PaperlayerView exact revision on arXiv

Source-linked AI summary

The Extreme Risk of Personal Data Breaches & The Erosion of Privacy

Spencer Wheatley, Thomas Maillart, Didier Sornette

arXiv:1505.07684v2stat.AP

TL;DR

Personal data breaches expose people to identity fraud and impose costs on consumers and organisations. This study models breach frequency, severity, and accumulation using breach records. It finds extremely heavy-tailed breach sizes, organisation-size scaling, and projected growth in cumulative breached information.

  • Problem

    Personal data breaches can enable identity fraud and cause financial harm to consumers and organisations.

    Source: Introduction · p. 1

  • Method

    The study models large-breach frequency and severity and projects cumulative breached information using joined breach records.

    Source: Introduction · p. 2

  • Results

    The estimated tail parameter fell from 0.57 in 2007 to 0.37 in 2015; breach frequency and severity scaled with organisation size, while cumulative breached information was projected to double.

    Source: Discussion · pp. 11–12

  • Takeaways & Limitations

    The study frames breach risk through frequency, severity, and cumulative totals, with large breaches providing the focus for risk modeling.

    Source: Introduction · p. 2

    The EVT-based upper limit may miss an unobserved extreme regime beyond the usual breach-size distribution.

    Source: Discussion · p. 11

Abstract

from arXiv · show

Personal data breaches from organisations, enabling mass identity fraud, constitute an \emph{extreme risk}. This risk worsens daily as an ever-growing amount of personal data are stored by organisations and on-line, and the attack surface surrounding this data becomes larger and harder to secure. Further, breached information is distributed and accumulates in the hands of cyber criminals, thus driving a cumulative erosion of privacy. Statistical modeling of breach data from 2000 through 2015 provides insights into this risk: A current maximum breach size of about 200 million is detected, and is expected to grow by fifty percent over the next five years. The breach sizes are found to be well modeled by an \emph{extremely heavy tailed} truncated Pareto distribution, with tail exponent parameter decreasing linearly from 0.57 in 2007 to 0.37 in 2015. With this current model, given a breach contains above fifty thousand items, there is a ten percent probability of exceeding ten million. A size effect is unearthed where both the frequency and severity of breaches scale with organisation size like $s^{0.6}$. Projections indicate that the total amount of breached information is expected to double from two to four billion items within the next five years, eclipsing the population of users of the Internet. This massive and uncontrolled dissemination of personal identities raises fundamental concerns about privacy.

Introduction

Personal data breaches are a serious cyber risk because stolen information can fuel identity fraud and harm consumers and organisations. This study updates breach-risk analysis and examines how breach risk relates to organisation size.

Introduction

  • Data breaches can impose consumer and organisational costs, including an estimated average loss of 213 USD per stolen data item and negative stock-price impacts.Large companies’ data breaches, including intellectual-property breaches, were estimated to cost more than 1 trillion USD in 2008.Source: Introduction · p. 1
  • The analysis extends earlier work by confirming heavy-tailed breach sizes and finding that the distribution is even heavier-tailed than previously expected, with a finite maximum.The study also examines breach frequency and the connection between organisation size and breach risk.Source: Introduction · p. 2
  • The study combines two large breach databases into 6,422 organisational events worldwide and models large-breach frequency, severity, and cumulative totals.The data cover January 2000 through April 16, 2015; the modeling focuses on breaches exceeding 50,000 ids.Source: Introduction · p. 2
  • Organisation size, measured by market capitalisation, is used as a proxy for attack surface and information assets to assess how breach frequency and magnitude scale.The paper reports that both scale with organisation size, quantifying an effective risk surface.Source: Introduction · pp. 2–3

Data, Results & Methods

The analysis models breach frequency and severity separately, focusing on large breaches in the more consistent recent data. It omits events with unknown sizes, which may make the estimated risk optimistic.

Data, Results & Methods

  • The analysis defines event time as the reporting date and breach size as the number of personal information items breached.Large-breach sizes are indexed as x_i for n = 619 events, bounded above the 50,000-item threshold by an unknown maximum ν.Source: Data, Results & Methods · p. 3
  • Large breaches exceed 50,000 ids and account for more than 99% of breached ids despite representing less than 10% of events.The study focuses on these events because their records are more complete and reliable than those for smaller breaches.Source: Data, Results & Methods · p. 3
  • The modeled events run from January 1, 2007, through April 15, 2015, with t measured in years from January 1, 2007.Earlier records were excluded because there were relatively few events and the statistics were less consistent.Source: Data, Results & Methods · p. 3
  • Almost 40% of events have unknown sizes, so omitting them yields an optimistic risk estimate and could bias results if missing events are large.The authors lacked covariates to predict unknown sizes or perform meaningful imputation.Source: Data, Results & Methods · p. 3

Data Breach Frequency

The study finds large-breach frequency broadly stable over time, with a small, practically insignificant increase overall despite significant growth outside the United States.

