, The Astrophysical Journal, 806, 46
  * Lanzetta et al. (1995) Lanzetta, K. M., Bowen, D. B., Tytler, D., & Webb, J. K. 1995, The Astrophysical Journal, 442, 538
  * Laursen & Sommer-Larsen (2007) Laursen, P. & Sommer-Larsen, J. 2007, The Astrophysical Journal, 657, L69
  * Leclercq et al. (2020) Leclercq, F., Bacon, R., Verhamme, A., et al. 2020, Astronomy & Astrophysics, 635, A82
  * Leclercq et al. (2017) Leclercq, F., Bacon, R., Wisotzki, L., et al. 2017, Astronomy & Astrophysics, 608, A8
  * Leclercq et al. (2022) Leclercq, F., Verhamme, A., Epinat, B., et al. 2022, arXiv: 2203.05614
  * Li & Wang (2013) Li, J.-T. & Wang, Q. D. 2013, Monthly Notices of the Royal Astronomical Society, 435, 3071
  * Mackenzie et al. (2019) Mackenzie, R., Fumagalli, M., Theuns, T., et al. 2019, Monthly Notices of the Royal Astronomical Society, 487, 5070
  * Martin et al. (2013) Martin, C. L., Shapley, A. E., Coil, A. L., et al. 2013, Astrophysical Journal, 770
  * Mary et al. (2020) Mary, D., Bacon, R., Conseil, S., Piqueras, L., & Schutz, A. 2020, Astronomy & Astrophysics, 635, A194
  * Mas-Ribas & Dijkstra (2016) Mas-Ribas, L. & Dijkstra, M. 2016, The Astrophysical Journal, 822, 84
  * Mas-Ribas et al. (2017a) Mas-Ribas, L., Dijkstra, M., Hennawi, J. F., et al. 2017a, The Astrophysical Journal, 841, 19
  * Mas-Ribas et al. (2017b) Mas-Ribas, L., Hennawi, J. F., Dijkstra, M., et al. 2017b, The Astrophysical Journal, 846, 11
  * Matsuda et al. (2011) Matsuda, Y., Yamada, T., Hayashino, T., et al. 2011, Monthly Notices of the Royal Astronomical Society: Letters, 410, 13
  * Matsuda et al. (2012) Matsuda, Y., Yamada, T., Hayashino, T., et al. 2012, Monthly Notices of the Royal Astronomical Society, 425, 878
  * Matthee et al. (2020) Matthee, J., Pezzulli, G., Mackenzie, R., et al. 2020, Monthly Notices of the Royal Astronomical Society, 498, 3043
  * Matthee et al. (2021) Matthee, J., Sobral, D., Hayes, M., et al. 2021, Monthly Notices of the Royal Astronomical Society, 505, 1382
  * Matthee et al. (2016) Matthee, J., Sobral, D., Oteo, I., et al. 2016, Monthly Notices of the Royal Astronomical Society, 458, 449
  * McKinney et al. (2019) McKinney, J. H., Jaskot, A. E., Oey, M. S., et al. 2019, The Astrophysical Journal, 874, 52
  * Mitchell et al. (2021) Mitchell, P. D., Blaizot, J., Cadiou, C., et al. 2021, Monthly Notices of the Royal Astronomical Society, 5775, 5757
  * Moffat (1969) Moffat, A. F. J. 1969, Astronomy and Astrophysics, 3, 455
  * Momose et al. (2014) Momose, R., Ouchi, M., Nakajima, K., et al. 2014, MNRAS442, 442, 110
  * Momose et al. (2016) Momose, R., Ouchi, M., Nakajima, K., et al. 2016, Monthly Notices of the Royal Astronomical Society, 457, 2318
  * Morrissey et al. (2018) Morrissey, P., Matuszewski, M., Martin, D. C., et al. 2018, The Astrophysical Journal, 864, 93
  * Muzahid et al. (2021) Muzahid, S., Schaye, J., Cantalupo, S., et al. 2021, Monthly Notices of the Royal Astronomical Society, 508, 5612
  * Nelson et al. (2021) Nelson, D., Byrohl, C., Peroux, C., Rubin, K. H. R., & Burchett, J. N. 2021, Monthly Notices of the Royal Astronomical Society, 507, 4445
  * Nelson et al. (2019) Nelson, D., Pillepich, A., Springel, V., et al. 2019, Monthly Notices of the Royal Astronomical Society, 490, 3234
  * Noterdaeme et al. (2012) Noterdaeme, P., Petitjean, P., Carithers, W. C., et al. 2012, Astronomy and Astrophysics, 547, 1
  * Oke & Gunn (1983) Oke, J. B. & Gunn, J. E. 1983, The Astrophysical Journal, 266, 713
  * Oppenheimer et al. (2016) Oppenheimer, B. D., Crain, R. A., Schaye, J., et al. 2016, Monthly Notices of the Royal Astronomical Society, 460, 2157
  * Oppenheimer & Davé (2008) Oppenheimer, B. D. & Davé, R. 2008, Monthly Notices of the Royal Astronomical Society, 387, 577
  * Östlin et al. (2009) Östlin, G., Hayes, M., Kunth, D., et al. 2009, The Astronomical Journal, 138, 923
  * Ouchi et al. (2020) Ouchi, M., Ono, Y., & Shibuya, T. 2020, Annual Review of Astronomy and Astrophysics, 58, 617
  * Patrício et al. (2016) Patrício, V., Richard, J., Verhamme, A., et al. 2016, Monthly Notices of the Royal Astronomical Society, 456, 4191
  * Peeples et al. (2019) Peeples, M. S., Corlies, L., Tumlinson, J., et al. 2019, The Astrophysical Journal, 873, 129
  * Peroux et al. (2003) Peroux, C., Dessauges-Zavadsky, M., D’Odorico, S., Kim, T.-S., & McMahon, R. G. 2003, Monthly Notices of the Royal Astronomical Society, 345, 480
  * Péroux & Howk (2020) Péroux, C. & Howk, J. C. 2020, Annual Review of Astronomy and Astrophysics, 58, 363
  * Pillepich et al. (2019) Pillepich, A., Nelson, D., Springel, V., et al. 2019, Monthly Notices of the Royal Astronomical Society, 490, 3196
  * Piqueras et al. (2019) Piqueras, L., Conseil, S., Shepherd, M., et al. 2019, Astronomical Data Analysis Software and Systems XXVI ASP Conference Series, 521, 545
  * Price-Whelan et al. (2018) Price-Whelan, A. M., Sipőcz, B. M., Günther, H. M., et al. 2018, The Astronomical Journal, 156, 123
  * Prochaska et al. (2013) Prochaska, J. X., Hennawi, J. F., Lee, K.-G., et al. 2013, The Astrophysical Journal, 776, 136
  * Prochaska et al. (2005) Prochaska, J. X., Herbert‐Fort, S., & Wolfe, A. M. 2005, The Astrophysical Journal, 635, 123
  * Rafelski et al. (2015) Rafelski, M., Teplitz, H. I., Gardner, J. P., et al. 2015, The Astronomical Journal, 150, 31
  * Rahmati et al. (2015) Rahmati, A., Schaye, J., Bower, R. G., et al. 2015, Monthly Notices of the Royal Astronomical Society, 452, 2034
  * Rauch et al. (2008) Rauch, M., Haehnelt, M., Bunker, A., et al. 2008, The Astrophysical Journal, 681, 856
  * Rosdahl & Blaizot (2012) Rosdahl, J. & Blaizot, J. 2012, Monthly Notices of the Royal Astronomical Society, 423, 344
  * Rubin et al. (2015) Rubin, K. H., Hennawi, J. F., Prochaska, J. X., et al. 2015, Astrophysical Journal, 808, 38
  * Rubin et al. (2011) Rubin, K. H., Prochaska, J. X., Ménard, B., et al. 2011, Astrophysical Journal, 728, 6
  * Rudie et al. (2012) Rudie, G. C., Steidel, C. C., Trainor, R. F., et al. 2012, The Astrophysical Journal, 750, 67
  * Schaye et al. (2015) Schaye, J., Crain, R. A., Bower, R. G., et al. 2015, Monthly Notices of the Royal Astronomical Society, 446, 521
  * Schroetter et al. (2016) Schroetter, I., Bouché, N., Wendt, M., et al. 2016, The Astrophysical Journal, 833, 39
  * Schroetter et al. (2021) Schroetter, I., Bouché, N. F., Zabl, J., et al. 2021, Monthly Notices of the Royal Astronomical Society, 501, 1900
  * Shibuya et al. (2015) Shibuya, T., Ouchi, M., & Harikane, Y. 2015, The Astrophysical Journal Supplement Series, 219, 15
  * Skelton et al. (2014) Skelton, R. E., Whitaker, K. E., Momcheva, I. G., et al. 2014, The Astrophysical Journal Supplement Series, 214, 24
  * Smith et al. (2019) Smith, A., Ma, X., Bromm, V., et al. 2019, Monthly Notices of the Royal Astronomical Society, 484, 39
  * Songaila & Cowie (2010) Songaila, A. & Cowie, L. L. 2010, The Astrophysical Journal, 721, 1448
  * Spitzer (1956) Spitzer, Lyman, J. 1956, The Astrophysical Journal, 124, 20
  * Steidel et al. (2011) Steidel, C. C., Bogosavljević, M., Shapley, A. E., et al. 2011, The Astrophysical Journal, 736, 160
  * Steidel et al. (2002) Steidel, C. C., Kollmeier, J. A., Shapley, A. E., et al. 2002, The Astrophysical Journal, 570, 526
  * Stern et al. (2021) Stern, J., Sternberg, A., Faucher-Giguère, C.-A., et al. 2021, Monthly Notices of the Royal Astronomical Society, 507, 2869
  * Suresh et al. (2015) Suresh, J., Bird, S., Vogelsberger, M., et al. 2015, Monthly Notices of the Royal Astronomical Society, 448, 895
  * Swinbank et al. (2007) Swinbank, A. M., Bower, R. G., Smith, G. P., et al. 2007, Monthly Notices of the Royal Astronomical Society, 376, 479
  * Taniguchi & Shioya (2000) Taniguchi, Y. & Shioya, Y. 2000, Astrophysical Journal Letters v.489, 532, L13
  * The Astropy Collaboration et al. (2013) The Astropy Collaboration, Robitaille, T. P., Tollerud, E. J., et al. 2013, Astronomy & Astrophysics, 558, A33
  * Trebitsch et al. (2017) Trebitsch, M., Blaizot, J., Rosdahl, J., Devriendt, J., & Slyz, A. 2017, Monthly Notices of the Royal Astronomical Society, 470, 224
  * Tumlinson et al. (2017) Tumlinson, J., Peeples, M. S., & Werk, J. K. 2017, Annual Review of Astronomy and Astrophysics, 55, 389
  * Turner et al. (2017) Turner, M. L., Schaye, J., Crain, R. A., et al. 2017, Monthly Notices of the Royal Astronomical Society, 471, 690
  * Turner et al. (2014) Turner, M. L., Schaye, J., Steidel, C. C., Rudie, G. C., & Strom, A. L. 2014, Monthly Notices of the Royal Astronomical Society, 445, 794
  * Tytler (1982) Tytler, D. 1982, Nature, 298, 427
  * Urrutia et al. (2019) Urrutia, T., Wisotzki, L., Kerutt, J., et al. 2019, Astronomy and Astrophysics, 624, 1
  * Van de Voort et al. (2012) Van de Voort, F., Schaye, J., Altay, G., & Theuns, T. 2012, Monthly Notices of the Royal Astronomical Society, 421, 2809
  * Verhamme et al. (2012) Verhamme, A., Dubois, Y., Blaizot, J., et al. 2012, A&A, 546, 111
  * Verhamme et al. (2018) Verhamme, A., Garel, T., Ventou, E., et al. 2018, Monthly Notices of the Royal Astronomical Society: Letters, 478, L60
  * Verhamme et al. (2006) Verhamme, A., Schaerer, D., & Maselli, A. 2006, Astronomy and Astrophysics, 460, 397
  * Virtanen et al. (2020) Virtanen, P., Gommers, R., Oliphant, T. E., et al. 2020, Nature Methods, 17, 261
  * Weilbacher et al. (2020) Weilbacher, P. M., Palsa, R., Streicher, O., et al. 2020, Astronomy & Astrophysics, 641, A28
  * Werk et al. (2016) Werk, J. K., Prochaska, J. X., Cantalupo, S., et al. 2016, The Astrophysical Journal, 833, 54
  * Werk et al. (2014) Werk, J. K., Prochaska, J. X., Tumlinson, J., et al. 2014, The Astrophysical Journal, 792, 8
  * Whitaker et al. (2019) Whitaker, K. E., Ashas, M., Illingworth, G., et al. 2019, The Astrophysical Journal Supplement Series, 244, 16
  * Wilson (1927) Wilson, E. B. 1927, Journal of the American Statistical Association, 22, 209
  * Wisotzki et al. (2016) Wisotzki, L., Bacon, R., Blaizot, J., et al. 2016, A&A, 587, 98
  * Wisotzki et al. (2018) Wisotzki, L., Bacon, R., Brinchmann, J., et al. 2018, Nature, 562, 229
  * Wolfe et al. (2005) Wolfe, A. M., Gawiser, E., & Prochaska, J. X. 2005, Annual Review of Astronomy and Astrophysics, 43, 861
  * Wolfe et al. (1986) Wolfe, A. M., Turnshek, D. A., Smith, H. E., & Cohen, R. D. 1986, The Astrophysical Journal Supplement Series, 61, 249
  * Wu et al. (2020) Wu, J., Jiang, L., & Ning, Y. 2020, The Astrophysical Journal, 891, 105
  * Xue et al. (2017) Xue, R., Lee, K.-S., Dey, A., et al. 2017, The Astrophysical Journal, 837, 172
  * Yajima et al. (2013) Yajima, H., Li, Y., & Zhu, Q. 2013, The Astrophysical Journal, 773, 151
  * Yuma et al. (2017) Yuma, S., Ouchi, M., Drake, A. B., et al. 2017, The Astrophysical Journal, 841, 93
  * Yuma et al. (2013) Yuma, S., Ouchi, M., Drake, A. B., et al. 2013, The Astrophysical Journal, 779, 53
  * Zabl et al. (2019) Zabl, J., Bouché, N. F., Schroetter, I., et al. 2019, Monthly Notices of the Royal Astronomical Society, 485, 1961
  * Zabl et al. (2021) Zabl, J., Bouché, N. F., Wisotzki, L., et al. 2021, arXiv: 2105.14090, 22, 1
  * Zafar et al. (2013a) Zafar, T., Péroux, C., Popping, A., et al. 2013a, Astronomy & Astrophysics, 556, A141
  * Zafar et al. (2013b) Zafar, T., Popping, A., & Péroux, C. 2013b, Astronomy & Astrophysics, 556, A140
  * Zhang et al. (2020) Zhang, H., Ouchi, M., Itoh, R., et al. 2020, The Astrophysical Journal, 891, 177
  * Zhang et al. (2016) Zhang, H., Zaritsky, D., Zhu, G., Ménard, B., & Hogg, D. W. 2016, The Astrophysical Journal, 833, 276
  * Zheng et al. (2011) Zheng, Z., Cen, R., Weinberg, D., Trac, H., & Miralda-Escudé, J. 2011, The Astrophysical Journal, 739, 62

