Paper: arXiv 2310.04786

Authors: Benjamin Avanzi, Xingyun Tan, Greg Taylor, Bernard Wong

Abstract

Understanding the emergence of data breaches is crucial for cyber insurance. However, analyses of data breach frequency trends in the current literature lead to contradictory conclusions. We put forward that those discrepancies may be (at least partially) due to inconsistent data collection standards, as well as reporting patterns, over time and space. We set out to carefully control both. In this paper, we conduct a joint analysis of state Attorneys General’s publications on data breaches across eight states (namely, California, Delaware, Indiana, Maine, Montana, North Dakota, Oregon, and Washington), all of which are subject to established data collection standards-namely, state data breach (mandatory) notification laws. Thanks to our explicit recognition of these notification laws, we are capable of modelling frequency of breaches in a consistent and comparable way over time. Hence, we are able to isolate and capture the complexities of reporting patterns, adequately estimate IBNRs, and yield a highly reliable assessment of historical frequency trends in data breaches. Our analysis also provides a comprehensive comparison of data breach frequency across the eight U.S. states, extending knowledge on state-specific differences in cyber risk, which has not been extensively discussed in the current literature. Furthermore, we uncover novel features not previously discussed in the literature, such as differences in cyber risk frequency trends between large and small data breaches. Overall, we find that the reporting delays are lengthening. We also elicit commonalities and heterogeneities in reporting patterns across states, severity levels, and time periods. After adequately estimating IBNRs, we find that frequency is relatively stable before 2020 and increasing after 2020. This is consistent across states. Implications of our findings for cyber insurance are discussed.

Complexity vs Empirical Score

  • Math Complexity: 5.5/10
  • Empirical Rigor: 8.0/10
  • Quadrant: Holy Grail — high math complexity, high empirical rigor

Why this score: This paper presents a rigorous empirical investigation into cyber insurance data breach frequencies by explicitly modeling reporting delays and Incurred But Not Reported (IBNR) losses across eight U.S. states. It resolves conflicting trends in the literature through solid actuarial statistical modeling and careful handling of state-level regulatory notification laws.

Research Flowchart

  flowchart TD
    A[Research Goal: Resolve contradictory trends in US data breach frequency] --> B[Data Collection: State AG breach publications across 8 US states]
    B --> C[Methodology: Standardize data via state notification laws]
    C --> D[Actuarial Modeling: Estimate IBNR & analyze reporting delays over space/time]
    D --> E[Key Outcome 1: Reporting delays are lengthening over time]
    D --> F[Key Outcome 2: Data breach frequency stable pre-2020, increasing post-2020]
    D --> G[Key Outcome 3: Discovered risk trends differ by breach size & state]