Legislators in many countries enact security breach notification regulation to address a lack of information security. The laws designate authorities to collect breach reports and advise firms. We devise a principal–agent model to analyze the economic effect of mandatory security breach reporting to authorities. The model assumes that firms (agents) have few incentives to unilaterally report br...

While the discussion about a federal law on data breach notification is ongoing and a rash of large, costly data breaches has galvanized public interest in the issue, this paper investigates on the phenomenon of data breach notification letters. In case of any data breach a company faces a number of dilemmas on how to inform the customers. The choices that a company makes on the missive content...

The existing literature has been silent on individuals’ decision making and reactions in response to data breaches. In 2015, the Office of Personnel Management (OPM) discovered that data of several million Federal employee was stolen in cyber-attacks. Within the context of the OPM breaches, we propose a conceptual model that helps reveal the core decision making process of incident victims in r...

To estimate the cost of a data breach to the inflicted firm, this study examines the relationship between a breach incident and changes in the inflicted firm’s profitability, perceived risk, and the inflicted firms’ information environment transparency. Profitability is measured as reported earnings and analysts’ earnings forecasts. Perceived risk is measured as reported stock return volatility...

Statistical evaluation of historical dike failure mechanism The failure mechanism of flood protection dikes includes physical (geotechnical, seepage) processes leading to a dike breach. An awareness of the failure mechanism is required directly in dike stability calculations and indirectly for risk calculations. Statistics of historical data indicate among others the distribution and frequency ...

Adversary: Somebody who, whether intentionally or not, reveals sensitive, private information Adversarial model: Formal description of the unique characteristics of a particular adversary Attribute disclosure: A privacy breach wherein some descriptive attribute of somebody is revealed Identity disclosure: A privacy breach in which a presumably anonymous person is in fact identifiable k-P-anonym...