##  Appendix A Details of the sample

###  A.1 MXDF catalog construction

Here we give a short summary of the MXDF catalog construction and the full
explanation is given in Bacon et al. (in prep.). The MUSE MXDF catalog was
constructed in two ways and was merged into one catalog: a blind source
detection with the 3D matched filtering software, ORIGIN (Mary et al. 2020),
and source extraction and deblending based on HST prior information with the
ODHIN software (Bacher 2017), in a similar manner to those used in the MUSE-
HUDF catalog (Inami et al. 2017, Bacon et al. in prep.). ORIGIN is optimized
for the detection of compact sources with faint spatial-spectral emission
signatures in MUSE datacubes. It subtracts the continuum from the MUSE cube
first, and the detection is based on the local maxima of generalized
likelihood ratio test statistics obtained for a set of spatial-spectral
profiles of emission line emitters. It provides an estimation of the purity.
The threshold value of the purity in the MXDF catalog is 0.8 (i.e., a false
detection rate of 0.2). The ODHIN software performs deblending of sources in
MUSE datacubes, based on the prior information from HST images with a higher
spatial resolution (Rafelski et al. 2015). The selection cut for the prior
sources is a S/N of 0.8 per spectral pixel. We extracted 1D spectra at the
position of the ORIGIN-detected sources and that of the ODHIN HST-prior
sources from the 3D data cube for the redshift determination and visual
inspection. To assign redshifts, we used an updated version of the redshift
fitting software, MARZ, which is based on a cross-correlation algorithm (e.g.,
Hilton et al. 2012; Baldry et al. 2014, see also Inami et al. 2017) for both
ORIGIN and ODHIN sources. The redshift solutions provided by MARZ were
visually inspected by the MUSE team members independently with the source
inspector software (Bacon et al. in prep.). We assigned HST counterparts from
the Rafelski et al. (2015) catalog when available, and merged an ORIGIN and an
ODHIN source into one when they overlapped by choosing the detection method.
After reconciliating conclusions between the different inspectors, we
summarized sources into the final catalog.

Following Inami et al. (2017) with some improvements, we have three levels of
confidence for spec-$z$ (ZCONF). ZCONF=1 is for a possible redshift with low
confidence. It can be assigned due to low S/N values of lines (e.g.,
$S/N\lesssim 3$), poor line fittings, existence of valid alternative redshift
solutions, noisy narrow bands, or additional lines which present in the
spectrum with reasonable S/Ns but can not be explained by the proposed
redshift solutions. ZCONF=2 is for a good redshift. Regarding non-Ly$\alpha$
emitters (e.g., $z\lesssim 2.9$), it is assigned for sources with multiple
lines detected with good S/N values of $S/N\gtrsim 5$. For instance, a
resolved [O II]$\lambda\lambda$3726,3729 doublet with a clear narrow band
would be sufficient for ZCONF=2. Regarding Ly$\alpha$ emitters, it is required
to have a Ly$\alpha$ line with a good S/N of $S/N\gtrsim 5$ and a width and an
asymmetry compatible with Ly$\alpha$ line shapes. The highest level, ZCONF=3,
indicates a secure redshift. For non-Ly$\alpha$ emitters, the criteria are
similar to those of ZCONF=2, but it is required to have more lines and higher
S/N, together with high S/N narrow band images. For Ly$\alpha$ emitters, if
there is no additional line except for Ly$\alpha$, it is required to have a
Ly$\alpha$ line with a high S/N value of $S/N\gtrsim 7$ and a Ly$\alpha$-like
line profile: a pronounced red asymmetrical line profile666Ly$\alpha$ lines
are fit with a skewed Gaussian with an asymmetry parameter $\gamma$:
$F(\lambda)=F_{\rm max}\left[1+{\rm
erf}\left(\gamma\frac{\lambda-\lambda_{0}}{\sqrt{2}\sigma}\right)\right]\left[{\rm
exp}\left(-\frac{(\lambda-\lambda_{0})^{2}}{2\sigma^{2}}\right)\right]$, where
$F_{\rm max}$, $\sigma$, and $\lambda_{0}$ represent the amplitude, the width,
and the peak wavelength, respectively, and the erf is error function (see
Bacon et al. in prep. for more details).  (highly asymmetric of $\gamma>2$)
and/or a blue bump, or a double peaked line profile. The S/N thresholds are
not strictly defined because other information was taken into account. In the
case of an ORIGIN detection, and if the source can be matched to an HST
counterpart, it adds confidence to the detection. In addition, if a photo-$z$
is reliable and a good match to the MUSE spec-$z$, it adds confidence to the
redshift assignment. This could lead to a higher ZCONF than in the case of an
ORIGIN source without HST counterpart. Meanwhile, faint HST sources often do
not have a reliable photo-$z$, which can be in disagreement with a MUSE
spec-$z$. It is not taken as a strong negative constraint (see Bacon et al. in
prep.). In addition to the three ZCONF levels, ZCONF=0 is defined in the MXDF
catalog (DR2 v0.8) for a source with an ORIGIN detection for which no
spectroscopic redshift could be identified. However, in this paper, we
independently defined ZCONF=0 as no spec-$z$ in the MXDF catalog with a
tentative (best-estimate) assignment of a redshift or a constraint of a
redshift.

###  A.2 Spec-$z$ and photo-$z$ distribution

In order to check a potential bias in our sample selection, we plotted the
distribution of photo-$z$ and spec-$z$ for 142 $F775W<27.5$ mag sources from
Rafelski et al. (2015) in the MXDF with more than 100-hour integration (see
Figure 14). As described in Section 2.2, 123 sources have ZCONF=2 or 3, 10
sources have ZCONF=1, and 9 sources are not included in the MXDF catalog
(ZCONF=0). Most of the ZCONF= 1 to 3 sources have a spec-$z$, which is
consistent with their photo-$z$ (blue and red stars). RID=23135 is the single
ZCONF=1 source in our sample (red star with $z_{\rm s}=3.94$ and $z_{\rm
p}=0.76^{+0.11}_{-0.38}$). Although the photo-$z$ and the spec-$z$ do not
match, the source has a strong ORIGIN-detected Ly$\alpha$ emission with
$S/N=6.4$. Regarding ZCONF=0 sources (magenta circles), 7 sources were
suggested to be at $z<2.86$ from clear continua at the blue edge of the MUSE
spectra, which are consistent with their photo-$z$. The remaining two sources,
RID=54891 and 6693, were included in our sample to minimize a selection bias
despite ZCONF=0. The tentative spec-$z$ for RID=54891 was determined from a
low-$S/N$ Ly$\alpha$ line at $z_{\rm s}=2.94$, while it was based on a
Ly$\alpha$ break and stacks of low-$S/N$ UV absorption lines for RID=6693 (see
Section 2.2 for the process of spec-$z$ assignment). Although not all the
sources have a secure or reliable spec-$z$, our spec-$z$ estimations are
almost complete with $F775W<27.5$ mag.

Generally, at $z\simeq 3$–$6$, the Ly$\alpha$ line is the most common $z_{\rm
s}$ indicator in follow-up observations, which could introduce a certain
sample bias in favor of Ly$\alpha$ emission. We also checked spec-$z$
estimates for $z_{\rm p}\gtrsim 3$ sources with $F775W<27.5$ mag. Among 142
sources, 26 sources have a best-fit photo-$z$ in $2.86\leq z_{\rm p}\leq 4.44$
(between the black lines). All of them except for RID=6693 have a spec-$z$
with ZCONF=2 or 3, most of which are consistent with their photo-$z$. As LAE
fractions are not high (e.g., Kusakabe et al. 2020), it means that our sample
construction is not significantly biased a Ly$\alpha$ selection despite the
redshift range. This result reinforces the high spec-$z$ completeness in our
sample construction.

Figure 14: Photo-$z$ vs. spec-$z$ for 142 $F775W<27.5$ mag sources. The blue
stars, the red stars, and the magenta dots represent galaxies with ZCONF=2 or
3, 1, and 0, respectively. The gray shaded areas indicate the spec-$z$ outside
the targeted redshift (z=2.86-4.44) and the AO gap. The gray diagonal line and
the black lines show the $z_{\rm p}$ = $z_{\rm s}$ relation, and $z_{\rm
p}=2.86$ and $4.44$ lines, respectively. The photometric redshifts were
estimated in Rafelski et al. (2015) with the Bayesian Photometric Redshift
(BPZ) algorithm (Benitez 2000; Benitez et al. 2004; Coe et al. 2006). The
error bars of $z_{\rm p}$ show 95% upper and lower limits.

###  A.3 Ly$\alpha$ equivalent width and LAE fraction

Figure 15:  1D spectra of the two non-LAEs with LAHs, RID=4587 and 4764
discussed in Section 3.3.3, as examples of our inside spectra. The dark gray
lines, the faint gray shaded areas, the black lines, and the magenta lines
show the inner spectra, its 1$\sigma$ uncertainties, the inner continuum
spectra, and the best-fit power-law models for the continua, respectively. The
blue and orange shaded areas indicate fluxes integrated for the Ly$\alpha$
emission and Ly$\alpha$ absorption measurements (the spectral windows, see
Appendix A.3 for more details), respectively. We note that the Ly$\alpha$
absorption flux (more precisely, the upper limit of the absorption flux) was
obtained by multiplying two to the integrated flux in the orange shaded
spectral window.

We used rest-frame $EW(\mbox{Ly$\alpha$})$ measurements to confirm the
presence of LAHs around non-LAEs in Section 3.3.3 and to compare the $X_{\rm
LAE}$ with a given $EW(\mbox{Ly$\alpha$})$ cut for that in Kusakabe et al.
(2020) in Section 2.2 in order to validate that our sample is not biased s the
LAE selection. Therefore, the $EW(\mbox{Ly$\alpha$})$ values in this paper
were measured in the galaxy’s stellar-component scale following Kusakabe et
al. (2020). Here we give a brief summary of the methods for the
$EW(\mbox{Ly$\alpha$})$ measurements and the $X_{\rm LAE}$ calculations. We
note that investigating Ly$\alpha$ line properties including
$EW(\mbox{Ly$\alpha$})$ for our individual sources is beyond the scope of this
paper. We plan to improve the method for measuring $EW(\mbox{Ly$\alpha$})$ in
the MUSE 3D cube and discuss them in a future project.

