BR122023022293B1 - METHOD FOR INFORMING A CONSUMER ABOUT AN ACCUMULATED RISK RESULTING FROM DATA BREACHES, AND, COMPUTER-READABLE STORAGE MEDIUM STORING A PLURALITY OF NON-TRANSITORY INSTRUCTIONS - Google Patents

Abstract

METHOD FOR INFORMING A CONSUMER OF AN ACCUMULATED RISK RESULTING FROM DATA BREACHES, AND, COMPUTER READABLE STORAGE MEDIUM STORING A PLURALITY OF NON-TRANSITORY INSTRUCTIONS. A method and system for generating a consumer breach history profile of a consumer via an electronic network includes receiving via the network, consumer profile information including at least one consumer information element corresponding to the consumer, generating a consumer breach history profile in a database using the consumer profile information, and associating the consumer breach history profile with the consumer profile information in the database. The database includes breach events, each breach event associated with at least one breached information element. The consumer profile information is matched to a respective breach event by determining a match between the consumer information element and the breached information element associated with the respective breach event. The respective breach event is associated in the database with the consumer's historical breach profile and a mitigation action. A notification to the consumer (...).

Description

CROSS-REFERENCE TO RELATED ORDERS

[001] This international application claims priority and the benefit of U.S. patent application Serial No. 17/080,556 filed October 26, 2020, U.S. patent application Serial No. 16/638,046 filed February 10, 2020, and U.S. provisional application No. 62/926,467 filed October 26, 2019.

FIELD OF TECHNIQUE

[002] The present disclosure relates to a system and methods for aggregating, searching, and analyzing data breach information from multiple breach events to generate an aggregated breach profile of a consumer, and using the aggregated data breach information for data breach risk analysis and harm mitigation.

FUNDAMENTALS

[003] Data breaches and data compromises differ significantly from one another in both the total relative risk and the specific nature of that risk to a consumer victim of the breach and, as a result, require that prioritized and unique action steps be taken by a consumer victim in response to notification of each breach or compromise of the consumer victim's data. The cumulative risk and nature of harm to a consumer who has been the victim of multiple breaches may not be evident from an analysis of each individual breach or compromise of the consumer victim's data. As such, systems and tools are needed to analyze, predict, and mitigate risks and harms that may result from multiple breaches or compromises of a consumer victim's data.

SUMMARY

[004] A system and methods for analyzing, predicting, and mitigating risks and harms that may result from multiple breaches or compromises of a consumer victim's data are provided herein. In a non-limiting example, the system and methods described herein for aggregating and analyzing risks and harms from multiple breaches utilize outputs generated by a data breach assessment system and methods as described in International Patent Application Number PCT/US2018/047237, published as WO 2019/040443, having common property and invention right with the present disclosure, the contents of which are incorporated herein by reference. The data breach assessment system is also referred to herein as a data breach system, as a Breach Clarity™ (BC) system, and/or as a BC system. The outputs generated by the data breach assessment system described in WO 2019/040443 include, for example, an overall risk score generated for a specific breach and breach victim, which is also referred to herein as a data breach score and/or as a Breach Clarity™ (BC) score; a prioritized list of specific harms (such as tax refund fraud or existing credit card fraud) that are generated by an algorithm as the most likely, e.g., most likely, harms that could occur as a result of a specific breach event or combination of breach events, based on the unique characteristics of that specific breach or that specific combination of breach events; an element risk score for a harm associated with a breached information element, wherein the element risk score is generated using one or more algorithms applied to data associated with a data structure and/or industry research, including qualitative, quantitative, and non-quantitative research, and stored in a BC system data structure; and a prioritized list of specific consumer fraud mitigation action steps, which may include, for example, actions such as obtaining a credit freeze, setting a fraud alert, initiating credit monitoring, etc., that are ranked to generate a prioritized set of actions to identify the relatively strongest protective actions against the risks and harms identified for the specific breach. The outputs generated by the BC system are presented, for example, displayed and/or issued, to the victim consumer through a user interface designed in one example such that the consumer can view a consolidated display showing a BC score, identified risks, mitigation actions, and, in one example, can trigger the mitigation actions and/or additional information through the user interface. This consolidation of outputs presented for consumer viewing and use presents an advantage to the consumer in contrast to AD HOC, unconsolidated, non-prioritized, and/or generalized consumer data breach information that may not clearly identify to the consumer the severity of a breach action and/or the appropriate mitigation actions that should be taken in response.

[005] A method and system for generating a consumer violation history profile of a consumer over an electronic network via a computer server is provided. In one example, the method includes receiving, over a network, consumer profile information corresponding to a consumer, generating, in a database and using the consumer profile information, a consumer violation history profile, and associating, in the database, the consumer violation history profile with the consumer profile information. The method further includes accessing, over a network, an electronic transaction account associated with the consumer, wherein the electronic transaction account is configured to execute a consumer transaction between the consumer and a consumer transaction party. Electronic transaction information associated with the consumer transaction is generated through the electronic transaction account and retrieved over the network, wherein, in an illustrative example, the electronic transaction information includes a consumer identifier corresponding to the consumer, a party identifier corresponding to the party, and a transaction time corresponding to the time the consumer transaction was executed through the electronic transaction account.

[006] The method further includes associating, in a database, electronic transaction information with the consumer, wherein the database includes breach information corresponding to a plurality of data breaches. The electronic transaction information is compared to the breach information of the plurality of data breaches by determining a match between the electronic transaction information and the breach information of a respective data breach. The consumer's breach history profile is appended when a match is determined by associating, in the database, the respective data breach with the consumer's breach history profile. In one example, appending the consumer's breach history profile further includes generating a breach notification to the consumer and transmitting the breach notification to the consumer via an electronic message and/or displaying the breach notification to the consumer via a breach system interface. In one example, the transaction time includes the date on which the consumer's transaction occurred, for comparison with the breach event information in the database.

