Working Paper: CEPR ID: DP14805
Authors: Inaki Aldasoro; Leonardo Gambacorta; Paolo Giudici; Thomas Leach
Abstract: Cyber incidents are becoming more sophisticated and their costs difficult to quantify. Using a unique database of more than 100,000 cyber events across sectors, we document the characteristics of cyber incidents. Cyber costs are higher for larger firms and for incidents that impact several organisations simultaneously. The financial sector is exposed to a larger number of cyber attacks but suffers lower costs, on average, thanks to proportionately greater investment in information technology (IT) security. The use of cloud services is associated with lower costs, especially when cyber incidents are relatively small. As cloud providers become systemically important, cloud dependence is likely to increase tail risks. Crypto-related activities, which are largely unregulated, are particularly vulnerable to cyber attacks.
Keywords: cyber risk; cloud services; financial institutions; bitcoin; cryptocurrencies; cyber cost; cyber regulation
JEL Codes: D5; D62; D82; G2; H41
Edges that are evidenced by causal inference methods are in orange, and the rest are in light blue.
| Cause | Effect |
|---|---|
| technological skills and investments in IT resources (O30) | costs associated with cyber events (K24) |
| firm size (L25) | cyber costs (K24) |
| connected events (Y80) | overall costs (J30) |
| malicious incidents (H84) | average costs (J30) |
| malicious incidents (H84) | costs at the tail end of the distribution (D39) |
| increasing Bitcoin prices (G13) | likelihood of attacks on crypto exchanges (G13) |