{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,5,18]],"date-time":"2025-05-18T04:05:41Z","timestamp":1747541141908,"version":"3.40.5"},"reference-count":42,"publisher":"Springer Science and Business Media LLC","issue":"3","license":[{"start":{"date-parts":[[2025,4,8]],"date-time":"2025-04-08T00:00:00Z","timestamp":1744070400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2025,4,8]],"date-time":"2025-04-08T00:00:00Z","timestamp":1744070400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"name":"Centro de Estat\u00edstica e Aplica\u00e7\u00f5es, Faculdade de Ci\u00eancias, Universidade de Lisboa (CEAUL), Portugal","award":["UIDB\/00006\/2020"],"award-info":[{"award-number":["UIDB\/00006\/2020"]}]},{"name":"Centro de Estudos de Economia Aplicada do Atl\u00e2ntico da Universidade dos A\u00e7ores (CEEAplA), Portugal","award":["UIDB\/00685\/2020"],"award-info":[{"award-number":["UIDB\/00685\/2020"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Health Technol."],"published-print":{"date-parts":[[2025,5]]},"abstract":"<jats:title>Abstract<\/jats:title>\n          <jats:sec>\n            <jats:title>Purpose<\/jats:title>\n            <jats:p>The healthcare sector is a primary target for cybercriminals, with health data breaches ranking among the most critical threats. Despite stringent penalties imposed by the U.S. Department of Health and Human Services Office for Civil Rights (OCR), vulnerabilities still persist due to slow detection and ineffective data protection measures. On the other hand, as organizations are often reluctant to disclose security breaches for fear of reputational and market share losses, penalties can serve as a useful proxy for quantifying losses and insurance claims.<\/jats:p>\n          <\/jats:sec>\n          <jats:sec>\n            <jats:title>Methods<\/jats:title>\n            <jats:p>This study analyzes fines and settlements (2008\u20132024) using the traditional lognormal, general extreme value (GEV) and other heavy-tailed statistical models, including the geo-max-stable loglogistic law, and also the mixture models hyperexponential and hyperloglogistic.<\/jats:p>\n          <\/jats:sec>\n          <jats:sec>\n            <jats:title>Results<\/jats:title>\n            <jats:p>Mixture models, either the hyperexponential or the hyperloglogistic, deliver the best fit for OCR penalties, and for yearly maxima, the best fit is achieved with the GEV distribution. Regarding Attorneys General fines, the hyperexponential model is optimal, with the GEV model excelling again for their yearly maxima. Hence, mixture models effectively capture the dual nature of penalty data, comprising clusters of moderate and extreme values. However, yearly maxima align better with the GEV model.<\/jats:p>\n          <\/jats:sec>\n          <jats:sec>\n            <jats:title>Conclusions<\/jats:title>\n            <jats:p>The findings suggest that while Panjer\u2019s theory for aggregate claims suffices for moderate claims, it must be supplemented with strategies to address extreme cybercrime scenarios, ensuring insurers and reinsurers can manage severe losses effectively.