Data Breach Frequency

  • 0.18 events per year was the estimated overall growth in large-breach frequency, a practically insignificant increase with p = 0.13.The rate was stable within the US and grew significantly outside the US; the table reports the associated event counts and GLM statistics.Source: Data Breach Frequency · p. 3, Table 1 · p. 4
  • The frequency analysis uses linear regression of monthly event counts over time with a Poisson GLM and identity link.The authors describe the overall trend as practically insignificant despite the significant increase outside the US.Source: Data Breach Frequency · p. 3
  • Table 1 reports event counts, breached-id totals, monthly and annual rates, and GLM summaries for US, non-US, and all firms.It separates all-size events from breaches exceeding 50,000 ids over the January 2007 to April 2015 window.Source: Table 1 · p. 4

Data Breach Severity

The analysis finds that the upper bound on large breach sizes is growing and that their distribution is becoming heavier-tailed. A doubly truncated Pareto model captures this evolution and estimates substantial risk of very large breaches.

Detecting The Maximum Breach Size

  • EVT estimates use peaks over threshold on log breach sizes, selecting the lowest threshold at which parameter estimates stabilize.The chosen threshold is u = 15.5, with 50 observations above it.Source: Detecting The Maximum Breach Size · pp. 4–5
  • EVT estimates indicate a highly significant upper truncation already reached by the data, with the maximum growing sublinearly over time.The sublinear-growth model has superior log-likelihood to the linear-growth model for thresholds u > 15.5.Source: Detecting The Maximum Breach Size · p. 5

The Distribution of Large Breach Sizes

  • The doubly truncated Pareto model allows both the breach-size tail parameter and the maximum size to change over time.The analysis uses the natural logarithm of breach sizes, modeled with a doubly truncated exponential distribution.Source: The Distribution of Large Breach Sizes · pp. 5–6
  • Model checks support D2: transformed data fit a stationary model (Kolmogorov-Smirnov p-value 0.78), and independent quantile regressions increase significantly.The median and 0.9 quantile regression slopes are 0.083 (0.038), p = 0.03, and 0.145 (0.07), p = 0.04, respectively.Source: The Distribution of Large Breach Sizes · pp. 6–7
  • D2 best fits the data (pLRT = 0.007 versus D1); in 2015, its estimated maximum is 2.24 × 10^8, with a 10% chance that breaches above 50,000 exceed 10 million ids.The estimated expected large breach size in 2015 is twice that under D0.Source: The Distribution of Large Breach Sizes · p. 6, Table 3 · p. 7

Cumulative Risk & Future Projections

Cumulative breached information combines breach frequency and severity, making it a measure of long-term privacy risk. Under nonstationary models, the cumulative total is expected to more than double over the next five years.

Cumulative Risk & Future Projections

  • The cumulative sum combines breach frequency and severity; expected sums and variability are compared with observed totals using the DTP’s first two moments.The observed sum curves upward, while the models’ expected sums are nE[X].Source: Cumulative Risk & Future Projections · p. 7
  • After the CLT crossover at about 50 observations, the upward bend is attributed to nonstationarity rather than heavy-tail superlinear growth; D2 captures it best.D1 partially captures the trend, while linearly growing D0 does not.Source: Cumulative Risk & Future Projections · p. 7
  • Annual projections treat the event count as random and independent of breach sizes, making each annual total a compound process with a specified mean and variance.The mean is E[N_t]E[X_t], and the variance is E[N_t]Var(X_t) + E[X_t]^2 Var(N_t).Source: Cumulative Risk & Future Projections · pp. 7–8
  • More than doubling: cumulative breaches, currently about 1.816×10^9, are projected to exceed twice that level over five years under nonstationary D1 and D2.The estimates cover 2015–2019; Table 4 reports projections under a constant rate of 75.6 large events per year.Source: Cumulative Risk & Future Projections · p. 8, Table 4 · p. 8

Data Breach Risk & Organisation Size

Breach frequency and severity both rise with organisation size in the studied firms, with frequency scaling approximately as s^0.6 and the largest breach sizes scaling approximately as s^0.66. The analysis also describes how these relationships could be extrapolated, subject to a comparability assumption.

