  Understanding the emergence of data breaches is crucial for cyber insurance.
However, analyses of data breach frequency trends in the current literature
lead to contradictory conclusions. We put forward that those discrepancies may
be (at least partially) due to inconsistent data collection standards, as well
as reporting patterns, over time and space. We set out to carefully control
both. In this paper, we conduct a joint analysis of state Attorneys General's
publications on data breaches across eight states (namely, California,
Delaware, Indiana, Maine, Montana, North Dakota, Oregon, and Washington), all
of which are subject to established data collection standards-namely, state
data breach (mandatory) notification laws. Thanks to our explicit recognition
of these notification laws, we are capable of modelling frequency of breaches
in a consistent and comparable way over time. Hence, we are able to isolate and
capture the complexities of reporting patterns, adequately estimate IBNRs, and
yield a highly reliable assessment of historical frequency trends in data
breaches. Our analysis also provides a comprehensive comparison of data breach
frequency across the eight U.S. states, extending knowledge on state-specific
differences in cyber risk, which has not been extensively discussed in the
current literature. Furthermore, we uncover novel features not previously
discussed in the literature, such as differences in cyber risk frequency trends
between large and small data breaches. Overall, we find that the reporting
delays are lengthening. We also elicit commonalities and heterogeneities in
reporting patterns across states, severity levels, and time periods. After
adequately estimating IBNRs, we find that frequency is relatively stable before
2020 and increasing after 2020. This is consistent across states. Implications
of our findings for cyber insurance are discussed.
