This article investigates the relationship between data breaches and identity theft, including the impact of Data Breach Notification Laws (DBNL) on these incidents (using empirical data and Bayesian modeling). We collected incident data on breaches and identity thefts over a 13-year timespan (2005–2017) in the United States. Our analysis shows that the correlation is driven by the size of a state. Enacting a DBNL still slightly reduces rates of identity theft; while publishing breaches notifications by Attorney Generals helps the broader security community learning about them. We conclude with an in-depth discussion on what the European Union can learn from the US experience.

中文翻译：

---

不仅仅是嫌疑人：对数据泄露、身份盗窃和数据泄露通知法之间联系的调查

本文调查了数据泄露与身份盗窃之间的关系，包括数据泄露通知法 (DBNL) 对这些事件的影响（使用经验数据和贝叶斯建模）。我们收集了美国 13 年（2005 年至 2017 年）的数据泄露和身份盗窃事件数据。我们的分析表明，相关性是由一个州的规模驱动的。制定 DBNL 仍会略微降低身份盗用率；总检察长发布违规通知有助于更广泛的安全社区了解它们。最后，我们深入讨论了欧盟可以从美国的经验中学到什么。