<\/jats:p>\n          <\/jats:sec>","DOI":"10.1007\/s12553-025-00964-w","type":"journal-article","created":{"date-parts":[[2025,4,8]],"date-time":"2025-04-08T21:28:32Z","timestamp":1744147712000},"page":"635-650","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Economic impact of healthcare cyber risks"],"prefix":"10.1007","volume":"15","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-9276-7011","authenticated-orcid":false,"given":"M. F\u00e1tima","family":"Brilhante","sequence":"first","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3364-0357","authenticated-orcid":false,"given":"Sandra","family":"Mendon\u00e7a","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3406-1077","authenticated-orcid":false,"given":"Pedro","family":"Pestana","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9966-2271","authenticated-orcid":false,"given":"M. Lu\u00edsa","family":"Rocha","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7371-363X","authenticated-orcid":false,"given":"Rui","family":"Santos","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2025,4,8]]},"reference":[{"key":"964_CR1","unstructured":"Tunggal AT. What is a vulnerability? Definition + Examples. https:\/\/www.upguard.com\/blog\/vulnerability Accessed 01-July-2024"},{"key":"964_CR2","unstructured":"Howard JD. An analysis of security incidents on the internet. PhD thesis, Carnegie Mellon University; 2012. https:\/\/insights.sei.cmu.edu\/library\/an-analysis-of-security-incidents-on-the-internet\/ Accessed 01-July-2024"},{"key":"964_CR3","doi-asserted-by":"publisher","first-page":"1053","DOI":"10.1111\/j.1539-6924.2007.00943.x","volume":"27","author":"C Lian","year":"2007","unstructured":"Lian C, Santos JR, Haimes YY. Extreme risk analysis of interdependent economic and infrastructure sectors. Risk Anal. 2007;27:1053\u201364. https:\/\/doi.org\/10.1111\/j.1539-6924.2007.00943.x.","journal-title":"Risk Anal"},{"key":"964_CR4","unstructured":"Dejung S. Economic impact of cyber accumulation scenarios. Swiss Insurance Association Cyber Working Group; 2017. https:\/\/www.imia.com\/wp-content\/uploads\/2023\/07\/Economic_impact_Cyber_loss_accumulation_scenarios_SVV.pdf"},{"issue":"3","key":"964_CR5","doi-asserted-by":"publisher","first-page":"429","DOI":"10.1080\/10920277.2022.2034507","volume":"27","author":"M Eling","year":"2023","unstructured":"Eling M, Elvedi M, Greg Falco G. The economic impact of extreme cyber risk scenarios. North Am Actuar J. 2023;27(3):429\u201343. https:\/\/doi.org\/10.1080\/10920277.2022.2034507.","journal-title":"North Am Actuar J"},{"key":"964_CR6","unstructured":"Nikolakopoulos T, Darra E, Tofan D. The cost of incidents affecting CIIs: systematic review of studies concerning the economic impact of cyber-security incidents on critical information infrastructures (CII). ENISA, Heraklion, Greece; 2016. https:\/\/data.europa.eu\/doi\/10.2824\/475621"},{"key":"964_CR7","doi-asserted-by":"publisher","first-page":"58","DOI":"10.1016\/j.cose.2014.05.006","volume":"45","author":"M Lagazio","year":"2014","unstructured":"Lagazio M, Sherif N, Cushman M. A multi-level approach to understanding the impact of cyber crime on the financial sector. Comput Secur. 2014;45:58\u201374. https:\/\/doi.org\/10.1016\/j.cose.2014.05.006.","journal-title":"Comput Secur"},{"key":"964_CR8","unstructured":"Common Vulnerabilities Scoring System. https:\/\/www.first.org\/cvss\/v4-0\/ Accessed 01-July-2024"},{"key":"964_CR9","unstructured":"Dugal D, Rich D. Announcing CVSS v4.0. In: 35th Annual FIRST Conference, Montr\u00e9al, Canada; 2023. https:\/\/www.first.org\/resources\/papers\/conf2023\/FIRSTCON23-TLP-CLEAR-SIG-Updates-CVSS-SIG-slides-Dave-Dugal.pdf"},{"issue":"1","key":"964_CR10","doi-asserted-by":"publisher","first-page":"20","DOI":"10.3390\/appliedmath4010002","volume":"4","author":"MF Brilhante","year":"2023","unstructured":"Brilhante MF, Pestana D, Pestana P, Rocha ML. Measuring the risk of vulnerabilities exploitation. Appl Math. 2023;4(1):20\u201354. https:\/\/doi.org\/10.3390\/appliedmath4010002.","journal-title":"Appl Math"},{"key":"964_CR11","doi-asserted-by":"publisher","unstructured":"Brilhante