We extracted the 1D spectra inside the target’s continuum-component mask
(hereafter, inside spectra). Some fraction of our sources shows a wide
Ly$\alpha$ absorption feature that could extend up to $\lambda\simeq 1260$ Å
or even longer. Indeed, Ly$\alpha$ absorption troughs have already been
identified for individual LBGs at $z\simeq 3$ (Kornei et al. 2010, see also
Chen et al. 2021), though the feature has not frequently been found for
spectra of individual high-$z$ galaxies perhaps because of limited S/N values.
Some of our sources also show a Ly$\alpha$ emission line on top of the wide
absorption feature (c.f., about 10% of the sample in Kornei et al. 2010),
which are similar to local Green Pea galaxies (e.g., McKinney et al. 2019;
Jaskot et al. 2019) as well as stacked MUSE LAEs at $z\sim 2.9$–$4.6$ (e.g.,
Feltre et al. 2020). Thanks to the very deep MUSE data, we need to go beyond
the standard method for $EW(\mbox{Ly$\alpha$})$ measurements for high-$z$
galaxies. We measured the $EW(\mbox{Ly$\alpha$})$ for Ly$\alpha$ emission and
Ly$\alpha$ absorption ($EW(\mbox{Ly$\alpha$})_{\rm emi.}$ and
$EW(\mbox{Ly$\alpha$})_{\rm abs.}$, respectively) on the inside spectra with a
method based on a similar idea in, for instance, Kornei et al. (2010) and
calculated the net $EW(\mbox{Ly$\alpha$})$, $EW(\mbox{Ly$\alpha$})_{\rm
net.}$, by summing $EW(\mbox{Ly$\alpha$})_{\rm emi.}$ and
$EW(\mbox{Ly$\alpha$})_{\rm abs.}$ (similar idea to that in McKinney et al.
2019; Jaskot et al. 2019). Figure 15 shows the 1D spectra of the two non-LAEs
with LAHs discussed in Section 3.3.3 as examples of our inside spectra. First
of all, we estimated the continuum spectrum around Ly$\alpha$ by fitting the
inside spectrum at rest-frame $\lambda\geq 1270$ Å with power-law models (see
Section 4.3 in Matthee et al. 2021, for the choice of the wavelength limit).
To obtain a Ly$\alpha$ emission flux, we integrated Ly$\alpha$ fluxes above
the best-fit power-law continuum within a spectral window, whose fluxes are
consecutively above the best-fit power-law around the Ly$\alpha$ peak (the
blue shaded area). The $EW(\mbox{Ly$\alpha$})_{\rm emi.}$ was calculated by
dividing the emission flux with the continuum at the Ly$\alpha$ wavelength
estimated from the power-law model and converted to that in the rest frame.
Regarding the Ly$\alpha$ absorption, we estimated the absorption flux only
from redder wavelengths than the Ly$\alpha$ wavelength, as the bluer
wavelengths are generally affected by the IGM absorption. We defined the
spectral window to measure the absorption fluxes (the orange shaded area). The
blue edge of the absorption window is the next wavelength slice of the red
edge of the emission window. The red edge of the absorption window was defined
with the spectrum extracted in the same target’s continuum-component mask from
the continuum minicube (hereafter inside continuum spectrum; Section 2.3). The
red edge corresponds to the longest wavelength pixel among the consecutive
increasing pixels at the redder side of the blue edge, where the flux on the
inside continuum spectrum (the black line) is fainter than that of the best-
fit continuum (the magenta line). Considering the possible contamination of
Nv$\lambda 1243$ P-Cygni profile and the limited S/N of the inside spectra for
all the sources, we gave a conservative upper limit of the red edge as 1230 Å.
We integrated relative fluxes to the power-law continuum within the spectral
window. Then, we obtained the Ly$\alpha$ absorption flux by multiplying two to
the integrated flux. We calculated $EW(\mbox{Ly$\alpha$})_{\rm abs.}$ by
dividing the negative absorption flux with the continuum at the Ly$\alpha$
wavelength and converted it to that in the rest-frame. These
$EW(\mbox{Ly$\alpha$})_{\rm abs.}$ values would be actually the upper limits
of the true $EW(\mbox{Ly$\alpha$})$ for absorption because of the limited
spectral windows (the orange shades). In this work, non-LAEs were defined with
$EW(\mbox{Ly$\alpha$})_{\rm net.}$= $EW(\mbox{Ly$\alpha$})_{\rm emi.}$ \+
$EW(\mbox{Ly$\alpha$})_{\rm abs.}$ $\leq 0$ Å. The two non-LAEs with LAHs
introduced in Section 3.3.3, RID=4587 and 4764, have
$EW(\mbox{Ly$\alpha$})_{\rm net.}\leq-10.0\pm 2.9$ Å and $-14.2\pm 1.0$ Å,
respectively. Moreover, their $EW(\mbox{Ly$\alpha$})_{\rm emi.}$ are as small
as $2.8\pm 0.6$ Å and $0.7\pm 0.3$ Å, respectively. Even when we ignore the
Ly$\alpha$ absorption ($EW(\mbox{Ly$\alpha$})_{\rm abs.}\leq-12.7\pm 2.8$ Å
and $-14.9\pm 1.0$ Å, respectively), their $EW(\mbox{Ly$\alpha$})_{\rm emi.}$
values are too low to be categorized as LAEs with the typical 20 Å selection
criteria. Their $EW(\mbox{Ly$\alpha$})_{\rm emi.}$ are also significantly
smaller than the minimum $EW(\mbox{Ly$\alpha$})$ of the MUSE LAEs with LAHs in
Leclercq et al. (2017), $\sim 20$ Å though Ly$\alpha$ halo fluxes are included
in their $EW(\mbox{Ly$\alpha$})$. These results validate our first individual
detections of LAHs around high-$z$ non-LAEs.

The LAE fractions for our sample were calculated with
$EW(\mbox{Ly$\alpha$})_{\rm emi.}$ in a similar method in that of Kusakabe et
al. (2020) using the MUSE-HUDF data, which cannot take Ly$\alpha$ absorption
into account as their continua are not detected in the MUSE spectra (i.e.,
nondetection of absorption) for most of the sources. Ly$\alpha$ fluxes from
extended emission were not included in the $EW(\mbox{Ly$\alpha$})$ for both
samples. We did not correct the incompleteness of the detection of Ly$\alpha$
emission for our sample as the completeness is expected to be high, and we
estimated the uncertainties on the $X_{\rm LAE}$ from the binomial proportion
confidence interval. The $X_{\rm LAE}$ with the typical threshold for LAE
selections, $EW(\mbox{Ly$\alpha$})\geq 20$ Å, for out entire sample with
$-20\leq M_{1500}\leq-18.0$ at $z=2.9$–$4.4$ is $0.33^{+0.11}_{-0.09}$. For a
fair comparison, we also calculated the $X_{\rm LAE}$ with
$EW(\mbox{Ly$\alpha$})\geq 65$ Å for our entire sample as
$0.14^{+0.09}_{-0.06}$. As discussed in Section 2.2, this value is similar to
those in Kusakabe et al. (2020), suggesting that our sample is not biased.

###  A.4 nonisolated sources

Figure 16: Ly$\alpha$ NB centered at RID=4838. The Ly$\alpha$ NB was extracted
from the MXDF data cube with a wavelength range of 4935–4948 Å and a size of
10”$\times$10” by source inspector, which was used to visually inspect the
MXDF sources. The color bar shows the flux with an arbitrary normalization.
The filled pink and filled purple circles indicate a nonisolated galaxy in our
sample and its neighbor, which is not included in our sample with a spec-z
measurement, respectively. The black open circles show sources in the catalog
of Rafelski et al. (2015). The cyan circle indicates a
$0\aas@@fstack{\prime\prime}6$-radius circle centered at the position of
RID=4838. The ID, $F775W$ magnitude, and $z_{\rm s}$ are shown for each
object.  Figure 17: Same as Figure 16, but for RIDs=7847, 7876, and 9944. The
Ly$\alpha$ NB is centered at RID=7876 with a wavelength range of 4838–4863 Å
and a size of 10”$\times$10”. The filled pink circles indicate three
nonisolated galaxies in our sample. The purple open square shows a close MUSE-
detected Ly$\alpha$ emitter without an HST counterpart. The purple open circle
presents a potential neighbor, which does not have a spec-z but has a close
photo-z. The black open circles show sources in the catalog of Rafelski et al.
(2015). The cyan circles indicate $0\aas@@fstack{\prime\prime}6$-radius
circles centered at the position of RID=7847, 7876, and 9944. The ID, $F775W$
magnitude (if available), and $z_{\rm s}$ or $z_{\rm p}$ are shown for each
object.

As described in Section 2.2, our sample includes four nonisolated galaxies,
which have a neighboring galaxy with an HST detection within
$0\aas@@fstack{\prime\prime}6$ (Inami et al. 2017) with close spec-$z$
($|\Delta V|\lesssim 500$ km s-1). Figure 16 shows a NB image of a nonisolated
galaxy. RID=4838 at $z_{\rm s}=3.06$ ($F775W$=26.70, ZCONF=2) has a UV-faint
neighbor RID=6666 at $z_{\rm s}=3.06$ ($F775W$=29.72, ZCONF=2) with ORIGIN-
detected Ly$\alpha$ emission, which is not included in our sample.
Interestingly, these sources are a part of a cosmic web filament found with
MUSE in Bacon et al. (2021), called ”G02”, whose structure extends to a total
length of 1.1 pMpc with a width of 47 kpc (see their Figure 12). Therefore,
RID=4838 was categorized as a nonisolated galaxy.

As shown in Figure 17, RID=7876 ($F775W$=26.85) and RID=9944 ($F775W$=26.49)
are located within $0\aas@@fstack{\prime\prime}6$ each other. Because of the
limited spatial resolution of MUSE, a MUSE source (MID=103, $z_{\rm s}=2.99$,
ZCONF=3), which shows Ly$\alpha$ emission and absorption depending on
wavelength and position, conservatively has two HST counterparts of RID=7876
and RID=9944. The Ly$\alpha$ absorption feature gets stronger at the position
of RID=9944 than that of RID=7876777RID=7876 and RID=9944 are treated as a
single HST source in the Cosmic Assembly Near-IR Deep Extragalactic Legacy
Survey (CANDELS, ID=110794, Whitaker et al. 2019) and 3D-HST (ID=28521,
Skelton et al. 2014). Following the other MUSE GTO papers, we used the catalog
of Rafelski et al. (2015) as a HST prior list (see also Figures 19 and 20).
Moreover, MID=103 is also within $0\aas@@fstack{\prime\prime}6$ from RID=7847
at $z_{\rm s}=3.00$ ($F775W$=26.84, ZCONF=3). Near them, we can see an HST
non-detected source at $z_{\rm s}=3.00$ (ZCONF=2, MID=8246) and a potential
neighbor of RID=7758 at $z_{\rm p}=2.89$ ($F775W$=28.20). These sources are
also included in an overdensity of MUSE-detected LAEs, ”G01” (Bacon et al.
2021). As a conservative choice, we categorized RID=7847 as a nonisolated
galaxy, in addition to RID=7876 and 9944.

In summary, we conclude that the environments around four nonisolated galaxies
in our sample would be different from those of the rest of the galaxies in our
sample, which may affect halo properties. We calculated Ly$\alpha$ halo
fractions separately for the isolated sources and the nonisolated sources in
Section 3.4 for a conservative discussion.

##  Appendix B Continuum subtraction

Figure 18 shows two examples of the difference in the radial SB profiles for
the four different settings of the continuum subtractions. One of the objects,
which has an artificial absorption trough on the SB profile with the general
setting of a 200-pix ($\pm 100$-pix) window, is RID=4764. The artificial
absorption becomes less significant with the smaller spectral windows.
Although the profile inside the target’s continuum-component mask changes
depending on the settings of the continuum subtraction, the profiles at
$r=r_{\rm in}$–$r_{\rm CoG}$ are independent of the settings. Another example
is RID=9863, which has a neighbor that cannot be eliminated only by the
neighboring object mask. The right panels emphasize the fact that the
continuum subtraction is essential to remove neighboring continuum-detected
objects from the minicube. The neighboring object masks can only cover
continuum-bright objects and prevent uncertainties due to continuum
subtractions. Therefore, we needed both of the continuum subtractions and the
neighboring object masks. The second example also shows that the SB profiles
at $r=r_{\rm in}$–$r_{\rm CoG}$ are independent of the settings except around
neighbors, implying that our tests for the existence of a Ly$\alpha$ halo at
$r=r_{\rm in}$–$r_{\rm CoG}$ are robust and stable.