[007] In one example, the consumer profile information includes account credentials corresponding to the electronic transaction account, and the method includes accessing the electronic transaction account using the account credentials. The account credentials may include one or more account identifiers, such as an account number or account name, an account password, an account authentication code, etc., as necessary for the breach system to access the electronic transaction account and/or retrieve electronic transaction information from the electronic transaction account. In one example, accessing the electronic transaction account includes receiving, via the network, a plug-in for accessing the electronic transaction account and executing the plug-in to transmit the transaction account information over the network, such that the electronic transaction information is retrieved from the account via the account plug-in.

[008] In an illustrative example, the electronic transaction account is an email account, the consumer transaction is an email transaction between an email sender and an email recipient, and the consumer transaction party is one between the email sender and the email recipient, and comparing the electronic transaction information to the breach information includes determining a match between the breach information for the respective data breach and at least one email sender or email recipient. In one example, the consumer identifier is an email address associated with the consumer.

[009] In an illustrative example, the electronic transaction account is an electronic payment account, the consumer transaction is an electronic payment transaction between a payer and a payee, and the consumer transaction party is one between the payer and the payee, such that comparing the electronic transaction information with the breach information includes determining a match between the breach information of the respective data breach and at least one of the payer and the payee. In one example, the consumer identifier is a payment account number associated with the consumer, which may be a payment card number.

[0010] In one example, a method and system for generating a consumer violation history profile of a consumer over an electronic network includes receiving over the network consumer profile information including at least one consumer information element corresponding to the consumer, generating a consumer violation history profile in a database using the consumer profile information, and associating the consumer violation history profile with consumer profile information in the database. The database includes a plurality of violation events, each violation event associated with at least one violated information element. The consumer profile information is matched with a respective violation event of the plurality of violation events by determining a match between the consumer information element and the violated information element associated with the respective violation event. The respective violation event is associated in the database with the consumer violation history profile.

[0011] The method further includes selecting, via the server, at least one mitigation action defined by the at least one breached information element and associating, in the database, the at least one mitigation action with the consumer's breach history profile. A notification to the consumer is generated and includes the at least one mitigation action. The method may include displaying, via a user device, a breach system interface and displaying, via the breach system interface, the at least one mitigation action. The at least one mitigation action may be associated in the breach system interface with an interface element and displayed such that the interface element is actionable via the breach system interface to complete the at least one mitigation action. In one example, the method includes displaying, in the breach system interface, a visual indicator configured to indicate whether the at least one mitigation action is complete or incomplete. In one example, the mitigation action is removed from the breach system interface when the mitigation action is complete.

[0012] The method may include indicating a mitigation action completion status in the consumer's breach history file and generating, via the consumer's breach history file, a consumer identity score defined by a combination of at least one breached information element and one or more mitigation actions associated with the breach clarity history profile. A notification may be generated reporting the consumer identity score to the consumer over the network. In one example, the consumer identity score may be displayed to the consumer via the breach system interface. The breach system is operable to update the consumer identity score based on a change in information associated with the consumer's breach history profile, wherein the change may include a change in a breach event or breach information associated with the consumer's breach history profile, a change in the completion status of a mitigation action, changes in breached information elements, or damages associated with the consumer's breach history profile.

[0013] In one example, a method of generating a consumer violation history profile of a consumer over an electronic network via a computer server includes receiving, over a network, consumer profile information corresponding to a consumer, generating in a database, and using the consumer profile information, a violation history profile of the consumer, and associating in the database the violation history profile of the consumer with the consumer profile information. The method further includes retrieving, over the network, violation event information from a violation information source and comparing the violation event information with the consumer profile information, determining a match between the violation event information and the consumer profile information, and appending the consumer violation history profile when a match is determined. Appending the consumer violation history profile includes associating in the database the respective data violation with the consumer violation history profile. In one example, the source of the breach information is the consumer, where the consumer may input the breach event information into a breach system interface via a consumer user device communicating with the network.

[0014] In one example, the breach information source is a DARK WEB service provider, the method including identifying, via the DARK WEB service provider, DARK WEB content including a breached information element and retrieving, via the network, the DARK WEB content, e.g., via the DARK WEB service provider. The method may include extracting the breached information element from the DARK WEB content, which may be saved in the database, and comparing the breached information element to consumer profile information, determining a match between the breached information and the consumer profile information. The method includes appending the consumer's breach history profile when a match is determined by generating, in the database, a breach event including the breached information element and associating, in the database, the breach event with the consumer's breach history profile.