MF, Pestana P, Rocha ML, Sequeira F. Risk assessment of vulnerabilities exploitation. In: Henriques-Rodrigues L, Menezes R, Meira\u00a0Machado L, Faria S, Carvalho M, editors. New Frontiers in Statistics and Data Science; 2025. pp. 69\u201382. Springer, Berlin. https:\/\/doi.org\/10.1007\/978-3-031-68949-9_6","DOI":"10.1007\/978-3-031-68949-9_6"},{"issue":"3","key":"964_CR12","doi-asserted-by":"publisher","first-page":"1175","DOI":"10.1017\/asb.2018.23","volume":"48","author":"MA Fahrenwaldt","year":"2018","unstructured":"Fahrenwaldt MA, Weber S, Weske K. Pricing of cyber insurance contracts in a network model. ASTIN Bull. 2018;48(3):1175\u2013218. https:\/\/doi.org\/10.1017\/asb.2018.23.","journal-title":"ASTIN Bull"},{"issue":"2","key":"964_CR13","doi-asserted-by":"publisher","first-page":"220","DOI":"10.1080\/10920277.2019.1566076","volume":"23","author":"M Xu","year":"2019","unstructured":"Xu M, Hua L. Cybersecurity insurance: modeling and pricing. North Am Actuar J. 2019;23(2):220\u201349. https:\/\/doi.org\/10.1080\/10920277.2019.1566076.","journal-title":"North Am Actuar J"},{"issue":"6","key":"964_CR14","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1017\/S1357321718000284","volume":"24","author":"R Egan","year":"2019","unstructured":"Egan R, Cartagena S, Mohamed R, Gosrani V, Grewal J, Acharyya M, Dee A, Bajaj R, Jaeger V, Katz D, Meghen P, Silley M, Nasser-Probert S, Pikinska J, Rubin R, Ang K. Cyber operational risk scenarios for insurance companies. Actuar J. 2019;24(6):1\u201334. https:\/\/doi.org\/10.1017\/S1357321718000284.","journal-title":"Actuar J."},{"key":"964_CR15","doi-asserted-by":"publisher","unstructured":"\u00d6\u011f\u00fct H, Raghunathan S, Menon N. Cyber security risk management: public policy implications of correlated risk, imperfect ability to prove loss, and observability of self-protection. Risk Anal. 2011;31(3):497\u2013512. https:\/\/doi.org\/10.1111\/j.1539-6924.2010.01478.x.","DOI":"10.1111\/j.1539-6924.2010.01478.x"},{"key":"964_CR16","unstructured":"Swiss Re Institute. https:\/\/www.swissre.com\/institute\/ Accessed 05-Aug-2024"},{"key":"964_CR17","doi-asserted-by":"publisher","first-page":"191","DOI":"10.1080\/15326349108807184","volume":"7","author":"ST Rachev","year":"1991","unstructured":"Rachev ST, Resnick S. Max-geometric infinite divisibility and stability. Commun Stat Stoch Model. 1991;7:191\u2013218. https:\/\/doi.org\/10.1080\/15326349108807184.","journal-title":"Commun Stat Stoch Model"},{"key":"964_CR18","unstructured":"Griffiths C. The Latest 2024 Cyber Crime Statistics. https:\/\/aag-it.com\/the-latest-cyber-crime-statistics\/ Accessed 01-July-2024"},{"key":"964_CR19","unstructured":"Griffiths C. The Latest 2024 Ransomware Statistics. https:\/\/aag-it.com\/the-latest-ransomware-statistics\/ Accessed 01-July-2024"},{"key":"964_CR20","unstructured":"Griffiths C. The Latest Cloud Computing Statistics. https:\/\/aag-it.com\/the-latest-cloud-computing-statistics\/ Accessed 01-July-2024"},{"key":"964_CR21","unstructured":"Office for Civil Rights Breach Portal. https:\/\/ocrportal.hhs.gov\/ocr\/breach\/breach_report.jsf Accessed 01-July-2024"},{"key":"964_CR22","unstructured":"The HIPAA Journal: Healthcare Data Breach Statistics. https:\/\/www.hipaajournal.com\/healthcare-data-breach-statistics\/ Accessed 01-July-2024"},{"issue":"1","key":"964_CR23","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3439873","volume":"13","author":"NN Neto","year":"2021","unstructured":"Neto NN, Madnick S, Paula AM, Borges NM. Developing a global data breach database and the challenges encountered. J Data Inf Quality. 