On the Evolution of Data Breach Reporting Patterns and Frequency in the United States: A Cross-State Analysis

Abstract

Understanding the emergence of data breaches is crucial for cyber insurance and risk management. However, analyses of data breach frequency trends in the current literature lead to contradictory conclusions. We put forward that those discrepancies may be (at least partially) due to inconsistent data collection standards, as well as reporting patterns, over time and space. We set out to carefully control both. In this article, we conduct a joint analysis of state attorneys general’s publications on data breaches across eight states (namely, California, Delaware, Indiana, Maine, Montana, North Dakota, Oregon, and Washington), all of which are subject to established data collection standards; namely, state data breach (mandatory) notification laws. Thanks to our explicit recognition of these notification laws, we are capable of modeling frequency of breaches in a consistent and comparable way over time. Hence, we are able to isolate and capture the complexities of reporting patterns, adequately estimate incurred but not reported (IBNR) data breaches, and yield a highly reliable assessment of historical frequency trends in data breaches. Our analysis also provides a comprehensive comparison of data breach frequency across the eight U.S. states, extending knowledge on state-specific differences in cyber risk, which has not been extensively discussed in the current literature. We thus illustrate how each state’s unique regulations, market dynamics, demographic profiles, and risk factors can significantly impact insurance products and pricing. Furthermore, we uncover novel features not previously discussed in the literature, such as differences in cyber risk frequency trends between large and small data breaches (i.e., breaches affecting more or fewer state residents), due to differences in state definitions of reportable data breaches. Overall, we find that the reporting delays are lengthening. We also elicit commonalities and heterogeneities in reporting patterns across states, severity levels, and time periods. After adequately estimating IBNRs, we find that frequency is relatively stable before 2020 and increasing after 2020. This is consistent across states. Implications of our findings for cyber insurance reserving, pricing, underwriting, and experience monitoring are discussed.