[0015] The above and other features and advantages of the present description are readily apparent from the following detailed descriptions when taken in connection with the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 is a schematic illustration of an exemplary data breach system, also referred to herein as a Breach Clarity™ (BC) system; Figure 2 is a schematic illustration of a flowchart of an exemplary process for a consumer user accessing a consumer interface of the BC system, also referred to herein as a BC Premium system (BC Premium), and generating a consumer breach profile, also referred to herein as a My Breach Clarity History profile; Figure 3 is a schematic illustration of a flowchart of an exemplary process for an institution user accessing an institution interface of the BC system, also referred to herein as a BC Professional system (BC Professional), and utilizing BC Professional breach reporting and assessment applications; Figure 4 is a schematic illustration of a flowchart of an exemplary process for analyzing an account request using a BC system fraud risk assessment application, also referred to as a BreachedID application; Figure 5 is a schematic illustration of a flowchart of an exemplary process for constructing and analyzing a breach event using a BC System Build-a-Breach application; Figure 6 is a schematic illustration of a flowchart of an exemplary process for integrated risk assessment and mitigation of data breach events using the BC System of Figure 1; Figure 7 is a schematic illustration of an exemplary BC Freemium user interface including a breach input field for conducting a breach search; Figure 8 is a schematic illustration of the example user interface of Figure 7 displaying the search outputs for an example breach search; Figure 9 is a schematic illustration of an example BC Freemium user interface displaying the risk outputs for an example breach event selected from the search outputs of Figure 8 and further including an institution input field for performing a sponsoring institution search; Figure 10 is a schematic illustration of the BC Freemium user interface of Figure 9 showing an example institution search; Figure 11 is a schematic illustration of an example BC Premium sponsoring institution interface issued as a result of the institution search of Figure 10 including a customer login field for use in accessing a customer account of the institution; Figure 12 is a schematic illustration of an example customer summary interface for the customer account accessed through the institution interface of Figure 11 including a Breach Clarity breach search input field integrated into the customer summary interface for accessing BC Premium; Figure 13 is a schematic illustration of an example user interface that displays risk outputs for an example breach event selected from the search outputs of Figure 8 and additionally including an institution input field for performing a sponsoring institution search; Figure 14 is a schematic illustration of the example BC Premium user interface of Figure 13, toggled to display information elements breached in the first breach event; Figure 15 is a schematic illustration of an example institution interface that displays risk mitigation actions that can be selectively enabled by the customer; Figure 16 is a schematic illustration of the example BC Premium user interface of Figure 14, illustrating a breach search for a second breach event; Figure 17 is a schematic illustration of an example BC Premium user interface showing a My Breach Clarity History generated for the client; Figure 18 is a schematic illustration of an example BC Professional interface including an institution user login field for use in secure BC Professional access; Figure 19 is a schematic illustration of an example BreachFeed view generated by BC Professional that shows breach event activity over a reporting time period, including the impact on the institution's customers; Figure 20 is a schematic illustration of the BreachFeed view from Figure 19, which shows the geographic impact of breach event activity over the reporting period and the customer credentials breached over the reporting period; Figure 21 is a schematic illustration of the BreachFeed view from Figure 19, including interface elements for searching for breach events; Figure 22 is a schematic illustration of an example BC Professional interface that displays the output of a breach search performed through BC Professional, including a list of institution customers impacted by the searched breach event and an institution risk assessment generated for the breach event being searched for; Figure 23 is a schematic illustration of an example BC Professional interface that displays a summary of breach events being searched for; Figure 24 is a schematic illustration of an example BC Professional interface for conducting a survey of a customer of the institution; Figure 25 is a schematic illustration of an example BC Professional interface that displays the output of the customer survey shown in Figure 24, incorporating the My Breach Clarity History of the searched customer and the customer's mitigation and damage status for each of the listed breach events; Figure 26 is a schematic illustration of an example BC Professional interface for constructing a breach event, also referred to herein as Build-a-Breach, including a list of breach types for selection in the breach event construction process; Figure 27 is a schematic illustration of the Build-a-Breach interface 59F of Figure 26, which further illustrates a listing of information elements for selection in the event construction process of breach;Figures 28-29 are schematic illustrations of the Build-a-Breach interface 59F of Figure 27, which further illustrates the selection of information elements in the breach event construction process;Figure 30 is a schematic illustration of an exemplary display of a constructed breach generated by the Build-a-Breach application and including a Breach Clarity score, damages, and mitigation actions determined for the constructed breach event by the BC system;Figure 31 is a schematic illustration of a fraud analysis generated by BC Professional including potential breach loss parameters generated for aggregate breaches affecting the institution's customer population; Figure 32 is a schematic illustration of an administrative interface for administering access given to institution users accessing BC Professional; Figure 33 is a schematic illustration of an example identity roadmap interface generated by BC Professional that displays an identity roadmap generated for an institution customer, including mitigation actions specific to the institution customer as defined by the customer’s consumer risk profile (My Breach Clarity History profile) and through which the customer can trigger the mitigation actions; Figure 34 is a schematic illustration of an example BC Professional interface configured to display through a consumer user device, including the display of an example identity roadmap and a breach event search interface; Figure 35 is a schematic illustration of a non-limiting summary of mitigation actions for preventing and detecting data breach damage; Figure 36 is a schematic illustration of an example data table that shows a listing of damages, a listing of breakable information elements and an exemplary element risk score generated by an algorithm of the BC system of Figure 1 for each harm information element combination; and Figure 37 is a schematic illustration of a flowchart of an exemplary process for generating an aggregated consumer identity risk score for a consumer user of the BC system, also referred to herein as a consumer identity score.

DETAILED DESCRIPTION

[0017] A system and methods for analyzing, predicting, and mitigating risks and harms that may result from multiple breaches or compromises of a consumer victim's data are provided herein. In a non-limiting example, the system and methods described herein for aggregating and analyzing risks and harms from multiple breaches utilize outputs generated by a data breach assessment system and methods as described in International Patent Application Number PCT/US2018/047237, published as WO 2019/040443, having common property and invention right with the present disclosure, the contents of which are incorporated herein by reference. The outputs generated by the data breach assessment system described in WO 2019/040443 include, for example, an overall risk score 80 generated for a specific breach 70 and breach victim, which is also referred to herein as a data breach score 70 and/or as a Breach Clarity™ (BC) score 70; a prioritized list of specific harms 72 (such as tax refund fraud or existing credit card fraud) that are generated by an algorithm as the most likely, e.g., most likely harms 72 that could occur as a result of a specific breach event 70 or combination or breach events 70, based on the unique characteristics of that specific breach 70 or that specific combination of breach events 70; an element risk score 74 for an harm 72 associated with a breached information element 68, wherein the element risk score 74 is generated using one or more algorithms applied to associated data in a data structure 22 and/or industry research, including qualitative, quantitative, and non-quantitative research, and stored in a data structure 22 of the BC system 100; and a prioritized list of specific consumer fraud mitigation action steps 116, which may include, for example, actions such as obtaining a credit freeze, setting a fraud alert, initiating credit monitoring, etc. which are ranked using an action prioritization factor 136 to generate a set of actions for the breach event 70 that are prioritized to identify the relatively strongest protective actions 116 against the identified risks and harms 72 for the specific breach event 70. The outputs generated by the BC system 100 are presented, e.g., displayed and/or outputted, to the victim consumer via a consumer user interface 90 designed in one example such that the consumer can view a consolidated display showing a BC score 80, identified risks and harms 72, and mitigation actions 116. In an illustrative example, the victim consumer can trigger the mitigation actions 116 by triggering an interface element 31 of the consumer user interface 90 and/or retrieve additional information via the consumer user interface 90. This consolidation of outputs presented for consumer viewing and use presents an advantage to the consumer, in contrast to AD HOC information, in that it does not consolidated, non-priority and/or widespread consumer data breach reports that may not clearly identify to the consumer the severity of a breach and/or the appropriate mitigating actions that should be taken in response.