2021;13(1):1\u201333. https:\/\/doi.org\/10.1145\/3439873.","journal-title":"J Data Inf Quality"},{"key":"964_CR24","doi-asserted-by":"publisher","first-page":"503","DOI":"10.2139\/ssrn.3238293","volume":"86","author":"LJ Trautman","year":"2018","unstructured":"Trautman LJ, Ormerod P. Wannacry, ransomware, and the emerging threat to corporations. Tennessee Law Rev. 2018;86:503\u201356. https:\/\/doi.org\/10.2139\/ssrn.3238293.","journal-title":"Tennessee Law Rev"},{"key":"964_CR25","doi-asserted-by":"crossref","unstructured":"Clauset A, Shalizi CR, Newman MEJ. Power-law distributions in empirical data. SIAM Rev. 2009;51(4):661\u2013703. Companion implementation of the methods in https:\/\/aaronclauset.github.io\/powerlaws\/","DOI":"10.1137\/070710111"},{"key":"964_CR26","doi-asserted-by":"publisher","first-page":"665","DOI":"10.1126\/science.1216142","volume":"335","author":"MPH Stumpf","year":"2012","unstructured":"Stumpf MPH, Porter MA. Critical truths about power laws. Science. 2012;335:665\u20136. https:\/\/doi.org\/10.1126\/science.1216142.","journal-title":"Science"},{"key":"964_CR27","doi-asserted-by":"publisher","unstructured":"Feldmann A, Whitt W. Fitting mixtures of exponentials to long-tail distributions to analyze network performance models. Perform Eval. 1998;31(3\/4):245\u201379. https:\/\/doi.org\/10.1016\/S0166-5316(97)00003-5.","DOI":"10.1016\/S0166-5316(97)00003-5"},{"issue":"2","key":"964_CR28","doi-asserted-by":"publisher","first-page":"226","DOI":"10.1080\/15427951.2004.10129088","volume":"1","author":"M Mitzenmacher","year":"2004","unstructured":"Mitzenmacher M. A brief history of generative models for power law and lognormal distributions. Int Math. 2004;1(2):226\u201351. https:\/\/doi.org\/10.1080\/15427951.2004.10129088.","journal-title":"Int Math"},{"key":"964_CR29","doi-asserted-by":"publisher","first-page":"189","DOI":"10.1017\/S0305004100015681","volume":"24","author":"RA Fisher","year":"1928","unstructured":"Fisher RA, Tippett LHC. Limiting forms of the frequency distribution of the largest and smallest member of a sample. Proc Camb Phil Soc. 1928;24:189\u201390.","journal-title":"Proc Camb Phil Soc"},{"key":"964_CR30","doi-asserted-by":"crossref","unstructured":"Gomes MI, Pestana D. Large claims \u2013 extreme value models. In: Goovaerts M, Vylder F, Haezendonck J, editors. Insurance and Risk Theory. Dordrecht: Springer; 1986. p. 301\u201323.","DOI":"10.1007\/978-94-009-4620-0_20"},{"key":"964_CR31","doi-asserted-by":"crossref","unstructured":"Embrechts P, Claudia Kl\u00fcppelberg C, Mikosch T. Modelling Extremal Events for Insurance and Finance. Berlin, Heidelberg, Germany: Springer; 1997.","DOI":"10.1007\/978-3-642-33483-2"},{"key":"964_CR32","doi-asserted-by":"publisher","DOI":"10.1002\/0470012382","volume-title":"Statistics of Extremes: Theory and Applications","author":"J Beirlant","year":"2004","unstructured":"Beirlant J, Goegebeur Y, Teugels J, Segers J. Statistics of Extremes: Theory and Applications. Berlin, USA: Wiley; 2004."},{"issue":"1","key":"964_CR33","first-page":"93","volume":"6","author":"M Fr\u00e9chet","year":"1927","unstructured":"Fr\u00e9chet M. Sur la loi de probabilit\u00e9 de l\u2019\u00e9cart maximum. Annales de la Soci\u00e9t\u00e9 Polonaise de Math\u00e9matique. 1927;6(1):93\u2013117.","journal-title":"Annales de la Soci\u00e9t\u00e9 Polonaise de Math\u00e9matique"},{"key":"964_CR34","unstructured":"L\u00e9vy P.: Calcul des Probabilit\u00e9s. Gauthier-Villars, Paris, France,. Reprinted in 2004. Paris, France: Editions Jacques Gabay; 1925."