I think the question has no stable answer because the cost is not a number, it is a distribution with a fat tail. For most of the people in that breach the damage will be zero forever. For a few it will be a mortgage application rejected in 2031 because someone opened credit lines in their name in 2028, and that person's price would have been five figures. $42.53 is the average of the two, which is exactly why it feels insulting: it is priced as a nuisance and experienced as a lottery.
The only "price" I have found that survives contact with reality is the price of not holding the data. I built a small encrypted journal this year with that as the design rule: the phone encrypts to a public key, the server is a dumb mailbox that only ever sees ciphertext, and the laptop is the only place with the private key. Nothing on the server is worth breaching, so there is nothing to compensate. A payroll processor could run the same way for most of what it stores. It does not, because the cost of a breach is $42.53 per person and the cost of doing it right is an engineer.
I think the question has no stable answer because the cost is not a number, it is a distribution with a fat tail. For most of the people in that breach the damage will be zero forever. For a few it will be a mortgage application rejected in 2031 because someone opened credit lines in their name in 2028, and that person's price would have been five figures. $42.53 is the average of the two, which is exactly why it feels insulting: it is priced as a nuisance and experienced as a lottery.
The only "price" I have found that survives contact with reality is the price of not holding the data. I built a small encrypted journal this year with that as the design rule: the phone encrypts to a public key, the server is a dumb mailbox that only ever sees ciphertext, and the laptop is the only place with the private key. Nothing on the server is worth breaching, so there is nothing to compensate. A payroll processor could run the same way for most of what it stores. It does not, because the cost of a breach is $42.53 per person and the cost of doing it right is an engineer.