[0018] With reference to the drawings in which like reference numerals represent like components throughout the various Figures, the elements shown in Figures 1-37 are not necessarily to scale or proportion. Accordingly, the particular dimensions and applications provided in the drawings presented herein are not to be construed as limiting. As used herein, the terms "a," "an," "the," "at least one," and "one or more" are interchangeable and indicate that at least one of an item is present. A plurality of such items may be present unless the context clearly indicates otherwise. All numerical values of parameters, quantities, or conditions in this description, including the appended claims, are to be understood as being modified in all instances by the term "about" or "approximately," regardless of whether "about" or "approximately" actually appears before the numerical value. “About” and “approximately” indicate that the stated numerical value allows for some slight imprecision (e.g., with some approach to the accuracy of the value; reasonably close to the value; almost; essentially). If the imprecision provided by “about” or “approximately” is not otherwise understood to have this meaning, then “about” and “approximately” as used herein indicate at least variations that may arise from measurement methods and using such parameters. In addition, the terminology “substantially” also refers to a slight imprecision of a condition (e.g., with some approach to the accuracy of the condition; approximately or reasonably close to the condition; almost; essentially). In addition, the numerical ranges described include the description of all values and further divided ranges within the entire described range. Each value within a range and the ends of a range are each described as separate embodiments. The terms "comprising," "includes," "including," "has," and "having" are inclusive and therefore specify the presence of the stated items but do not exclude the presence of other items. As used in this description, the term "or" includes any and all combinations of one or more of the listed items.

[0019] The term “data breach” as used herein is not intended to be limiting and shall be construed broadly to include any incident in which data has been exposed in a manner that creates a possibility or potential for danger, pain, loss and/or injury to the data owner, including, for example, identity theft, financial loss, loss of privacy, extortion, etc. A “data breach” as that term is used herein may also be referred to and/or include one or more of data theft, data compromise, unauthorized access to data, unauthorized exposure of data, data intrusion, data hacking, a penetration of data, physical loss or theft of personally identifiable information, etc. A “data breach” may also be referred to herein as a “data compromise” and/or as a “breach event.” In an illustrative example, the information elements 68 that may be breached and/or compromised may include one or more personally identifiable information (PII), protected health information (PHI), payment card industry (PCI) data, and other information that may, if breached and/or compromised, expose the breached victim to risk, injury, and/or danger.

[0020] The data breach system 100 described herein uses a plurality of data structures 22, tabulation formats, quantitative and qualitative research, and algorithms 10 that are used in combination to calculate risk-related outputs designed to minimize risk to consumers, which may be sent to a consumer via a consumer user interface (UI) 128 of a consumer user device 30 and/or to a sponsoring entity or institution 50, such as a banking institution or other financial services provider, healthcare provider, or other resource provider 50 engaged in providing a service or product to consumers, via one or more institution user interfaces (UI) described herein as BC Professional interfaces 59. The cumulative data structures 22, tabulation formats, quantitative and qualitative research, and algorithms 10 that are used in combination to calculate risk-related outputs, perform fraud analysis, generate aggregated consumer breach histories 57, analyze, accumulate, and reporting data breach events 70, etc. are referred to herein as the Breach Intelligence Network™. In an illustrative example, the system 100 described herein is referred to as the Breach Clarity™ (BC) system and includes consumer-facing applications 20 and interfaces 90 referred to herein as Breach Clarity Freemium, consumer-facing applications 20 and interfaces 90 referred to herein as Breach Clarity Premium, and institution-facing applications 20, 45, APIs 24, 43, and user interfaces 59 referred to herein as Breach Clarity Professional.

[0021] In a non-limiting example, BC Freemium may be accessed and utilized by a consumer via a user device 30 without registration or identification of the consumer in the BC system 100. In one example, access to BC Premium may be offered by a sponsoring entity, such as a resource provider, to customers of the resource provider, where in an illustrative example, the sponsoring entity's interface 25 may be accessed via the BC Premium interface 90, and the BC Premium interface 90 may be accessed by a customer of the sponsoring entity via the sponsoring entity's interface 25. In this example, a breach profile 57, also referred to herein as a My Breach Clarity History profile, may be created for each customer/consumer via a BC Premium interface 90Z, wherein the customer/consumer's breach profile 57 includes a history of each breach 70 to which the customer/consumer has been subjected, such that the breach history 57 of that consumer may be analyzed for additional risks attributable to the cumulative breaches to which the consumer has been subjected, and so that mitigation actions 116 tailored to the cumulative breach history 57 of that customer/consumer can be identified and/or implemented by the sponsoring entity 50, thereby reducing the risk to the customer/consumer and to the sponsoring entity in relation to the customer/consumer data held by and/or transactions entered into with the sponsoring entity. In a non-limiting example, BC Freemium features, interfaces and applications are included in BC Premium, and BC Freemium and BC Premium may also be referred to individually and/or collectively herein as a consumer user interface 90, a consumer interface 90, a customer interface 90 and/or a subscriber interface 90 for the BC system, which may include a plurality of user interfaces 90A, 90B... 90N, configured such that the consumer use may interact with the BC system 100 to access the BC system 100, view and/or enter breach information including breach events 70, view the consumer risk profile 57, identity roadmap 218 and/or consumer identity score 216 and/or activate mitigation actions 116 to reduce consumer identity risk, as described in more detail herein.

[0022] In one example, one or more application program interfaces (APIs) 24, 43 are used to interface consumer breach data 22 from BC system server 12 with customer data 46 from sponsoring entity server 50 via BC Premium interface with BC Professional via a network 130. Using the breach data, customer data, and/or other data entered by the consumer/client into BC system 100, an individualized breach history profile 57 may be generated and maintained in BC system 100 for the consumer/client, which may be referred to herein as a consumer breach profile and/or in an illustrative example may be referred to herein as the consumer's My Breach Clarity History. In one example, the breach history profile 57 for each customer of a sponsoring entity 50 may be provided via interfaces 90, 59 between BC Premium and BC Professional to the sponsoring entity 50, which may combine the breach history profile 57 for each customer with the sponsoring entity's data for that customer to generate a risk profile for that customer, wherein the combination of the consumer's breach history and risk profile may be referred to herein as the consumer's breach profile and/or in illustrative examples as the consumer's My Breach Clarity History. In one example, the customer breach profile 57 may include information such as a listing of each breach event 70 by which the customer has been victimized, an identifier of the breached entity such as the name of the entity, the source of information from which the breach was identified, whether a fraud event was experienced by the customer related to the breach event, the extent to which the customer has completed mitigation actions 116 related to each breach event, etc., wherein mitigation action tracking, in one example, is accomplished via a consumer identity roadmap 218 as shown in Figures 25, 33, and 34.