},{"issue":"3","key":"964_CR35","doi-asserted-by":"publisher","first-page":"423","DOI":"10.2307\/1968974","volume":"44","author":"BV Gnedenko","year":"1943","unstructured":"Gnedenko BV. Sur la distribution limite du terme maximum d\u2019une s\u00e9rie al\u00e9atoire. Ann Math. 1943;44(3):423\u201353. https:\/\/doi.org\/10.2307\/1968974.","journal-title":"Ann Math"},{"key":"964_CR36","volume-title":"On Regular Variation and Its Application to the Weak Convergence of Sample Extremes","author":"L de Haan","year":"1970","unstructured":"de Haan L. On Regular Variation and Its Application to the Weak Convergence of Sample Extremes. Amsterdam, Netherlands: Universiteit van Amsterdam; 1970."},{"key":"964_CR37","unstructured":"von Mises R. La distribution de la plus grande de n valeurs. Rev Math Union Interbalcanique. 1936;1:141\u201360. Reprinted in Selected Papers of Richard von Mises, Amer Math Soc. 1954;2:271\u201394"},{"issue":"348","key":"964_CR38","doi-asserted-by":"publisher","first-page":"158","DOI":"10.1002\/qj.49708134804","volume":"81","author":"AF Jenkinson","year":"1955","unstructured":"Jenkinson AF. The frequency distribution of the annual maximum (or minimum) values of meteorological elements. Q J R Meteorol Soc. 1955;81(348):158\u201371.","journal-title":"Q J R Meteorol Soc"},{"issue":"2","key":"964_CR39","doi-asserted-by":"publisher","first-page":"263","DOI":"10.1111\/insr.12058","volume":"83","author":"MI Gomes","year":"2015","unstructured":"Gomes MI, Guillou A. Extreme value theory and statistics of univariate extremes: a review. Int Stat Rev. 2015;83(2):263\u201392. https:\/\/doi.org\/10.1111\/insr.12058.","journal-title":"Int Stat Rev"},{"issue":"1","key":"964_CR40","doi-asserted-by":"publisher","first-page":"54","DOI":"10.1214\/ss\/1177013815","volume":"1","author":"B Efron","year":"1986","unstructured":"Efron B, Tibshirani R. Bootstrap methods for standard errors, confidence intervals, and other measures of statistical accuracy. Stat Sci. 1986;1(1):54\u201375. https:\/\/doi.org\/10.1214\/ss\/1177013815.","journal-title":"Stat Sci"},{"key":"964_CR41","doi-asserted-by":"publisher","unstructured":"Klugman SA, Panjer HH, Willmot GE. Loss Models: From Data to Decisions, New York, USA: Wiley ; 1998. https:\/\/doi.org\/10.1002\/9780470391341","DOI":"10.1002\/9780470391341"},{"key":"964_CR42","doi-asserted-by":"publisher","DOI":"10.1002\/9780470317044","volume-title":"Stochastic Processes for Insurance and Finance","author":"T R\u00f3lski","year":"1999","unstructured":"R\u00f3lski T, Schmidli H, Schmidt V, Teugels J. Stochastic Processes for Insurance and Finance. New York, USA: Wiley; 1999."}],"container-title":["Health and Technology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s12553-025-00964-w.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s12553-025-00964-w\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s12553-025-00964-w.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,5,17]],"date-time":"2025-05-17T10:52:33Z","timestamp":1747479153000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s12553-025-00964-w"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,4,8]]},"references-count":42,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2025,5]]}},"alternative-id":["964"],"URL":"https:\/\/doi.org\/10.1007\/s12553-025-00964-w","relation":{},"ISSN":["2190-7188","2190-7196"],"issn-type":[{"type":"print","value":"2190-7188"},{"type":"electronic","value":"2190-7196"}],"subject":[],"published":{"date-parts":[[2025,4,8]]},"assertion":[{"value":"6 December 2024","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"28 March 2025","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"8 April 2025","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflicts of Interest"}}]}}