On the evolution of data breach reporting patterns and frequency in the United States: a cross-state analysis

Benjamin Avanzi,Xingyun Tan,Greg Taylor,Bernard Wong
2024-06-30
Abstract:Understanding the emergence of data breaches is crucial for cyber insurance. However, analyses of data breach frequency trends in the current literature lead to contradictory conclusions. We put forward that those discrepancies may be (at least partially) due to inconsistent data collection standards, as well as reporting patterns, over time and space. We set out to carefully control both. In this paper, we conduct a joint analysis of state Attorneys General's publications on data breaches across eight states (namely, California, Delaware, Indiana, Maine, Montana, North Dakota, Oregon, and Washington), all of which are subject to established data collection standards-namely, state data breach (mandatory) notification laws. Thanks to our explicit recognition of these notification laws, we are capable of modelling frequency of breaches in a consistent and comparable way over time. Hence, we are able to isolate and capture the complexities of reporting patterns, adequately estimate IBNRs, and yield a highly reliable assessment of historical frequency trends in data breaches. Our analysis also provides a comprehensive comparison of data breach frequency across the eight U.S. states, extending knowledge on state-specific differences in cyber risk, which has not been extensively discussed in the current literature. Furthermore, we uncover novel features not previously discussed in the literature, such as differences in cyber risk frequency trends between large and small data breaches. Overall, we find that the reporting delays are lengthening. We also elicit commonalities and heterogeneities in reporting patterns across states, severity levels, and time periods. After adequately estimating IBNRs, we find that frequency is relatively stable before 2020 and increasing after 2020. This is consistent across states. Implications of our findings for cyber insurance are discussed.
Risk Management,Cryptography and Security
What problem does this paper attempt to address?
The paper attempts to address the issue of the evolution of data breach reporting patterns and frequency over time and space. Specifically, the paper aims to address the following key issues: 1. **Contradictory conclusions in existing literature**: Current studies on data breach frequency trends have yielded contradictory conclusions. The paper suggests that these contradictions may partly stem from inconsistencies in data collection standards and reporting patterns over time and space. 2. **Inconsistencies in data collection standards**: Existing datasets (such as PRC, Advisen, and SAS) are difficult to analyze reliably for frequency trends due to diverse data sources and inconsistent standards. 3. **Impact of reporting delays**: There are delays in data breach reporting, which affect the accurate assessment of actual data breach frequency. The paper aims to more accurately estimate unreported data breaches (IBNRs) by controlling for these delays. 4. **Analysis of interstate differences**: There are significant differences in data breach reporting patterns and frequency across different states. The paper explores these differences and their underlying reasons by analyzing data from eight specific states (California, Delaware, Indiana, Maine, Montana, North Dakota, Oregon, and Washington). 5. **Impact of market dynamics and regulatory factors**: How each state's unique regulations, market dynamics, demographic characteristics, and risk factors influence the pricing and underwriting strategies of cyber insurance products. By addressing these issues, the paper aims to provide more reliable and detailed analytical tools for risk management and pricing in cyber insurance.