[0023] In one example, the BC system 100 includes an application and/or application interface referred to herein as BreachedID™, which is API enabled through the BC system 100 and an institution's system 50, for analyzing account requests received by the institution related to a consumer/customer account. Using the BreachedID application and consumer/customer identification information, such as the customer's email address, the account-related request is analyzed using the BC System 100 and the BC Breach Intelligence Network, including data structure 22, to determine the risk associated with the account request, e.g., to determine whether the account-related request is an attempted fraudulent account request by a third party using the consumer/customer identification information that was breached. The BreachedID application and/or the institution may, in response to the attempted fraudulent account application identified by BreachedID™, identify and/or implement mitigation actions 116 to prevent the fraudulent account application from being approved without sufficient proof that the application is being completed by the legitimate identity owner, the amount and frequency of transactions from the new account for an initial period after the application is approved, increasing authentication requirements for future transactions on the customer/consumer account, etc.

[0024] As described in more detail herein and in the accompanying Figures, BC Professional is configured for use by an institution, which may also be referred to herein as a resource provider 50, which may be a financial organization, commercial entity, healthcare organization, or the like that provides services and products to a customer that involve the use of the customer's personally identifiable information (PII) and/or where the customer may also be a consumer that has been the victim of a breach. In one example, institution 50 may be a breached entity. In one example, institution 50 may be an entity that has not been breached but provides services and products to customers of institution 50 that have had their (customer's) personal data breached, such that the breach of customer data presents a potential risk to institution 50, e.g., in the form of fraud at the institution, account takeover, etc. The BC Professional, as described herein, may include one or more applications, methods, and/or processes that may be used by the institution through the BC Professional interface, also referred to as an interface from the institution 48 to the BC system 100, in understanding, assessing, and analyzing the impact of multiple data breaches on its customer population and/or to identify and/or implement mitigation actions to reduce risks and/or harm to the customer and/or the institution due to data breaches that have affected, e.g., victimized, its customer population. BC Professional may include, by way of non-limiting example, a BreachFeed™ application, which is a “news feed” style information compilation and reporting tool that displays to the institution user 50 new reported breaches in real time, wherein the breach information associated with the new breaches is aggregated from various sources, including Breach Clarity Premium, DARK WEB monitoring, common point of purchase (CPP) analysis, etc., wherein new breach information may be reported separately and/or may be aggregated with known breach information to report and provide breach exposure analysis for a selected time period, for example, to display information on breaches reported in the last day, week, or month. In one example, the breach event information may be analyzed in conjunction with information known to the institution and/or available in the BC system databases about the institution’s customer population to determine and/or estimate the impact of a particular breach or breaches on the institution’s customer population, as demonstrated in the figures accompanying this description.

[0025] In an example shown in Figure 22 , the BC Professional institution user interface 59 includes a search engine executable through an interface 59C to search for a particular breach 70 in the BC database 22 to obtain detailed information for that particular breach 70, including the Breach Clarity score 80, the breached information elements 68, the potential damages 72, and the recommended mitigation actions 116 associated with that particular breach 70 in the BC system 100. In an example shown in Figures 24-25 , the BC Professional includes a search engine executable through an interface 59E and APIs 24, 43 operable such that an institution user can search for breach events 70 that have impacted a particular customer of the institution 50, which may include customer information for the particular customer provided by the institution 50 to the BC Professional via the BC server 12, for example, via one or more APIs 24, 43. 43, which may be used by BC Professional and/or BC system 100 to associate customer information provided by institution 50 with identifying consumer information stored in the BC database 22 and/or within the BC Breach Intelligence Network, and provide institution 50 with one or more reports showing the breach history profile 57, also referred to herein as My Breach Clarity History, for the specific customer. The example is not limitative, so that the interface between BC Professional and institution 50 may be used to perform other customer-related search and analysis configurations, for example, to generate customer-specific information reported to institution 50, for example, through a BreachFeed interface and reports. A specific breach 70 in the BC database 22 may be searched to obtain detailed information for that specific breach 70, including the Breach Clarity score 80, the information elements 68 breached by the breach event 70, the potential damages 72 associated with the breach of those information elements 68, and the recommended mitigation actions 116 associated with that specific breach 70 in the BC system 100. In one example, BC Professional includes applications 20 and/or algorithms 10 such that the institution 50 via BC Professional may “Build-a-Breach™” to generate a breach event 70 and/or assess the impact of a breach event 70 on the institution's customer population. In an example method 165 shown in Figure 5 and in an illustrative example shown in Figures 26-30 , the institution 50 may select inputs to the Build-a-Breach application that include the type of breach 47, e.g., a corporate data breach, a personal user device (tablet, cell phone) breach, user disclosed information, etc., and the information elements 68 to be input as breached information elements. Creating the breach event 70 generated by the Build-a-Breach application may include inputting 49 impacted customers from the institution's customer base that have been associated by the institution's resource database 46, the BC server 12, and/or the Breach Intelligence Network data structure 22 with the constructed breach event 70, and generating classified risks 72 and mitigation actions 116 for the constructed breach. The constructed breach event 70 may be saved to the institution's BC Professional profile for use with later analysis and/or may be submitted to the BC Breach Intelligence Network and saved to the BC data structure 22 for use by the BC system 100 and/or for use by other institutions 50 accessing the BC system 100 through the institution's BC Professional interface. In one example, the BC Professional may include other fraud analysis tools that may be used to assess the estimated actual and/or projected damage and/or risk to the institution 50 and/or to the institution's customer population associated with one or more breach events 70, for example, to analyze the potential benefits of implementing certain mitigation actions, such as modifications to customer authentication requirements, transaction controls, security alerts, etc. A non-limiting example is shown in Figure 32.

