This study proposes a measure of the data breach risk’s probable maximum loss, which stands for the worst data breach loss likely to occur, using an alternative approach to estimating the potential loss degree of an extreme event with one of the largest private databases for data breach risk. We determine stationarity, the presence of autoregressive feature, and the Fréchet type of generalized extreme value distribution (GEV) as the best fit for data breach loss maxima series and check robustness of the model with a public dataset. We find that the predicted data breach loss likely to occur in the next five years is substantially larger than the loss estimated by the recent literature with a Pareto model. In particular, the comparison between the estimates from the recent data (after 2014) and those for the old data (before 2014) shows a significant increase with a break in the loss severity. We design a three-layer reinsurance scheme based on the probable maximum loss estimates with public–private partnership. Our findings are important for risk managers, actuaries, and policymakers concerned about the enormous cost of the next extreme cyber event.

本研究提出了一种衡量数据泄露风险的可能最大损失的方法，它代表可能发生的最严重的数据泄露损失，使用另一种方法来估计具有最大的数据泄露私有数据库之一的极端事件的潜在损失程度风险。我们确定平稳性、自回归特征的存在和广义极值分布 (GEV) 的 Fréchet 类型作为数据泄露损失最大值系列的最佳拟合，并使用公共数据集检查模型的稳健性。我们发现，未来五年内可能发生的预测数据泄露损失远大于最近文献使用帕累托模型估计的损失。特别是，比较近期数据（2014 年之后）与旧数据（2014 年之前）的估计值之间的比较显示，随着损失严重程度的中断，显着增加。我们根据公私合作伙伴关系的可能最大损失估计设计了一个三层再保险计划。我们的发现对于关注下一次极端网络事件的巨大成本的风险管理人员、精算师和政策制定者很重要。