Figure 18:  Examples of the difference in the radial SB profiles for four
different settings of the continuum subtractions. The black and blue lines
indicate the SB profiles for the original minicubes and the continuum-
subtracted minicubes, respectively. The neighboring masks were applied for
both. The cyan shaded areas indicate the radii outside the target’s continuum-
component masks and inside the $r_{\rm CoG}$. Left column: RID=4764, which has
an artificial absorption trough with the general setting of a 200-pix ($\pm
100$-pix) window. Right column: RID=9863, which has a neighbor (at the radius
shown by the magenta solid line) that cannot be eliminated only by the
neighboring object mask. From top to bottom, each panel represents the
settings: 1) 200-pix ($\pm 100$-pix) window, 2) 200-pix ($\pm 100$-pix) window
+ Ly$\alpha$ mask ($\pm 400$ km s-1 around Ly$\alpha$), 3) 100-pix ($\pm
50$-pix) window + Ly$\alpha$ mask, and 4) 60-pix ($\pm 30$-pix) window +
Ly$\alpha$ mask, respectively.

##  Appendix C Masks

Figures 19 and 20 show 4′′ $\times$ 4 ′′ HST $F775W$ cutout images, 4′′
$\times$ 4′′ cutouts of the HST segmentation map, the target’s continuum-
component masks (in the spatial resolution of MUSE, 15′′ $\times$ 15′′), and
the neighboring object masks (in the spatial resolution of MUSE, 15′′ $\times$
15 ′′), respectively. We used the HST segmentation map in Rafelski et al.
(2015) following Inami et al. (2017), which indicates areas in which galaxies
are detected and defines the boundaries of the objects. The segmentation map
was created with Source Extractor (Bertin & Arnouts 1996) with multiple
thresholds for detection and deblending, in order to deblend sources and
optimize detections and photometries, as no single set of such thresholds
perfectly detects bright, faint, large, and small sources simultaneously (see
Section 3.5 and Table 2 in Rafelski et al. 2015). They had four iterations.
The parameter set for the first iteration is called “Deep” with
detect_thresh=1.1$\sigma$ and detect_minarea=9, with which source definitions
near bright targets were poorly defined. The second “Shallow” run has
detect_thresh=3.5$\sigma$ and gave better detections for bright sources. They
merged the two catalogs into one, but both runs have difficulty in deblending
sources. Then, they had two more iterations called “Deep Deblend” and “Shallow
Deblend”, which are with normal deblending parameters and lower deblending
thresholds (see their Table 2). The resulting catalogs are merged into a
single catalog with a single segmentation map (Rafelski et al. 2015).

Figure 19: HST cutouts, segmentation maps, and masks for the first 10 sources
in order of RID. First column: 4′′ $\times$ 4′′ HST $F775W$ cutout images. The
purple dots and circles represent the positions of the UV-selected galaxy and
rin, respectively. Second column: 4′′ $\times$ 4′′ cutouts of the HST
segmentation map. The yellow and green regions indicate the areas in which the
target and neighboring galaxies are detected on the HST images, respectively.
The segmentation map gives the boundaries of the objects. The dark purple
regions indicate the sky. Third column: target’s continuum-component masks (in
the spatial resolution of MUSE, 15′′ $\times$ 15′′). The yellow and dark
purple regions present the mask (the area of the main part of the galaxy) and
the sky, respectively. The violet circles show $r_{\rm CoG}$. Fourth column:
Neighboring object masks (neighbor mask; in the spatial resolution of MUSE,
15′′ $\times$ 15′′). The yellow and dark purple regions present the mask (the
area of the main part of neighboring galaxies that have a bright continuum)
and the sky, respectively.  Figure 20: Same as Figure 19, but for the last 11
sources in order of RID.

##  Appendix D Completeness simulations and non-LAHs

Figure 21: Heat map of the simulated completeness on the diagram of $I_{\rm
h}$ and $r_{\rm s,h}$ of halo models for the first two non-LAH sources
(RID=5479 and 22230). Left and right panels show completeness maps for halo
only models and those for halo and continuum-like components models. Black
stars and asterisks on the map indicate the halo parameter sets that have
completeness values from 45% to 54% and those from 54% to 70%, respectively,
while white large, middle-size, and small circles represent the parameter sets
whose Ly$\alpha$ fluxes of the halo models are from $1\times 10^{-18}$ erg s-1
cm-2 to $2\times 10^{-18}$ erg s-1 cm-2, those from $4\times 10^{-18}$ erg s-1
cm-2 to $6\times 10^{-18}$ erg s-1 cm-2, and those from $1\times 10^{-17}$ erg
s-1 cm-2 to $2\times 10^{-17}$ erg s-1 cm-2, respectively. (a) and (b):
RID=5479. The flux of the continuum-like component is
$f(\mbox{Ly$\alpha$})=1.5\times 10^{-17}$ erg s-1 cm-2.  Figure 22: Same as
Figure 21, but for the last two non-LAH sources (RID=23135 and 54891) (a) and
(b): RID=23135 with $f(\mbox{Ly$\alpha$})=3.7\times 10^{-19}$ erg s-1 cm-2.
(c) and (d) :RID=54891 with $f(\mbox{Ly$\alpha$})=1.6\times 10^{-19}$ erg s-1
cm-2.  Figure 23: Heat map of the relative difference in the completeness for
four non-LAHs on the diagram of $I_{\rm h}$ and $r_{\rm s,h}$ of halo models.
The relative difference in completeness is defined as ($f_{\rm
comp}^{h+c}$-$f_{\rm comp}^{h}$)/$f_{\rm comp}^{h}$, where $f_{\rm
comp}^{h+c}$ and $f_{\rm comp}^{h}$ are the completeness for halo and
continuum-like model, and that for halo only model, respectively. The heat map
gets white when the relative difference is not available ($f_{\rm
comp}^{h}$=0) or $f_{\rm comp}^{h}\sim 0.0033$. Black stars and asterisks on
the map indicate the halo parameter sets that have completeness values for
halo models from 45% to 54% and those from 54% to 70%, respectively, while
gray large, middle-size, and small circles represent the parameter sets whose
Ly$\alpha$ fluxes of the halo models are from $1\times 10^{-18}$ erg s-1 cm-2
to $2\times 10^{-18}$ erg s-1 cm-2, those from $4\times 10^{-18}$ erg s-1 cm-2
to $6\times 10^{-18}$ erg s-1 cm-2, and those from $1\times 10^{-17}$ erg s-1
cm-2 to $2\times 10^{-17}$ erg s-1 cm-2, respectively.

###  D.1 Completeness simulations

We simulated the completeness of the LAH test (Section 3.3) for our four
individual non-LAHs. We created mock NB images with different halo parameters
and repeated the procedures for the halo test as follows.

First, we created 300 NB images with sky background noises by producing random
values for pixels, which follow the Gaussian distribution. The Gaussian width
$\sigma$ was assumed to be the median of the square root of the variance of
the actual optimized NB for each source.

Second, we created various 2D Ly$\alpha$ halo models assuming an exponential
profile as SB profile, $SB(r)$, used in the literature (e.g., Wisotzki et al.
2016; Leclercq et al. 2017; Zhang et al. 2020):

$SB(r)=I_{\rm h}\exp{\left(-\frac{r}{r_{\rm s,h}}\right)},$ (4)

where $I_{\rm h}$ and $r_{\rm s,h}$ are the central surface brightness and the
scale length for haloes. The $I_{\rm h}$ is varied from $1\times 10^{-19}$ erg
s-1 cm-2 arcsec-2 to $8\times 10^{-17}$ erg s-1 cm-2 arcsec-2 with 15 steps in
the log scale, while the $r_{\rm s,h}$ is from 1.0 kpc to 16 kpc with 15 steps
in the log scale. The 2D halo models were convolved with the MUSE PSF at the
Ly$\alpha$ wavelength for each source. In total, we had 225 halo models for
each source. We added each halo model to 300 mock images with background
noises (in total, 67500 images). Then, we measured $r_{\rm CoG}$ (Section 3.2)
and did the same SB test for the existence of the Ly$\alpha$ halo (Section
3.3). We calculated a completeness value for each halo parameter set for each
source by dividing the number of confirmed haloes with 300. We also checked
the median $r_{\rm CoG}$ for each halo parameter set.

We also tested for the case when a source has a Ly$\alpha$ component with a
continuum-like profile. We fixed the model profile of the continuum-like
Ly$\alpha$ component to that of the target’s continuum-component image, which
was obtained from the MUSE PSF convolution to the HST counterpart (Section
3.1). We set the total flux of the target’s continuum-component profile to the
Ly$\alpha$ flux, f(Ly$\alpha$), which is measured from the flux-maximized NB
and the target’s continuum-component mask with an aperture correction. The
aperture correction factor was derived for each source from the target’s
continuum-component image and the target’s continuum-component mask. We added
the continuum-like Ly$\alpha$ component to 300 mock images for each halo
parameter set and then repeated the other procedures. The results of the
completeness for non-LAHs are shown in Figures 21 and 22 for RID=5479 and
22230, and 23135 and 54891, respectively.

Generally, there is a sharp transition between the parameter space with high
completeness values in blue, and the parameter space with low completeness
values in red, depending on $I_{\rm h}$ and $r_{\rm s,h}$ (see the drastic
change of colors near black stars in Figures 21 and 22). The halo tests for
the non-LAH sources are complete when the halo fluxes are equal to or brighter
than $\simeq 4\times 10^{-18}$ erg s-1 cm-2 to $6\times 10^{-18}$ erg s-1 cm-2
in most of the parameter ranges. At a fixed halo flux range (see white circles
with a given size), completeness decreases both when $r_{\rm s,h}$ is too
small and too large. Compact haloes with $r_{\rm s,h}\lesssim 1$–$3$ kpc
mostly cannot be detected due to the MUSE PSF and the method in which we only
used $r=r_{\rm in}$–$r_{\rm CoG}$. We note that Leclercq et al. (2017) found
compact haloes with $r_{\rm s,h}=2$–$3$ kpc with shallower MUSE data without
AO, because of the difference in the methods. We also would like to note that
the $r_{\rm e}$ in UV is $\simeq 0.5$–$1.7$ kpc, which is relatively close to
our limit. The halo only models and halo and continuum-like component models
have similar distribution of completeness and median $r_{\rm CoG}$ in most of
the case. However, the completeness of the two cases are slightly different
from each other when the values are low as seen in Figure 23 (lower than 70%;
black asterisks). In particular, if a galaxy has a bright continuum-like
Ly$\alpha$ component like RID=5479, its extended emission can be hidden by the
continuum-like component for some cases. The non-LAH, RID=5479, has a
$\simeq$0.25 to 1 times lower completeness for the two-component model than
that of the halo only model, when the only halo completeness is
$\simeq$50%–70% with relatively bright $I_{\rm h}$ (i.e., most of the cases
with halo fluxes lower than $6\times 10^{-18}$ erg s-1 cm-2). However, a
bright-continuum component can also help the halo detection by increasing the
S/N required for the test, when $I_{\rm h}$ is low. The parameter space in
which the completeness for both cases is different is narrow for RID=5479, and
the trend holds for both directions. We conclude that it does not cause a
serious bias to our tests. With regard to $r_{\rm CoG}$, it is natural that
the median value gets slightly higher for halo and continuum-like components
models than halo only counterparts, since the continuum-like components can
enhance the S/N on the outskirts. With the completeness obtained here, we give
an overview of non-LAHs in Section 3.3.4, focusing on an object included in
the UV-bright sample (RID=5479), and closely look at the other sources below.

###  D.2 RID=22230

This object has a high confidence level of ZCONF=2 for $z_{\rm s}=3.46$ in the
MXDF catalog and $M_{1500}=-18.60$. It shows a clear Ly$\alpha$ emission line
on the 1D spectrum for $r\leq r_{\rm in}=0\aas@@fstack{\prime\prime}8$ as
shown in Figure 4 and has S/N($r_{\rm in}$–$r_{\rm CoG}$)=6.72 with $r_{\rm
CoG}=1\aas@@fstack{\prime\prime}4$. However, the SB profile at $r\geq r_{\rm
in}$ is consistent with that of the MUSE PSF-convolved HST profile (continuum-
like component), with $p_{0}=0.273$, which is higher than the threshold of
0.05. The completeness simulations for RID=22230 is shown in Figure 21. For
instance, the completeness decreases to $\simeq 50$% at $r_{\rm s,h}$=4.5 kpc
and $I_{\rm h}=8.8\times 10^{-19}$ erg s-1 cm-2 arcsec-2.