[0026] As previously described and further illustrated herein by the process shown in Figure 4 and Figures 24-25, the BC system 100 may include an API-based service for determining identification risks associated with new customer applications and/or account requests made on existing accounts, to mitigate fraudulent account creation and/or account takeover, using an application and/or process referred to herein as BreachedID.

[0027] The BC system 100 described herein includes, in an illustrative example, an apparatus 12, which may be referred to herein as a BC server or computing device 12, the computing device having a processor 14 and a non-transitory memory 16, the non-transitory memory storing instructions executable by the processor 14 such that the apparatus is configured and/or operable to execute methods and processes including methods and processes 105, 125, 145, 165, 175, and 205, and/or applications described herein which may also be referred to as Breach Clarity™ (BC) processes, including, for example, generating a Breach Clarity Score 80 (BC Score) for an identified breach, executing processes as described herein associated with BreachFeed, breach entity and/or institution 50 searches, customer searches, BreachedID, Build-a-Breach, fraud analysis processes, My Breach Clarity History and/or consumer risk profiles 57, consumer identity roadmaps 218 including mitigation actions 116, Consumer Identity Scores 216, etc., and processes as described herein associated with the BC Freemium, BC Premium and BC Professional applications and interfaces. In an illustrative example and as shown in Figure 6 and described in related International Patent Application Number PCT/US2018/047237 published as WO 2019/040443, the contents of which are incorporated herein by reference, the methods described herein may include populating, via a BC server 12, a data structure 22 with breach information, wherein the breach information may include information relating to one or more breach events 70, which may include identifying information identifying consumers who were victimized by the breach, information elements 68 breached in the breach event 70, the information source from which the breach event 70 was reported, information indicating whether fraud or other danger was detected by use of the breached information, etc. The breach information may further include a plurality of information elements 68 breached by the breach event 70 and a plurality of hazards or other risks 72 that may result from a breach of information elements 68. In a non-limiting example shown in Figure 1, the information source from which a breach event 70 may be reported may include a self-reporting entity reporting information related to a breach that was experienced by the self-reporting entity, which may also be a resource institution 50 as further described herein. The information source providing the breach information may be a regulatory or governmental organization or other organization configured to receive and report breach event information, such as the U.S. Federal Trade Commission or a private entity, such as the Identity Theft Resource Center (ITRC), as examples of the 40 reporting entities further described herein. In one example, the information source may be an individual consumer user 30 who enters breach information into the BC system 100, for example, through the BC Freemium and/or BC Premium consumer interfaces 90 and/or through interfaces provided by BC Professional and/or BC sponsoring institution interfaces 59, 25. In one example, an information source of breach information may be a DARK WEB service provider 11, which may be an entity configured to monitor the DARK WEB 202, also referred to as the Darknet, to detect breach events, breached information, and/or data marketplaces that offer stolen, compromised, breached, or unauthorized personal information and/or credentials for sale. The DARK WEB service provider 11 provides the detected information to the BC system 100, wherein the detected information is normalized into the Breach Intelligence Network and/or BC data structure 22 as further described herein, including being scored with a BC score 80 and associated in the BC data structure 22 with the BC score and other breach information associated with the information detected by the DARK WEB service provider 11, including, for example, consumer personal information and/or consumer credentials associated with the breach information retrieved from the DARK WEB 202. In another example, a source of breach information may be payment account data for a consumer user retrieved through the consumer user's payment service provider 89, including bill payment and payment card transaction data and associated payment dates on the consumer user's payment account and retrieved into the Breach Intelligence Network data structure 22 for risk analysis related to known breach events, as further described herein. In another example, a source of breach information may be email account data for a consumer user retrieved through the consumer user's email service provider 87, including recipient name identifier, sender name identifier, receipt and/or sending date of each email message in the consumer user's email account, and retrieved into the Breach Intelligence Network data structure 22 for risk analysis related to known breach events 70, as further described herein.

[0028] Referring to Figure 1, a system, which may be described herein as a data breach scoring, research, and analysis system, is generally denoted at 100. In an illustrative example, system 100 is also referred to herein as a Breach Clarity™ (BC) system and/or as a BC system 100. BC system 100 includes a BC server 12, which includes one or more data structures generally denoted at 22, one or more applications 20, one or more application program interfaces (APIs) 24, and/or one or more algorithms 10 configured to execute applications 20 described herein. In a non-limiting example, applications 20 executable by the BC system 100 may include one or more of BC Freemium, BC Premium, BC Professional, BreachFeed, BreachedID, Build-a-Breach, My Breach Clarity History as further described herein, applications for generating a consumer risk profile 57 also known as a My Breach Clarity History profile, Consumer Identity Roadmap 218 and/or Consumer Identity Score 216 and search applications for searching for one or more breach events 70 or a combination of breach events 70, a consumer breach profile 57, a population of consumers to determine the impact of the breach of one or more breach events on the population of consumers. In a non-limiting example, applications 20 executable by the BC system 100 include breach scoring and risk assessment applications for computing risk-related outputs designed to minimize risk to consumers who have been victims of a breach event 70. The cumulative data structures 22, tabulation formats, quantitative and qualitative research, and algorithms 10 that are used in combination to calculate risk-related outputs, perform fraud analysis, generate aggregated consumer breach histories, analyze, accumulate, and report data breach events, etc. are referred to herein as a Breach Intelligence Network, which is integrated with the BC system 100.

[0029] As used herein, risk 72 to a consumer as a result of a data breach may also be referred to herein as a hazard 72 or an injury 72, such that the terms risk, harm, and injury are to be broadly construed to include all types of harm to a consumer that may result from a data breach, including but not limited to the harms 72 described herein and shown in the FIGS. Each of the risk-related outputs may be generated by the BC system 100 for each breach event 70 and/or as a summary output for a plurality of breach events 70 experienced by a victim consumer. A breach event 70 may also be identified herein by a breach descriptor, e.g., by a name or description by which the breach event 70 is identified. Risk-related outputs may include, in an illustrative example and further described herein, one or more breach descriptors 70, a set of breakable information elements 68, one or more of a set of damage descriptors 72, and an overall data breach score 80 also referred to herein as a Breach Clarity™ (BC) score 80 generated for the specific breach event 70.

