Author(s)

S. Y. Lee, J. H. Chung, J. S. Lee

Abstract

This paper estimates the damage costs of data breaches. In January 2014, around 100 million records containing sensitive personal information were maliciously leaked in Korea. Since this leakage of personal information could lead to cybercrimes such as phishing, pharming and privacy invasion, it caused severe social confusion. Despite its seriousness, current studies rarely estimate the damage from the victims’ perspectives or evaluate the value of personal data. Therefore, this study aims to estimate the true social costs of this privacy invasion. In addition, we evaluate the non-market value of personal information by estimating willingness to pay (WTP). For the analysis, we use the contingent valuation method (CVM) with double-bounded dichotomous choice questions. The result of the CVM analysis shows that individual WTP for protecting personal information is KRW 2,940 which is KRW 35,280 in annual cost. According to the analysis, the estimated damage cost of personal information leakage occurred in 2014 in Korea was up to KRW 529 billion, considering the actual victims in the calculation.

Keywords

data breach, personal information leakage, social disaster, CVM, WTP