美国数据泄露报告模式与频率的演变：跨州分析
On the evolution of data breach reporting patterns and frequency in the United States: a cross-state analysis
AI总结：
本文通过分析美国八个州的数据泄露强制通知数据，控制数据收集标准与报告模式差异，估计IBNR并揭示各州网络风险频率趋势的共性与差异，发现2020年后泄露频率上升且报告延迟延长，为网络保险提供参考。
摘要：
理解数据泄露事件的出现对于网络保险至关重要。然而，当前文献中对数据泄露频率趋势的分析得出了相互矛盾的结论。我们认为，这些差异可能（至少部分）源于数据收集标准以及报告模式在时间和空间上的不一致。我们着手对这两方面进行严格控制。在本文中，我们对八个州（即加利福尼亚州、特拉华州、印第安纳州、缅因州、蒙大拿州、北达科他州、俄勒冈州和华盛顿州）的州总检察长关于数据泄露的出版物进行了联合分析，这些州均受既定数据收集标准的约束——即州数据泄露（强制）通知法。由于我们明确识别了这些通知法，我们能够以一致且可比的方式对泄露频率随时间的变化进行建模。因此，我们能够分离并捕捉报告模式的复杂性，充分估计已发生但尚未报告（IBNR）的泄露事件，并对数据泄露的历史频率趋势做出高度可靠的评估。我们的分析还对八个美国州的数据泄露频率进行了全面比较，扩展了关于各州特定网络风险差异的知识，这在当前文献中尚未得到广泛讨论。此外，我们揭示了文献中此前未讨论过的新特征，例如大型和小型数据泄露之间网络风险频率趋势的差异。总体而言，我们发现报告延迟正在延长。我们还揭示了各州、各严重程度级别以及各时间段之间报告模式的共性和异质性。在充分估计IBNR之后，我们发现频率在2020年之前相对稳定，在2020年之后有所上升。这一结果在各州之间是一致的。我们还讨论了研究结果对网络保险的启示。
英文摘要：
Understanding the emergence of data breaches is crucial for cyber insurance. However, analyses of data breach frequency trends in the current literature lead to contradictory conclusions. We put forward that those discrepancies may be (at least partially) due to inconsistent data collection standards, as well as reporting patterns, over time and space. We set out to carefully control both. In this paper, we conduct a joint analysis of state Attorneys General's publications on data breaches across eight states (namely, California, Delaware, Indiana, Maine, Montana, North Dakota, Oregon, and Washington), all of which are subject to established data collection standards-namely, state data breach (mandatory) notification laws. Thanks to our explicit recognition of these notification laws, we are capable of modelling frequency of breaches in a consistent and comparable way over time. Hence, we are able to isolate and capture the complexities of reporting patterns, adequately estimate IBNRs, and yield a highly reliable assessment of historical frequency trends in data breaches. Our analysis also provides a comprehensive comparison of data breach frequency across the eight U.S. states, extending knowledge on state-specific differences in cyber risk, which has not been extensively discussed in the current literature. Furthermore, we uncover novel features not previously discussed in the literature, such as differences in cyber risk frequency trends between large and small data breaches. Overall, we find that the reporting delays are lengthening. We also elicit commonalities and heterogeneities in reporting patterns across states, severity levels, and time periods. After adequately estimating IBNRs, we find that frequency is relatively stable before 2020 and increasing after 2020. This is consistent across states. Implications of our findings for cyber insurance are discussed.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