[0030] As shown in Figure 1, the BC server 12 includes a memory 16 and a central processing unit (CPU) 14. The memory 16 of the BC server 12 may include, by way of example, Read Only Memory (ROM), Random Access Memory (RAM), Electrically Erasable Programmable Read Only Memory (EEPROM), etc., i.e., non-transitory/tangible machine memory of sufficient size and speed to store the data structure 22, the algorithms 10, the APIs 24, tabulation formats included in the data structure 22, quantitative, qualitative, and other industry and/or breach-related research, breach event data, mitigation action information, one or more BC applications 20, etc. Memory 16 is of sufficient size and speed to manipulate data structure 22, to execute algorithms 10, APIs 24, and/or BC applications 20 to generate risk-related outputs, simulate breach events, interface with institution APIs 43, to generate one or more consumer user interfaces (UI) 90 including, for example, consumer user interfaces 90T, 90U, 90W, 90X, and 90Z shown in the Figures, to generate one or more professional user interfaces (UI) 59 including, for example, professional user interfaces 59A, 59B, 59C, 59D, 59E, 59F, 59G, 59H shown in the Figures. The BC server includes a BC interface 18, which in an illustrative example may be configured as a modem, browser, or similar means suitable for accessing a network 130. In one example, the network 130 is the Internet. The BC server 12, in a non-limiting example, is administered and/or operated by a BC service provider. In one example, a victim consumer may access the risk outputs and other services of the BC system 100 through a user device 30 and/or by personal contact with the BC service provider.

[0031] A consumer, also referred to herein as a consumer-victim, a consumer user, a consumer, a subscriber, and/or a customer, may access the BC system 100, for example, through a user device 30, and breach system interfaces, such as BC Freemium, BC Premium, and/or BC Professional client interfaces, to view breach information, including risk outputs generated by the BC system 100 for one or more breach events 70. In one example, the consumer accessing the BC system 100 may be a consumer-victim of a breach event 70 accessing the BC system 100 to view information output by the BC system 100 related to that breach event 70. In another example, the consumer need not be a victim of a breach 70, for example, any consumer may access the BC system 100 to view breach information, including risk outputs 72 generated by the BC system 100 for one or more breach events 70. In one example, the BC system 100 may be configured such that a consumer does not need to enter identifying information and/or identify themselves as a victim of a breach event 70 as a prerequisite to accessing the BC system 100. In another example, the BC system 100 is configured to provide an option for a consumer to subscribe to the BC system 100, such that subscription information for the subscriber-consumer may be stored in memory 16 of the BC server 12 in data structure 22, e.g., in a consumer profile created in data structure 22 for the subscriber-consumer. The term "subscription" is intended to have a broad meaning, including, for example, one or more actions, such as creating an account, creating a login name and password, subscribing and/or registering as a user of the BC system 100 and/or to receive notifications from the BC system 100, creating a consumer profile, etc. The term "subscription" may include, but is not limited to, a subscription for which the subscriber receives a fee to access the BC system 100. In one example, a consumer may subscribe without paying a subscription fee. In another example, the BC system 100 and/or a subscription to the BC system 100 may be offered to the consumer by a sponsoring entity 23, wherein the sponsoring entity 23 may be a resource provider 50 which may be a financial organization, commercial entity, or healthcare organization that offers and/or provides products and/or services to the sponsored consumer.

[0032] In one example, the sponsored consumer may be a customer of the sponsoring entity 23, so that the sponsored consumer may be referred to herein as a customer, a consumer/customer, an enrolled customer, or the like. In one example, the sponsor and/or other entity may host a portal 29 to the BC system 100 on the sponsor/other entity's website, through which a consumer may access the BC system 100. The sponsoring entity may also be referred to herein as a sponsoring institution 23 and/or a resource institution 50. In one illustrative example, the sponsoring institution 23 is a resource provider 50 operating as a financial services provider, such as a bank, offering its customers a sponsored BC Premium subscription that may be accessed through an institution interface 25 of the institution 23. In one illustrative example, the institution 23 utilizes the Breach Clarity application 20 referred to herein as BC Professional, such that the institution 23 communicates with the BC server 12 through one or more BC APIs 24 and institution APIs 43. In one example, customer identification information for one or more customers of the institution's customer population is associated through the APIs 24, 43 with breach information in the Breach Intelligence Network and/or data structure 22 of the BC server 12, so that customer-specific breach history profiles 57 and/or customer-specific risk assessment and mitigation outputs, such as Consumer Identity Roadmaps 218, can be generated by the BC system 100 and provided to the institution 23 and the institution's consumer customer via the BC Professional application 20.