On the radial SB profile shown in Figure 8, we can see an absorption-like dip
at the top of the profile with surrounding emission. The dip could be created
by the combination of Ly$\alpha$ absorption and spatially offset and
anisotropic distribution of Ly$\alpha$, which can be confirmed on the NB image
by eye (Figure 4). The S/N of the extended flux (at $r\geq r_{\rm in}$) would
be higher if we only use angle-limited spatial pixels with a direction of the
extended Ly$\alpha$ emission. If we could consider the SB profile at $r\leq
r_{\rm in}$, which is found to be different from the shape of the MUSE PSF-
convolved HST profile by eye, we might be able to confirm a potential halo.
Deeper and higher-spatial resolution data set than MXDF will help improve the
test, but with the current data set and method, this object is classified as a
non-LAH. This object is not included in the UV-bright sample and does not
influence on our main conclusions, or could even support our main conclusions
if it was classified as a LAH.

###  D.3 RID=23135

This object has a confidence level of ZCONF=1 for $z_{\rm s}=3.94$ in the MXDF
catalog and $M_{1500}=-18.39$. As discussed in Section 2.2, it has a faint but
ORIGIN-detected Ly$\alpha$ emission line, which can be seen on the 1D spectrum
for $r\leq r_{\rm in}=0\aas@@fstack{\prime\prime}8$ in Figure 5. However, the
object does not have a sufficient number of spectral slices with S/N¿1.5 at
$r=r_{\rm in}$–$r_{\rm CoG}$ that can be used to create the optimized NBs (see
Section 3.2). As a consequence, it has a low S/N($r_{\rm in}$–$r_{\rm CoG}$)
(¡0) on the NB with $r_{\rm CoG}$=$1\aas@@fstack{\prime\prime}6$. Therefore,
it is clear that this object does not have a significant Ly$\alpha$ halo above
the observational limit. The completeness simulations for RID=23135 are shown
in Figure 22. For instance, the completeness decreases to $\simeq 50$% at
$r_{\rm s,h}$=4.9 kpc and $I_{\rm h}=5.5\times 10^{-19}$ erg s-1 cm-2
arcsec-2.

We would like to note that the nondetection of a halo should not be a direct
result of a wrong redshift (i.e., low ZCONF value). On the contrary, if it had
a clear extended Ly$\alpha$ emission line, it could be a redshift indicator
and raise the ZCONF value in the MXDF catalog. Since the UV magnitude is
faint, this object is not included in the UV-bright sample. The Ly$\alpha$
halo fraction for the sample including all sources could be even higher, if we
excluded this object.

###  D.4 RID=54891

This object has a confidence level of ZCONF=0 for $z_{\rm s}=2.94$ and
$M_{1500}=-18.02$. As discussed in Section 2.2, it does not have ORIGIN-
detected lines but has a faint Ly$\alpha$ line (see the NB and SB profile in
Figure 5). Similar to RID=23135, the object does not have a sufficient number
of spectral slices at $r=r_{\rm in}$–$r_{\rm CoG}$ for an optimized NB (see
Section 3.2; $r_{\rm in}=0\aas@@fstack{\prime\prime}8$, $r_{\rm
CoG}=2\aas@@fstack{\prime\prime}2$), the S/N($r_{\rm in}$–$r_{\rm CoG}$) on
the NB is only 1.29. Therefore, it is clear that this object does not have a
significant Ly$\alpha$ halo. The completeness simulations for RID=54891 is
shown in Figure 22. For instance, the completeness decreases to $\simeq 50$%
at $r_{\rm s,h}$=6.3 kpc and $I_{\rm h}=5.7\times 10^{-19}$ erg s-1 cm-2
arcsec-2. Since the UV magnitude is faint, this object is not included in the
UV-bright sample.


