The extreme risk of personal data breaches and the erosion of privacy

Abstract

Personal data breaches from organisations, enabling mass identity fraud, constitute an extreme risk. This risk worsens daily as an ever-growing amount of personal data are stored by organisations and on-line, and the attack surface surrounding this data becomes larger and harder to secure. Further, breached information is distributed and accumulates in the hands of cyber criminals, thus driving a cumulative erosion of privacy. Statistical modeling of breach data from 2000 through 2015 provides insights into this risk: A current maximum breach size of about 200 million is detected, and is expected to grow by fifty percent over the next five years. The breach sizes are found to be well modeled by an extremely heavy tailed truncated Pareto distribution, with tail exponent parameter decreasing linearly from 0.57 in 2007 to 0.37 in 2015. With this current model, given a breach contains above fifty thousand items, there is a ten percent probability of exceeding ten million. A size effect is unearthed where both the frequency and severity of breaches scale with organisation size like s 0.6 . Projections indicate that the total amount of breached information is expected to double from two to four billion items within the next five years, eclipsing the population of users of the Internet. This massive and uncontrolled dissemination of personal identities raises fundamental concerns about privacy.

Bringing Back the Person into Behavioural Personality Science Using Big Data

“…When using social media for participant acquisition (Kern et al, 2016) and when conducting n‐of‐1 or small sample idiographic studies, it is almost impossible to completely anonymize participants. Kern et al (2016) therefore highlight the importance of storing such data safely in order to avoid unauthorized access (Wheatley, Maillart, & Sornette, 2016), which has happened in the past (e.g. Cambridge Analytica data scandal).…”

A Comprehensive Model for Cyber Risk Based on Marked Point Processes and Its Application to Insurance

“…This result is found to be robust for different types and sizes of targeted organizations and over time, where the number of ID loss events first exhibits a non-stationary growth followed by a more stationary phase. [77] combined data from both databases to focus exclusively on large breaches (> 50.000 lost/stolen IDs) to study maximum breach sizes as well as severity distributions. The best fit is obtained by using a doubly truncated Pareto (Power law) distribution with linearly decreasing shape parameter for breach sizes, with sub-linear growth for the maximum log breach size.…”

Pricing the Cost of Cybercrime—A Financial Protection Approach

“…In the past, proposals have been examined for the exploitation of insurance as a risk management tool, taking into account the characteristics of digital hazards and how these affect the design of appropriate insurance policies and contracts [10], as well as the viability of insurance market for complete coverage [11]. The increasing trend of occurrence of cyber-attack incidents [12] in combination with the need to comply with the new legislation [13], contributes significantly to the demand for digital security and insurance solutions [14]. Ways of benefiting through the use of insurance policies for both business and society [15] as well as approaches, standards, incentives and rewarding to increase individual protection and security [16] have been investigated.…”