Difficulties in Determining Data Breach Impacts

Internet searches for information regarding the impacts of data breaches yield a large amount of data. While significant effort is made to determine the costs associated with data breaches, important questions can be asked regarding the accuracy of such reporting. This article examines some of the drivers of difficulty in determining the impacts of data breaches, both from the perspective of the organization that is breached, and, possibly more importantly, from the viewpoint of individuals whose data is breached. This article will make the case that, from the start of the process in forensic analysis, difficulties can be detected. Separately, dis-incentives to report more than required by law is another impediment. In the United States, no uniform reporting requirement exists. Ultimate impacts on the individuals whose data is breached are often delayed, based upon incomplete self-reports, and difficult to summarize. This article will make the case that all these factors negatively impact the quality of data breach reporting.