* [62] James E Maddux and Ronald W Rogers.  Protection motivation and self-efficacy: A revised theory of fear appeals and attitude change.  Journal of experimental social psychology, 19(5):469–479, 1983\.  doi:10.1016/0022-1031(83)90023-9.
  * [63] Peter Mayer, Alexandra Kunz, and Melanie Volkamer.  Reliable behavioural factors in the information security context.  In International Conference on Availability, Reliability and Security, pages 9:1–9:10, Reggio Calabria, Italy, August 2017. ACM.  doi:10.1145/3098954.3098986.
  * [64] Peter Mayer, Collins W. Munyendo, Michelle L. Mazurek, and Adam J. Aviv.  Why Users (Don’t) Use Password Managers at a Large Educational Institution.  In USENIX Security Symposium, pages 1849–1866, Boston, MA, USA, August 2022. USENIX.  https://www.usenix.org/system/files/sec22-mayer.pdf.
  * [65] Peter Mayer, Yixin Zou, Byron M Lowens, Hunter A Dyer, Khue Le, Florian Schaub, and Adam J Aviv.  Awareness, Intention,(In) Action: Individuals’ Reactions to Data Breaches.  ACM Transactions on Computer-Human Interaction, 30(5):77:1–77:53, 2023.  doi:10.1145/3589958.
  * [66] Peter Mayer, Yixin Zou, Florian Schaub, and Adam J. Aviv.  “Now I’m a bit angry:” Individuals’ Awareness, Perception, and Responses to Data Breaches that Affected Them.  In USENIX Security Symposium, pages 393–410, Virtual Conference, August 2021. USENIX.  https://www.usenix.org/system/files/sec21fall-mayer.pdf.
  * [67] Michelle L. Mazurek, Saranga Komanduri, Timothy Vidas, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, Patrick Gage Kelley, Richard Shay, and Blase Ur.  Measuring Password Guessability for an Entire University.  In ACM Conference on Computer and Communications Security, pages 173–186, Berlin, Germany, November 2013. ACM.  doi:10.1145/2508859.2516726.
  * [68] Nora McDonald, Sarita Schoenebeck, and Andrea Forte.  Reliability and inter-rater reliability in qualitative research: Norms and guidelines for CSCW and HCI practice.  Proceedings of the ACM on Human-Computer Interaction, 3(CSCW):72:1–72:23, 2019.  doi:10.1145/3359174.
  * [69] B Dawn Medlin and Joseph A Cazier.  An Empirical Investigation: Health Care Employee Passwords and Their Crack Times in Relationship to HIPAA Security Standards.  International Journal of Healthcare Information Systems and Informatics, 2(3):39–48, 2007.  doi:10.4018/jhisi.2007070104.
  * [70] Sarah Milne, Paschal Sheeran, and Sheina Orbell.  Prediction and Intervention in Health-Related Behavior: A Meta-Analytic Review of Protection Motivation Theory.  Journal of Applied Social Psychology, 30(1):106–143, 2006.  doi:10.1111/j.1559-1816.2000.tb02308.x.
  * [71] Deirdre K Mulligan, Priscilla M Regan, and Jennifer King.  The fertile dark matter of privacy takes on the dark patterns of surveillance.  Journal of Consumer Psychology, 30(4):767–773, 2020.  doi:10.1002/jcpy.1190.
  * [72] Boon-Yuen Ng, Atreyi Kankanhalli, and Yunjie Calvin Xu.  Studying users’ computer security behavior: A health belief perspective.  Decision Support Systems, 46(4):815–825, 2009.  doi:10.1016/j.dss.2008.11.010.
  * [73] Office of the California Attorney General.  California Consumer Privacy Act (CCPA): Final Text of Proposed Regulations, March 2020.  https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/oal-sub-final-text-of-regs.pdf, accessed on: .
  * [74] Jeremiah Onaolapo, Enrico Mariconti, and Gianluca Stringhini.  What Happens After You Are Pwnd: Understanding the Use of Leaked Webmail Credentials in the Wild.  In Internet Measurement Conference, pages 65–79, Santa Monica, CA, USA, November 2016. ACM.  doi:10.1145/2987443.2987475.
  * [75] Sarah Pearman, Jeremy Thomas, Pardis Emami Naeini, Hana Habib, Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, Serge Egelman, and Alain Forget.  Let’s go in for a closer look: Observing passwords in their natural habitat.  In Conference on Computer and Communications Security, pages 295–310, Dallas, TX, USA, October 2017. ACM.  doi:10.1145/3133956.3133973.
  * [76] Sarah Pearman, Shikun Aerin Zhang, Lujo Bauer, Nicolas Christin, and Lorrie Faith Cranor.  Why People (Don’t) Use Password Managers Effectively.  In Symposium on Usable Privacy and Security, pages 319–338, Santa Clara, CA, USA, August 2019. USENIX.  https://www.usenix.org/system/files/soups2019-pearman.pdf.
  * [77] Eyal Peer, Serge Egelman, Marian Harbach, Nathan Malkin, Arunesh Mathur, and Alisa Frik.  Nudge me right: Personalizing online security nudges to people’s decision-making styles.  Computers in Human Behavior, 109:106347, 2020.  doi:10.1016/j.chb.2020.106347.
  * [78] Jennifer Pullman, Kurt Thomas, and Elie Bursztein.  Protect your accounts from data breaches with Password Checkup, February 2019.  https://security.googleblog.com/2019/02/protect-your-accounts-from-data.html, accessed on: .
  * [79] Hirak Ray, Flynn Wolf, Ravi Kuber, and Adam J Aviv.  Why older adults (don’t) use password managers.  In USENIX Security Symposium, pages 73–90, Virtual Conference, 2021\. USENIX.  https://www.usenix.org/system/files/sec21-ray.pdf.
  * [80] Elissa M. Redmiles.  “Should I Worry?” A Cross-Cultural Examination of Account Security Incident Response.  In IEEE Symposium on Security and Privacy, pages 920–934, San Francisco, CA, USA, May 2019. IEEE.  doi:10.1109/SP.2019.00059.
  * [81] Elissa M. Redmiles, Ziyun Zhu, Sean Kross, Dhruv Kuchhal, Tudor Dumitras, and Michelle L. Mazurek.  Asking for a Friend: Evaluating Response Biases in Security User Studies.  In ACM Conference on Computer and Communications Security, pages 1238–1255, Toronto, Ontario, Canada, October 2018. ACM.  doi:10.1145/3243734.3243740.
  * [82] Ronald W Rogers.  A protection motivation theory of fear appeals and attitude change.  The Journal of Psychology, 91(1):93–114, 1975.  doi:10.1080/00223980.1975.9915803.
  * [83] Ronald W Rogers.  Cognitive and psychological processes in fear appeals and attitude change: A revised theory of protection motivation.  Social psychophysiology: A sourcebook, pages 153–176, 1983.
  * [84] Sasha Romanosky, Rahul Telang, and Alessandro Acquisti.  Do data breach disclosure laws reduce identity theft?  Journal of Policy Analysis and Management, 30(2):256–286, 2011\.  doi:10.1002/pam.20567.
  * [85] Robert AC Ruiter, Loes TE Kessels, Gjalt-Jorn Y Peters, and Gerjo Kok.  Sixty years of fear appeal research: Current state of the evidence.  International journal of psychology, 49(2):63–70, 2014.  doi:10.1002/ijop.12042.
  * [86] Johnny Saldaña.  The Coding Manual for Qualitative Researchers.  Sage, Thousand Oaks, CA, USA, 2015.
  * [87] Shruti Sannon, Billie Sun, and Dan Cosley.  Privacy, surveillance, and power in the gig economy.  In ACM Conference on Human Factors in Computing Systems, pages 619:1–619:15, New Orleans, LA, USA, April 2022. ACM.  doi:10.1145/3491102.3502083.
  * [88] Richard Shay, Iulia Ion, Robert W. Reeder, and Sunny Consolvo.  “My Religious Aunt Asked Why I Was Trying to Sell Her Viagra”: Experiences with Account Hijacking.  In ACM Conference on Human Factors in Computing Systems, pages 2657–2666, Toronto, Ontario, Canada, April 2014. ACM.  doi:10.1145/2556288.2557330.
  * [89] Richard Shay, Saranga Komanduri, Adam L Durity, Phillip Huh, Michelle L Mazurek, Sean M Segreti, Blase Ur, Lujo Bauer, Nicolas Christin, and Lorrie Faith Cranor.  Designing password policies for strength and usability.  ACM Transactions on Information and System Security, 18(4):13:1–13:34, 2016.  doi:10.1145/2891411.
  * [90] Paschal Sheeran and Thomas L Webb.  The intention–behavior gap.  Social and Personality Psychology Compass, 10(9):503–518, 2016\.  doi:10.1111/spc3.12265.
  * [91] Ruth Shillair, Shelia R Cotten, Hsin-Yi Sandy Tsai, Saleem Alhabash, Robert LaRose, and Nora J Rifon.  Online safety begins with you and me: Convincing internet users to protect themselves.  Computers in Human Behavior, 48:199–207, 2015.  doi:10.1016/j.chb.2015.01.046.
  * [92] Jeff Shiner.  Finding compromised passwords with 1Password, August 2018.  https://blog.1password.com/finding-pwned-passwords-with-1password/, accessed on: .
  * [93] Mikko Siponen, M Adam Mahmood, and Seppo Pahnila.  Employees’ adherence to information security policies: An exploratory field study.  Information & Management, 51(2):217–224, 2014.  doi:10.1016/j.im.2013.08.006.
  * [94] Daniel J Solove and Woodrow Hartzog.  Breached!: Why Data Security Law Fails and How to Improve it.  Oxford University Press, Oxford, UK, 2022.
  * [95] Elizabeth Stobert and Robert Biddle.  The Password Life Cycle: User Behaviour in Managing Passwords.  In Symposium on Usable Privacy and Security, pages 243–255, Menlo Park, CA, USA, July 2014. USENIX.  https://www.usenix.org/system/files/conference/soups2014/soups14-paper-stobert.pdf.
  * [96] Peter Story, Daniel Smullen, Alessandro Acquisti, Lorrie Faith Cranor, Norman Sadeh, and Florian Schaub.  From intent to action: Nudging users towards secure mobile payments.  In Symposium on Usable Privacy and Security, pages 379–415, Virtual Conference, August 2020. USENIX.  https://www.usenix.org/system/files/soups2020-story.pdf.
  * [97] Peter Story, Daniel Smullen, Rex Chen, Yaxing Yao, Alessandro Acquisti, Lorrie Faith Cranor, Norman Sadeh, and Florian Schaub.  Increasing Adoption of Tor Browser Using Informational and Planning Nudges.  Proceedings on Privacy Enhancing Technologies, 2:152–183, 2022\.  doi:10.2478/popets-2022-0040.
  * [98] The Federal Trade Commission.  When information is lost or exposed, January 2020.  https://www.identitytheft.gov/databreach, accessed on: .
  * [99] The Federal Trade Commission.  CAN-SPAM Act: A Compliance Guide for Business, August 2023.  https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business, accessed on: .
  * [100] Kurt Thomas, Frank Li, Ali Zand, Jacob Barrett, Juri Ranieri, Luca Invernizzi, Yarik Markov, Oxana Comanescu, Vijay Eranti, Angelika Moscicki, Daniel Margolis, Vern Paxson, and Elie Bursztein.  Data Breaches, Phishing, or Malware? Understanding the Risks of Stolen Credentials.  In ACM Conference on Computer and Communications Security, pages 1421–1434, Dallas, TX, USA, October 2017. ACM.  doi:10.1145/3133956.3134067.
  * [101] Kurt Thomas, Jennifer Pullman, Kevin Yeo, Ananth Raghunathan, Patrick Gage Kelley, Luca Invernizzi, Borbala Benko, Tadek Pietraszek, Sarvar Patel, Dan Boneh, and Elie Bursztein.  Protecting Accounts from Credential Stuffing with Password Breach Alerting.  In USENIX Security Symposium, pages 1556–1571, Santa Clara, CA, USA, August 2019. USENIX.  https://www.usenix.org/system/files/sec19-thomas.pdf.
  * [102] United Kingdom National Cybersecurity Center.  Password administration for system owners, January 2018.  https://www.ncsc.gov.uk/collection/passwords/updating-your-approach, accessed on: .
  * [103] United States Census Bureau.  Age and Sex Tables, January 2022.  https://www.census.gov/topics/population/age-and-sex/data/tables.2019.List_897222059.html, accessed on: .
  * [104] United States Census Bureau.  Census Bureau Releases New Educational Attainment Data, January 2022\.  https://www.census.gov/newsroom/press-releases/2022/educational-attainment.html, accessed on: .
  * [105] United States Census Bureau.  Selected Characteristics of Households by Total Money Income, January 2022.  https://www.census.gov/data/tables/time-series/demo/income-poverty/cps-hinc/hinc-01.html, accessed on: .
  * [106] United States Census Bureau.  U.S. Census Bureau QuickFacts, January 2022.  https://www.census.gov/quickfacts/fact/table/US/LFE046220, accessed on: .
  * [107] Blase Ur, Jonathan Bees, Sean M. Segreti, Lujo Bauer, Nicolas Christin, and Lorrie Faith Cranor.  Do Users’ Perceptions of Password Security Match Reality?  In ACM Conference on Human Factors in Computing Systems, pages 3748–3760, San Jose, CA, USA, May 2016. ACM.  doi:10.1145/2858036.2858546.
  * [108] Blase Ur, Patrick Gage Kelley, Saranga Komanduri, Joel Lee, Michael Maass, Michelle L. Mazurek, Timothy Passaro, Richard Shay, Timothy Vidas, Lujo Bauer, Nicolas Christin, and Lorrie Faith Cranor.  How Does Your Password Measure Up? The Effect of Strength Meters on Password Creation.  In USENIX Security Symposium, pages 65–80, Bellevue, WA, USA, August 2012. USENIX.  https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final209.pdf.
  * [109] Blase Ur, Fumiko Noma, Jonathan Bees, Sean M. Segreti, Richard Shay, Lujo Bauer, Nicolas Christin, and Lorrie Faith Cranor.  “I Added ‘!’ at the End to Make It Secure”: Observing Password Creation in the Lab.  In Symposium on Usable Privacy and Security, pages 123–140, Ottawa, Ontario, Canada, July 2015. USENIX.  https://www.usenix.org/system/files/conference/soups2015/soups15-paper-ur.pdf.
  * [110] René van Bavel, Nuria Rodríguez-Priego, José Vila, and Pam Briggs.  Using protection motivation theory in the design of nudges to improve online security behavior.  International Journal of Human-Computer Studies, 123:29–39, 2019\.  doi:10.1016/j.ijhcs.2018.11.003.
  * [111] Anthony Vance, David Eargle, Kirk Ouimet, and Detmar Straub.  Enhancing Password Security through Interactive Fear Appeals: A Web-based Field Experiment.  In Hawaii International Conference on System Sciences, pages 2988–2997, Maui, HI, USA, January 2013. IEEE.  doi:10.1109/HICSS.2013.196.
  * [112] Ashlee Vance.  If Your Password Is 123456, Just Make It HackMe, January 2010.  https://www.nytimes.com/2010/01/21/technology/21password.html, accessed on: .
  * [113] Rafael Veras, Christopher Collins, and Julie Thorpe.  On the Semantic Patterns of Passwords and their Security Impact.  In Symposium on Network and Distributed System Security, pages 27:1–27:16, San Diego, CA, USA, February 2014. Internet Society.  https://www.ndss-symposium.org/ndss2014/programme/semantic-patterns-passwords-and-their-security-impact/.
  * [114] Ding Wang, Zijian Zhang, Ping Wang, Jeff Yan, and Xinyi Huang.  Targeted Online Password Guessing: An Underestimated Threat.  In ACM Conference on Computer and Communications Security, pages 1242–1254, Vienna, Austria, October 2016. ACM.  doi:10.1145/2976749.2978339.
  * [115] Rick Wash, Emilee Radar, Ruthie Berman, and Zac Wellmer.  Understanding Password Choices: How Frequently Entered Passwords are Re-used Across Websites.  In Symposium on Usable Privacy and Security, pages 175–188, Denver, CO, USA, July 2016. USENIX.  https://www.usenix.org/system/files/conference/soups2016/soups2016-paper-wash.pdf.
  * [116] Rick Wash, Emilee Rader, and Chris Fennell.  Can people self-report security accurately? agreement between self-report and behavioral measures.  In ACM Conference on Human Factors in Computing Systems, pages 2228–2232, Denver, CO, USA, May 2017. ACM.  doi:10.1145/3025453.3025911.
  * [117] Thomas L Webb and Paschal Sheeran.  Does changing behavioral intentions engender behavior change? a meta-analysis of the experimental evidence.  Psychological Bulletin, 132(2):249–268, 2006.  doi:10.1037/0033-2909.132.2.249.
  * [118] Neil D Weinstein.  Testing four competing theories of health-protective behavior.  Health Psychology, 12(4):324–333, 1993.  doi:10.1037/0278-6133.12.4.324.
  * [119] Daniel Lowe Wheeler.  zxcvbn: Low-Budget Password Strength Estimation.  In USENIX Security Symposium, pages 157–173, Austin, TX, USA, August 2016. USENIX.  https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_wheeler.pdf.
  * [120] Michael Workman, William H Bommer, and Detmar Straub.  Security lapses and the omission of information security measures: A threat control model and empirical test.  Computers in Human Behavior, 24(6):2799–2816, 2008.  doi:10.1016/j.chb.2008.04.005.
  * [121] Justin Wu and Daniel Zappala.  When is a Tree Really a Truck? Exploring Mental Models of Encryption.  In Symposium on Usable Privacy and Security, pages 395–409, Baltimore, MD, USA, August 2018. USENIX.  https://www.usenix.org/system/files/conference/soups2018/soups2018-wu.pdf.
  * [122] Yixin Zou, Shawn Danino, Kaiwen Sun, and Florian Schaub.  You ‘Might’ Be Affected: An Empirical Analysis of Readability and Usability Issues in Data Breach Notifications.  In ACM Conference on Human Factors in Computing Systems, pages 194:1–194:14, Glasgow, Scotland, UK, May 2019. ACM.  doi:10.1145/3290605.3300424.
  * [123] Yixin Zou, Abraham H Mhaidli, Austin McCall, and Florian Schaub.  “I’ve Got Nothing to Lose”: Consumers’ Risk Perceptions and Protective Actions after the Equifax Data Breach.  In Symposium on Usable Privacy and Security, pages 197–216, Baltimore, MD, USA, August 2018. USENIX.  https://www.usenix.org/system/files/conference/soups2018/soups2018-zou.pdf.
  * [124] Yixin Zou, Kevin Roundy, Acar Tamersoy, Saurabh Shintre, Johann Roturier, and Florian Schaub.  Examining the Adoption and Abandonment of Security, Privacy, and Identity Theft Protection Practices.  In ACM Conference on Human Factors in Computing Systems, pages 443:1–443:15, Honolulu, HI, USA, April 2020. ACM.  doi:10.1145/3313831.3376570.

##  Appendix A Survey Material

###  A.1. Screening Survey

#### Informed consent

[This informed consent form was for the screening survey. We used a very
similar consent form for the main and follow-up surveys, except adjusting the
estimated completion time and compensation.]

Study Title: Consumers’ Reactions Toward Data Breaches

Principal Investigators: REDACTED

Purpose of this Study: We are conducting a research study to understand how
consumers perceive and react to data breaches.

Description of your involvement:

If you agree to be part of the research study, we will ask you to complete a
screening survey that asks you to provide an email address. We will query this
email address in haveibeenpwned.com, a public database, to see if it has
appeared in any data breaches.

Depending on the query results, we may send you an invitation to our main
survey following your completion. The main survey will show more information
about these breaches and ask you to answer a few questions about them.

Compensation:

We expect this screening survey to take about two to three minutes. You will
be compensated $0.80 upon completing the survey.

You are free to withdraw at any time. However, you will not be compensated if
you withdraw from the study.

Benefits and Risks: Although you may not directly benefit from participating
in this study, the study will inform how to better protect consumers against
data breaches.

The risks associated with your participation are similar to those normally
encountered when using the Internet. We take strong measures to protect your
personal information, as we outline in the “Confidentiality” section.

Confidentiality: By participating in the study, you understand and agree that
the REDACTED may be required to disclose your consent form, data and other
personally identifiable information as required by law, regulation, subpoena
or court order.

Otherwise, your confidentiality will be maintained in the following manner:

  * •

Your data will be stored in password-protected cloud services and will only be
accessible to the study team.

  * •

We plan to publish the results of this study, but we will not include any
information that would identify you.

  * •

Throughout the study, you will not be asked to provide any direct personal
identifiers in the study apart from your email address. We do not track your
email address, and we will not be able to tie your email address to any
results or analysis. All records of your email address will reside in
temporary storage to facilitate the lookup of data breaches, and will be
deleted following the completion of this task. We will never see your actual
email address.

Right to Ask Questions & Contact Information: If you have questions about this
research, you may contact the study team at REDACTED.

The REDACTED Institutional Review Board has determined that this study is
exempt from IRB oversight.

Voluntary Consent: By proceeding to the next page, you are agreeing to
participate in this study. You may print a copy of this consent form for your
records. You may also contact the study team at any time by emailing REDACTED
if you think of a question later.

Are you 18 years of age or older? $\circ$ Yes $\circ$ No

Are you physically living in the United States? $\circ$ Yes $\circ$ No

[Participants need to answer “Yes” for both questions to proceed to the next
page. If the answer is “No” to any question, show an error message “We’re
sorry, but to participate in this survey you must be at least 18 and currently
physically located in the United States. Thank you for your interest.”]