Data Breach Risk & Organisation Size

  • Among 4,950 publicly traded firms, the estimated size distribution for victimised firms is shifted about one decade above the population distribution.The analysis covers 735 events across 400 firms from 2006 to 2015 and uses lognormal fits for the firm-size distributions.Source: Data Breach Risk & Organisation Size · p. 8

Breach Frequency & Firm Size

  • 0.6: victimisation probability grows approximately as s^0.6 for firms sized between 10^8 and 10^11 in market capitalisation.Both histogram and parametric estimates indicate approximately linear growth over that size range.Source: Breach Frequency & Firm Size · p. 9

Breach Size & Firm Size

  • 0.66: breach size at the 0.9 quantile scales with firm size at this slope, with the size effect saturating above firm sizes of 10^10.Quantile regressions for quantiles 0.5 and above significantly increase with firm size until saturation.Source: Breach Size & Firm Size · p. 9
  • The frequency and largest-breach size patterns are linked to firm sub-units, whose largest unit is reported to scale as s^2/3.The authors describe this connection as a coincidence and point to the largest sub-unit as a possible link to breach risk.Source: Breach Size & Firm Size · p. 9, Breach Frequency & Firm Size · p. 9

Data Breach Risk & Organisation Size

  • Extrapolating breach statistics to unobserved organisations assumes they resemble publicly traded firms of similar size in attractiveness and permeability to cyber criminals.Given organisation sizes, the risk surface can be used to infer the quantity and distribution of breaches suffered.Source: Breach Size & Firm Size · p. 10

Sector & Data Breach Risk

The sector analysis uses industry as a proxy for differences in customer interaction and guarded personal-data volume. Its observations tend to support hypotheses linking interaction frequency to breach frequency and guarded-data volume to breach severity.

Sector & Data Breach Risk

  • Because sector and firm size may be confounded and the data are limited, the analysis considers sectors separately rather than jointly with firm size.The twelve sectors serve as a possible proxy for subpopulations with different consumer interaction and guarded-data volumes.Source: Sector & Data Breach Risk · p. 10
  • Consumer Service and Finance have small, frequent breaches, whereas Basic Industries have large, infrequent breaches, consistent with differences in customer interaction and operational centralisation.Consumer Durables have lower breach frequency than Non-Durables, which involve more frequent customer contact.Source: Sector & Data Breach Risk · p. 10
  • The sectors with the highest median losses include companies identified as guarding large amounts of personal data, supporting the proposed link between guarded-data volume and severity.The examples are Sony, eBay, and UPS.Source: Sector & Data Breach Risk · p. 10

Discussion

The discussion frames data breaches as an extreme risk: modeled breach tails and maxima intensify, while cumulative exposure compounds privacy erosion and motivates policies focused on extreme events.

Discussion

  • The estimated maximum breach is about 200 million items and is expected to grow 50% over five years, though EVT may miss an unobserved extreme regime.The estimated maximum grows like t^0.84; the authors caution that attacks on internet giants or governments cannot be excluded.Source: Discussion · p. 11
  • Breach sizes follow a Pareto model whose shape parameter fell from 0.57 in 2007 to 0.37 in 2015; breaches above 50,000 items have a 10% chance of exceeding 10 million.The model uses the EVT estimate for the maximum breach size.Source: Discussion · p. 11
  • Breach frequency scales with organisation size as s^0.6, while the 0.9-quantile breach size scales as s^0.66 up to $10 billion market capitalisation, then plateaus.The authors suggest that the largest organisational sub-unit may help define risk, noting its size scales similarly with firm size.Source: Discussion · p. 11
  • The cumulative total is about 2 billion breached personal-data items and is projected to double within five years, surpassing the number of Internet users.The estimate is based on large breaches; cumulative totals may overstate erosion as some data lose value, while unknown breach sizes make reported statistics underestimates.Source: Discussion · pp. 11–12
  • Breach estimates cover only incidents discovered, reported, and submitted to online databases, so the authors characterize them as conservative.They warn that uploaded personal data may be disseminated through underground markets and later publicly.Source: Discussion · p. 12
  • Because total risk is dominated by stochastic extremes, the authors argue for considering the full distribution rather than typical breaches or mean-based insurance.They suggest measures aimed at stopping major events and cascades, potentially by decentralizing large organisations’ IT systems.Source: Discussion · p. 12
Loading 1505.07684v2…