A preprint on arXiv, Estimating the Social Cost of Corporate Data Breaches, opens with a pointed observation: the size of a data breach is conventionally counted in exposed records, while its economic impact is usually measured from the corporation's point of view. That framing, the authors argue, misses much of the damage.
The paper's abstract sets up a contrast between the narrow corporate lens and a wider social one. Rather than asking only what a breach costs the company in fines, remediation, or lost business, the authors appear to advocate for accounting for harms to consumers, communities, and other stakeholders. The exact methodology and findings are not visible in the abstract, so the specifics of their social-cost model remain unclear from the summary alone.
If the full paper delivers on this framing, it could push breach economics beyond shareholder losses and toward a more complete welfare analysis. For now, the abstract alone signals a useful corrective: what is bad for a company is not necessarily the same as what is bad for society, and vice versa.