#### Breach lookup

We are going to ask you to enter your most commonly used email address at the
bottom of this page. We will use your email address to look up whether your
email address has appeared in any data breaches (also called “security
breaches”), using the public lookup service for data breaches
haveibeenpwned.com. Based on the results, we may invite you to our main survey
in which we will show you more information about these breaches.

Privacy Notice: We do not track or store your email address as part of this
study, and we will not be able tie your email address to any results or
analysis. All records of your email address will reside in temporary storage
to facilitate the lookup of data breaches, and will be deleted following the
completion of this task. We will never see your actual email address.

To access information about breaches, your email address will be communicated
to haveibeenpwned.com, a public service that maintains a database of data
breaches involving email addresses. Communication with haveibeenpwned.com will
occur on secure and encrypted channels. haveibeenpwned.com does not
permanently store email addresses used in queries as described in their
privacy policy.

If you have any further concerns about providing your email address, you may
opt-out of the survey at this time. We will remove any record of your
participation. Note that if you choose to opt out, you will not be
compensated.

  1. (1)

Please enter your most commonly used email address. After the task, you may
search for another email address, but for now, we are primarily interested in
breaches that may have involved your most commonly used email address. [free
text]

#### Email-related questions

Please tell us more about this email address.

  1. (2)

Whose email address is it? $\circ$ It is my own account / I have sole
ownership of this account $\circ$ It is my shared account / I share the
account with someone else (e.g., a partner or family member) $\circ$ It is
someone else’s account / someone else has sole ownership of this account
$\circ$ I made up an email address just for this study

  2. (3)

How often do you check emails in this account? $\circ$ Every day $\circ$ A few
times a week $\circ$ A few times a month $\circ$ A few times a year or less
frequently

  3. (4)

What do you use this email account for? Choose all that apply. $\circ$ For
personal correspondence (e.g., friends and family members) $\circ$ For
professional correspondence (e.g., with colleagues, business partners) $\circ$
Sign up for sensitive accounts (e.g., banking, taxes) $\circ$ Sign up for
medium sensitive accounts (e.g., social media, online shopping) $\circ$ Sign
up for low-value accounts (I used it when I’m prompted to sign up but don’t
really care) $\circ$ Other [free-text]

  4. (5)

How long have you been using this email account? [number entry] $\circ$
year(s) $\circ$ month(s) $\circ$ week(s) $\circ$ day(s)

  5. (6)

How many other email addresses/accounts do you regularly use? (Not counting
the one you entered) [number entry]

  6. (7)

Prior to our study, have you ever checked if this email address has appeared
in any data breaches using Have I Been Pwned (haveibeenpwned.com) or other
services? $\circ$ Yes $\circ$ No $\circ$ Unsure

#### Demographics-related questions

As the final part of this survey, please tell us a few things about yourself.

  1. (8)

What is your age? [number entry or “prefer not to say”]

  2. (9)

What is your gender? $\circ$ Man $\circ$ Woman $\circ$ Non-Binary $\circ$
Prefer to self-describe: [free text] $\circ$ Prefer not to say

  3. (10)

What is the highest level of education you have completed? $\circ$ Less than
high school $\circ$ High school or equivalent $\circ$ Some college, no degree
$\circ$ Associate’s degree, occupational $\circ$ Associate’s degree, academic
$\circ$ Bachelor’s Degree $\circ$ Master’s Degree $\circ$ Professional degree
$\circ$ Doctoral degree $\circ$ Prefer not to say

  4. (11)

Have you studied or worked in the field of computer science or information
technology? $\circ$ Yes $\circ$ No $\circ$ Prefer not to answer

  5. (12)

Have you studied or practiced law or other legal services? $\circ$ Yes $\circ$
No $\circ$ Prefer not to answer

  6. (13)

What was your total household income before taxes during the past 12 months?
$\circ$ Under $15,000 $\circ$ $15,000 to $24,999 $\circ$ $25,000 to $34,999
$\circ$ $35,000 to $49,999 $\circ$ $50,000 to $74,999 $\circ$ $75,000 to
$99,999 $\circ$ $100,000 to $149,999 $\circ$ $150,000 or above $\circ$ Prefer
not to say

  7. (14)

Which of the following best describes you? Choose one or more. $\circ$ White
$\circ$ Black or African American $\circ$ Asian $\circ$ American Indian or
Alaska Native $\circ$ Native Hawaiian or other Pacific Islander $\circ$ Middle
Eastern or North African descent $\circ$ Prefer to self-describe: [free text]

  8. (15)

Are you Hispanic or Latino? $\circ$ Yes $\circ$ No $\circ$ Prefer not to say

#### Next steps (only for eligible participants)

We will send you the link to our main survey within the next week. In the main
survey, we will show you more details about the data breach records associated
with your provided email address.

Please click the “continue” button to proceed to the next page, where you will
be automatically redirected to Prolific.

Stay tuned, and we look forward to seeing you back!

#### Debrief (only for ineligible participants)

[For participants who did not have any password breach but had other data
breaches associated with their provided email address:]

Thank you for completing our screening survey. We’re looking for participants
who have at least one password breach (i.e., a data breach that exposes users’
account passwords) to take our main survey. According to haveibeenpwned.com,
your email address has not appeared in any password breach.

That being said, your email address has appeared in the following data
breaches, and we suggest that you take necessary precautions. Please note that
you can always obtain the same results by checking your email address on
haveibeenpwned.com, which, in addition, provides records with sensitive
breaches upon the verification of your email account. Please keep in mind that
this list only reflects breaches that are registered in the haveibeenpwned.com
database, your information may have been exposed in other breaches.

[For participants who did not have any data breach with their provided email
address:]

Thank you for completing our screening survey. We’re looking for participants
who have at least one password breach (i.e., a data breach that exposes users’
account passwords) to take our main survey. According to haveibeenpwned.com,
your email address has not appeared in any data breach.

That’s great news! However, we still recommend that you monitor breach
services like haveibeenpwned.com in case new breaches come to light. In case
you still want to learn about what to do when you’re affected by a breach, you
can find several resources below.

[For all ineligible participants:]

Below is a list of resources to help you better protect yourself from data
breaches.

  * •

Resources about recovering from a data breach:

    * –

Federal Trade Commission: Identity theft recovery steps

    * –

Federal Trade Commission: Credit Freeze FAQs

    * –

Firefox Monitor: What to do after a data breach

    * –

Norton: What to do after 5 types of data breaches

  * •

Resources about protecting yourself against future breaches:

    * –

Firefox Monitor: How to create strong passwords

    * –

Firefox Monitor: Steps to protect your online identity

###  A.2. Main Survey

#### Show breach

In our previous survey, you provided an email address for querying the Have I
Been Pwned (haveibeenpwned.com, referred to as “HIBP” onward) database for
data breach records. Below is a data breach in which your provided email
address has appeared. [Show breach information.]

#### Breach-related questions

  1. (16)

Prior to our study, have you ever heard of [site name]? $\circ$ Yes $\circ$ No
$\circ$ Unsure

  2. (17)

Prior to our study, were you aware that you are affected by the [site name]
data breach? $\circ$ Yes $\circ$ No $\circ$ Unsure

  3. (18)

To your knowledge, do you have an account with [site name]? $\circ$ Yes, I
created an account by providing an email address and a password $\circ$ Yes, I
created an account through a third-party service (e.g., “sign in with Google”
or “sign in with Facebook”) $\circ$ No, I did not have an account with [site
name]

  4. (19)

[If “unsure” for Q16/Q17/Q18] You selected unsure for [Q16/Q17/Q18]. Please
explain why you selected “unsure.” [free text]

  5. (20)

[If “yes” for Q18] To the best of your memory, how long have you been using
your [site name] account? [number entry] $\circ$ year(s) $\circ$ month(s)
$\circ$ week(s) $\circ$ day(s)

  6. (21)

[If “yes” for Q18] How often do you use your [site name] account? $\circ$
Every day $\circ$ A few times a week $\circ$ A few times a month $\circ$ A few
times a year or less frequently

  7. (22)

[If “yes” for Q18] To the best of your memory, does your [company name]
account have any of the following information about you? Please select all
that apply. $\circ$ Date of birth $\circ$ Financial information (e.g., bank
accounts or credit card numbers $\circ$ Gender $\circ$ IP address $\circ$ Name
$\circ$ Phone number $\circ$ Residential address

  8. (23)

[If “yes” for Q18] Is there any other type of information the account may have
about you? If you cannot think of any, please write “I don’t know.” [free
text]

  9. (24)

[If “yes” for Q18] How important or unimportant is your [site name] account to
you? $\circ$ Very unimportant $\circ$ Unimportant $\circ$ Somewhat unimportant
$\circ$ Neither important nor unimportant $\circ$ Somewhat important $\circ$
Important $\circ$ Very important

#### Measuring password change intention

[Show intervention, see Figures 2 and 2 for the specific text.]

  1. (25)

After learning about this breach, do you intend to change the password of your
[site name] account? $\circ$ Yes, I intend to change the password of my [site
name] account $\circ$ No, I do not intend to change the password of my [site
name] account $\circ$ I have already changed the password of my [company name]
account after this breach occurred (on [date]) and before taking this survey

  2. (26)

Please explain why you selected this answer option. [free text]

  3. (27)

Do you use your [site name] account’s password for any other online accounts?
$\circ$ Yes $\circ$ No $\circ$ I don’t know $\circ$ I don’t have an account
with [site name]

#### Measuring PMT constructs

[The order of questions in this section was randomized.]

  1. (28)

Please rate to what extent the following incidents would be a serious problem
to you. [Answer options for each: not at all serious, slightly serious,
somewhat serious, serious, extremely serious.] $\circ$ Experience financial
loss $\circ$ Have my personal information sold to marketers $\circ$ Have my
online accounts hacked by someone $\circ$ Have my identity stolen by someone
$\circ$ Receive more spam emails $\circ$ Please select “extremely serious”
(this is an attention check)

  2. (29)

As a result of the [site name] data breach, how likely or unlikely do you
think you are to experience the following incidents? [Answer options for each:
very unlikely, somewhat unlikely, neither likely nor unlikely, somewhat
likely, very likely.] $\circ$ Experience financial loss $\circ$ Have my
personal information sold to marketers $\circ$ Have my online accounts hacked
by someone $\circ$ Have my identity stolen by someone $\circ$ Receive more
spam emails $\circ$ Please select “very unlikely” (this is an attention check)

  3. (30)

Please rate your level of disagreement or agreement with the following
statement: “Changing the password of my [site name] account will protect me
from negative incidents as a result of the [site name] breach.” $\circ$
Strongly disagree $\circ$ Somewhat disagree $\circ$ Neither agree nor disagree
$\circ$ Somewhat agree $\circ$ Strongly agree

  4. (31)

How easy or difficult do you think it would be for you to change the password
of your [site name] account? $\circ$ Very difficult $\circ$ Somewhat difficult
$\circ$ Neither easy nor difficult $\circ$ Somewhat easy $\circ$ Very easy

  5. (32)

If I were to change the password of my [site name] account, I would… [Answer
options for each: not true at all, slightly true, somewhat true, true,
extremely true.] $\circ$ Spend a lot of time changing the password $\circ$
Changing the password requires me to learn new skills $\circ$ Feel more
anxious about the [site name] data breach $\circ$ Forget the new password and
be locked out of the account

#### SA-6 & prior negative experience

You’re almost done! Just a few questions about yourself.

  1. (33)

Please indicate your agreement with the following statements. [Answer options
for each: strongly disagree, somewhat disagree, neither agree nor disagree,
somewhat agree, strongly agree.] $\circ$ Generally, I diligently follow a
routine about security practices. $\circ$ I always pay attention to experts’
advice about the steps I need to take to keep my online data and accounts
safe. $\circ$ I am extremely knowledgeable about all the steps needed to keep
my online data and accounts safe. $\circ$ I am extremely motivated to take all
the steps needed to keep my online data and accounts safe. $\circ$ I often am
interested in articles about security threats. $\circ$ I seek out
opportunities to learn about security measures that are relevant to me.

  2. (34)

Has anyone ever gained unauthorized access to one of your online accounts?
E.g., someone secretly changed your password without you noticing it. $\circ$
Yes $\circ$ No $\circ$ Unsure

  3. (35)

Have you ever learned that your information was exposed in a data breach
before taking our survey? $\circ$ Yes $\circ$ No $\circ$ Unsure

  4. (36)

Have you ever been a victim of identity theft? E.g., someone secretly applied
for a new credit card under your name. $\circ$ Yes $\circ$ No $\circ$ Unsure

  5. (37)

[If “unsure” for Q34/Q35/Q36] You selected unsure for [Q34/Q35/Q36]. Please
explain why you selected “unsure.” [free text]

#### Final remarks

Thank you for completing this survey! Please note that the information about
this data breach we showed to you is real. Your email address and potentially
other personal information has appeared in this breach and could be used by
criminals to steal your identity or access your online accounts.

You can check a full list of data breaches associated with your email address
on haveibeenpwned.com, which, in addition, provides records with sensitive
breaches upon the verification of your email account. Please keep in mind that
this list only reflects breaches that are registered in the haveibeenpwned.com
database, your information may have been exposed in other breaches.

Please click the “continue” button to proceed to the next page, where you will
be automatically redirected to Prolific.

###  A.3. Follow-up Survey

#### Reminder of breach

In our previous survey, you provided an email address for querying the Have I
Been Pwned (haveibeenpwned.com, referred to as “HIBP” onward) database for
data breach records.

Below is a data breach in which your provided email address has appeared.

[Show breach information.]

  1. (38)

Since taking our previous survey on [date], what did you do, if anything,
after learning that your information was exposed in the [site name] data
breach? Please explain why. [free text]

#### Attention check

  1. (39)

This is an attention check. What is the name of the company that suffered a
data breach and exposed your information, as we show you in the previous page?
$\circ$ correct answer $\circ$ AKP emails $\circ$ KnownCircle $\circ$ Staminus

#### Measuring password change behavior

  1. (40)

You took our previous survey on [date]. The survey showed that your
information was exposed in the [site name] data breach. Since then, have you
changed the password for your [site name] account? $\circ$ Yes $\circ$ No

  2. (41)

Please explain why you changed or did not change your [site name] account’s
password after taking our previous survey on [date]. [free text]

  3. (42)

What did you do about passwords for other accounts? $\circ$ I changed the
password for every online account I have $\circ$ I changed the password for
other accounts that use the same or similar passwords $\circ$ I changed the
password for really important accounts (e.g., bank accounts) $\circ$ I kept
using the same password for other accounts

  4. (43)

[If “Yes” for Q40] To your best estimate, how soon after taking our previous
survey on [date] did you change the password for your [site name] account?
[number entry] days

  5. (44)

[If “Yes” for Q40] What did you use for the new password for your [site name]
account? $\circ$ A password that I already use for other accounts $\circ$
Something related to the old password but a few characters different, created
by myself $\circ$ Something completely unrelated to the old password, created
by myself $\circ$ A unique or random password, such as one generated by a
password manager $\circ$ Other: [free text]

  6. (45)

[If “Yes” for Q40] What techniques did you use to remember the new password
for your [site name] account? Please select all that apply. $\circ$ I
remembered my new password without writing it down or storing it digitally
$\circ$ I reset my password every time I log in rather than remembering my new
password $\circ$ I wrote my new password down on paper or other physical media
$\circ$ I stored my new password in a digital file or files $\circ$ I saved my
new password in the browser (e.g., passwords saved in Chrome) $\circ$ I used a
system-provided password manager (e.g., Apple’s Keychain) $\circ$ I used a
third-party password manager (e.g., 1Password or LastPass) $\circ$ Other:
[free text]

#### Screenshot upload

[Only display this page if “yes” for Q40.]

Optional: Please upload a screenshot of the password reset confirmation email
you received from [site name] after changing the password. Make sure the image
you are uploading is in PNG format. We would greatly appreciate it if you do
this, as it will help us validate your responses.

If you upload a valid screenshot upon our verification, you will receive a
$1.00 bonus payment in addition to the $1.20 base payment.

Steps to take:

  * •

Sign in to your email account; make sure this account has the email address
you checked for breaches in our earlier survey.

  * •

Do a keyword search of “[site name]” in your inbox and/or spam folder.

  * •

On a Windows PC, open the “Snipping Tool” program; on a Mac computer, press
Shift + Command + 4 on your keyboard to take a screenshot.

  * •

Select the area you want to take a screenshot of. Make sure your screenshot
includes the email’s subject line, sender, and date (see the example below).

  * •

IMPORTANT: Do NOT upload a screenshot that includes your personal information,
such as your actual email address, username, and new password.

  1. (46)

Which of the following options applies to you? $\circ$ I have my screenshot
and I am ready to upload it on the next page. $\circ$ I cannot find the
password reset confirmation email (please explain why): [free text] $\circ$ I
choose not to upload the screenshot (please explain why): [free text]

#### Final remarks

Thank you for your participation! As we noted in our previous surveys, the
information about the data breach we showed to you is real. Your email address
and potentially other personal information has appeared in this breach and
could be used by criminals to steal your identity or access your online
accounts.

Below is the full list of breaches associated with the email address you
provided. Please note that you can always obtain the same results by checking
your email address on haveibeenpwned.com, which, in addition, provides records
with sensitive breaches upon the verification of your email account. Please
keep in mind that this list only reflects breaches that are registered in the
haveibeenpwned.com database, your information may have been exposed in other
breaches.

[Show all breaches.]

  * •

Resources about recovering from a data breach:

    * –

Federal Trade Commission: Identity theft recovery steps

    * –

Federal Trade Commission: Credit Freeze FAQs

    * –

Firefox Monitor: What to do after a data breach

    * –

Norton: What to do after 5 types of data breaches

  * •

Resources about protecting yourself against future breaches:

    * –

Firefox Monitor: How to create strong passwords

    * –

Firefox Monitor: Steps to protect your online identity

We greatly appreciate the insights you contributed, which would help us
develop better technologies and interfaces that notify people of data
breaches.

Would you like to be contacted by us to participate in our future research?
$\circ$ Yes, I am interested. $\circ$ No, I am not interested.

Please click the “continue” button to proceed to the next page, where you will
be automatically redirected to Prolific.

##  Appendix B Cognitive Walkthrough Protocol

#### Introduction

Today we will be testing a series of three surveys for an experiment. To
ensure you have a fresh experience, I will not reveal the experiment’s
purpose, but I am happy to talk about it toward the end.

The first survey is a screening survey. You will be asked to provide an email
address for querying a database and see if this email address has appeared in
any data breaches.

The second survey is the main survey. You will see more information about a
breach associated with the email address you provided, and answer some
questions about it.

The third survey is a follow-up survey. For real-world participants, they will
receive a link to this survey two weeks after the second survey. Since we are
doing pilot testing today, I will ask you to review the follow-up survey as
well.

The link to all surveys is [URL]. If possible, could you please share your
screen with me as you complete the surveys? We’ll be using a think-aloud
protocol, which means you will read out the survey questions on your screen
line by line, tell me your answer and why you select it. Please also feel free
to comment on your thoughts and reactions to the survey questions, especially
if there’s anything that’s unclear or doesn’t make sense to you.

For most of the time, I will be quietly sitting in the background and observe
your interactions. I may chime in if there is a critical question I want to
ask on the spot. I also have a list of questions I would like to get your
feedback on toward the end after you complete all three surveys.

I will be taking notes as I observe your interactions. However, to make sure I
capture everything, would you mind me recording our meeting today as well?

#### Questions to ask

  * •

Does the text under “What are the risks” describe the threats clearly? Does
the text under “How to change your password” provide useful information? Do
you feel motivated to change an exposed password after reading the text?

  * •

Right now there’s a 2-second delay after “What to do” and a 10-second delay
after the threat/coping module. The delay seeks to nudge participants to pay
close attention to the text while waiting. Is the delay too long, too short,
or just the right amount for you?

  * •

For the follow-up survey, how’s your experience of completing the screenshot
upload question? Are the instructions clear? Is this question in line with
ethical data collection? Are they written in a way that minimizes accidental
information leaks from taking screenshots of emails?

  * •

Any unclear or confusing wording for any survey questions?

##  Appendix C Breaches in Our Sample

Figure 5. Company name and frequency of the breaches featured in our study
(bubble size proportionate to each breach’s frequency). Figure 6. How often
each data type got leaked among the 127 breaches in our sample, excluding
email addresses and passwords (appearing in all breaches). Eliminated 26 other
types occurring twice or fewer.

##  Appendix D Manipulation Check Results

Variable |  Condition |  Mean |  Median |  SD
---|---|---|---|---
Threat severity |  Control |  4.28 |  5.00 |  0.90
Threat only |  4.37 |  5.00 |  0.79
Coping only |  4.31 |  4.50 |  0.88
Combined |  4.32 |  4.00 |  0.83
Threat vulnerability |  Control |  2.73 |  3.00 |  0.06
Threat only |  2.99 |  3.00 |  0.06
Coping only |  2.89 |  3.00 |  0.06
Combined |  3.01 |  3.00 |  0.06
Self-efficacy |  Control |  3.99 |  4.00 |  1.14
Threat only |  3.96 |  4.00 |  1.15
Coping only |  4.04 |  4.00 |  1.13
Combined |  4.00 |  4.00 |  1.07
Response efficacy |  Control |  3.20 |  3.00 |  1.13
Threat only |  3.44 |  4.00 |  1.15
Coping only |  3.28 |  4.00 |  1.17
Combined |  3.55 |  4.00 |  1.13
Response costs |  Control |  1.51 |  1.00 |  0.74
Threat only |  1.52 |  1.00 |  0.79
Coping only |  1.51 |  1.00 |  0.79
Combined |  1.60 |  1.50 |  0.80
Table 8. Mean, median, and standard deviation of participants’ rating of the
PMT constructs, divided by conditions. We adapted scales from prior work [9,
96] in measuring these variables: threat severity (Q28), threat vulnerability
(Q29), response costs (Q32) were measured using 5-point Likert scales, taking
the median. Response efficacy (Q30) and self-efficacy (Q31) were measured
using a single 5-point Likert-type item.

##  Appendix E Qualitative Codebook

We provide our codebook for each coded question as well as the respective
count for each code.

###  E.1. Password Change Intention (Main Survey, Q26)

• Yes (868): to be safe (223), bad things (212), take other actions (181),
inactive use (103), triggered by breach (98), action good idea (65), reuse
passwords (47), depend on account access (40), just changed Password (40),
forget password (24), yes sensitive info (23), other existing measures (19),
action easy (18), instructed by survey (18), unspecific (18), action important
(17), tried and failed (17), no sensitive info (16), unsure if already changed
(16), no account (15), unaware account existence (15), prior negative
experience (14), unsure account existence (14), distrust company (13),
resigned (11), use unique passwords (9), don’t know site (8), important
account (8), unsure about info in account (8), forget account existence (7),
unimportant password (7), already changed password (6), account future use
(6), old breach (5), limited impact (4), account created via social login (3),
unimportant email (1) • No (518)inactive use (189), no account (152),
sensitive info no (80), forget password (45), take other actions (45),
unimportant password (43), unimportant account (42), limited impact (29),
tried and failed (28), resigned (23), use unique passwords (23), already
changed password (21), don’t know site (19), too much effort (18), unsure
account existence (18), old breach (16), other existing measures (13), don’t
know how (8), reuse passwords (8), account created via social login (8),
unaware account existence (8), unspecific (8), distrust company (7), distrust
intervention (5), forget account existence (5), unimportant email (5), prior
negative experience (3)

###  E.2. Actions Taken (Follow-up Survey, Q38)

• Action (632): change this password (214), change other passwords (171),
delete this account (89), try accessing account but fail (89), check breach
records (59), check reused passwords (48), check/delete info in account (35),
check out the breached site (32), review other accounts (27), check info
leaked in this breach (20), enable two-factor authentication (19), other
miscellaneous action (11), research on cybersecurity (11), unsubscribed (10),
inform others (9), start to use password managers (9), check credit reports
(8), use credit monitoring services (8), check financial statements (7), use
antivirus (6), use stronger passwords (5), be careful with emails (4), create
a new email (4), delete other accounts (4), stay vigilant (4) • Nothing (543)

###  E.3. Password Change Behavior (Follow-up Survey, Q41)

• Yes (855): to be safe (96), bad things (72), trigger by breach (42), take
other actions (41), inactive use (20), to access account (18), instructed by
survey (16), reuse passwords (15), action easy (12), action good idea (11),
change passwords regularly (10), no sensitive info (10), yes sensitive info
(9), distrust company (8), already changed password (7), refer to intervention
text (7), use password managers (7), unspecific (6), use unique passwords (5),
resigned (3), action important (2), account future use (2), prior negative
experience (2), don’t know site (1), limited impact (1) • No (320)inactive use
(282), no account (169), no sensitive info (86), tried and failed (86), forget
to do (78), take other actions (75), unimportant account (67), forget password
(59), unimportant password (39), busy (38), don’t know site (24), limited
impact (24), too much effort (24), use unique passwords (20), already changed
password (19), action unnecessary (17), unspecific (15), distrust company
(14), resigned (12), not a priority (9), old breach (9), account created via
social login (8), unsure account existence (3), use password managers (3),
change passwords regularly (2)