[0033] In a non-limiting example, the consumer subscriber's subscription information and/or the consumer subscriber's consumer profile 57 is associated in data structure 22 with at least each breach event 70 in which the consumer subscriber was a known victim, and with each of the consumer subscriber's information elements 68 that was breached or compromised. The consumer profile 57 may also be referred to herein as a consumer risk profile and/or as a subscriber risk profile, as a consumer breach profile, and in a non-limiting example, an individual consumer profile may be referred to herein as My Breach Clarity History. During the subscription process, the consumer subscriber may enter into the BC system 100 pieces of information 68 of the consumer subscriber that have been compromised and/or breached that are not associated with a publicly reported breach, e.g., theft of credit card information from a stolen purse or wallet, loss of payment information through skimming, improper disposal of personal information records, etc. In a non-limiting example, subscription information for a consumer subscriber may include identifying information to identify the consumer subscriber including, for example, the consumer subscriber’s name, address, email address, telephone, other social media contact information (Twitter®, Instagram®, etc.), a listing of the breach events 70 in which the consumer subscriber has been victimized, including the number, type, frequency, and timing of each such breach event 70, a listing of the consumer subscriber’s information elements 68 that have been breached or compromised by the breach events 70 in which the consumer subscriber has been victimized, actual damage or injury suffered by the consumer subscriber due to a data breach or compromise, behavioral and/or demographic information for the consumer subscriber that, in one example, may be used by the BC system 100 and/or algorithms 10 to generate, rank, weight, and/or prioritize mitigation actions 116 that can be sent to the consumer subscriber. In this latter example, behavioral information may include, by way of non-limiting example, the consumer subscriber's information security behaviors, including, for example, password behaviors, including reuse of passwords, frequency of changing passwords, password security messages used by the consumer subscriber, the consumer subscriber's use of anti-virus, security, and anti-malware products, the consumer subscriber's use of identity theft tools, such as credit score monitoring, the consumer subscriber's frequency and breadth of online communication methods (private and public networks, including Wi-Fi, email, chat rooms, blogs, social media, instant messaging, etc.), the frequency and breadth of the consumer subscriber's online use and/or communication of personally identifiable information (PII), protected health information (PHI), payment card industry (PCI) data, including online access and manipulation of such information, consumer subscriber's data access mechanisms, including type, model, etc. of devices (mobile phones, personal computers, personal digital assistants, tablets, laptops, modems, routers, smart appliances, smart home devices and systems, smart vehicles, etc.) used by the subscriber-consumer, etc. In this last example, demographic information may include, but is not limited to, the subscriber-consumer's geographic location, income demographic, age, gender, marital status, occupation, etc. One or more algorithms of the BC system 100 may be configured to incorporate the subscriber-consumer subscription information in the generation of one or more risk outputs, for example, in the generation of an exposure classification 132, a listing of recommended mitigation actions 116, a damage ranking 72, etc., wherein the subscription information may be used by the algorithm as a modifier and/or additional factor in the calculation and/or generation of the risk outputs by the BC server 12. The example of using the subscriber information in the calculation and/or generation of the risk outputs is illustrative and not limiting. For example, one or more algorithms of the BC system 100 may be configured to associate, in data structure 22, the identifying information of a non-subscribing consumer, with one or more of the breach events 70, breached information elements 68, etc., in generating one or more risk outputs, e.g., in generating an exposure rating 132, a list of recommended mitigation actions 116, a damage rating 72, etc., wherein the consumer information may be used by the algorithm as a modifier and/or additional factor in the calculation and/or generation of the risk outputs by the BC server 12.

[0034] In one example, the consumer's breach profile, e.g., the consumer's My Breach Clarity History profile, may be combined with identifying customer information provided by an institution 23 to the BC system 100 via the BC Professional application, such that a customer risk profile may be compiled by the BC system 100 and/or institution 23 for the institution's customer/consumer. For example, an assessor's customer risk profile may be combined with customer risk profiles of other customers of institution 23, and the BC Professional application may be used to study risk assessment for the institution based on the number and type of breaches impacting the customer population of institution 23.

[0035] Referring again to Figure 1, user device 30 includes a memory 26, a central processing unit (CPU) 28, a communication interface 126, and an input/output interface 128. User device 30 may be a user device such as a cellular telephone, a personal digital assistant (PDAs), a portable or handheld device (iPhone, Blackberry, etc.), a notebook, tablet, personal computer, notepad, or other user device configured for mobile communications, including communication with network 130. User device 30 is configured to communicate with network 130 through communication interface 126, which may be a modem, mobile browser, wireless Internet browser, or similar means suitable for accessing network 130. Memory 26 of user device 30 may include, by way of example, read-only memory (ROM), random-access memory (RAM), electrically erasable programmable read-only memory (EEPROM), etc., i.e., non-transitory/tangible machine memory of sufficient size and speed to execute a BC application 20 that may be activated on the user device 30 including, for example, one or more consumer user interfaces 90 and/or to perform mitigation actions 116, as further described herein. The input/output interface 128 of the user device 30 may include, for example, one or more of a keyboard and display, a touch screen, or a combination thereof configurable for output and/or display, for example, one or more consumer user interfaces 90 associated with one or more BC applications 20 and/or one or more institution applications 45 and/or for displaying content received by the user device 30 from the BC server 12, a reporting server 40, and/or a resource server 50, including, for example, web pages, images, information selected for output via the input/output interface 128, a consumer user interface 90, and/or an institution user interface 25 of the user device 30. Illustrative examples of consumer user interfaces 90 that may be generated and output from the BC system 100 are included in the Figures and shown as consumer user interfaces 90T, 90U, 90W, 90X and 90Z. These examples are not limitative and it should be understood that other configurations and/or arrangements of the risk outputs generated by the BC system 100 may be displayed through one or more consumer user interfaces 90 other than those shown in the Figures for illustration.

[0036] The system 100 may include one or more reporting servers 40 configured and/or operable to report information related to a data breach, which may include, for example, a breach descriptor 70 of the breached entity, such as a company name (e.g., “Equifax” or “Anthem”), breach event information including date(s) of the breach, information elements 68 breached and/or compromised by the breach (personally identifiable information (PII), protected health information (PHI), payment industry (PCI) card data, etc.), information related to the breaching entity (hacker, criminal, etc.), post-breach exposure and/or use of the breached data (availability for sale in online criminal marketplaces), etc. Each of the reporting servers 40 is administered and/or operated by a reporting entity that is reporting a breach event. The reporting entity administering a reporting server 40 may be, by way of example, a breached entity reporting information related to a breach of its own data, a regulatory or government organization configured to receive information from breached entities and/or report the information to victim consumers, a financial institution, a government organization, a healthcare organization, a retail entity, etc. reporting breaches of its respective data, etc. In one example, the reporting entity is an organization such as the Identity Theft Resource Center (ITRC) that maintains a database 36 of breach information. The BC system 100 collects breach event information, for example, via communication between the BC server 12 and one or more of the reporting servers 40, for use in generating the BC risk-related outputs described herein. In an illustrative example, the reporting server 40 includes a memory 32 and a central processing unit (CPU) 34. The memory 32 of the reporting server 40 may include, by way of example, Read Only Memory (ROM), Random Access Memory (RAM), Electrically Erasable Programmable Read Only Memory (EEPROM), etc., i.e., non-transitory/tangible machine memory of sufficient size and speed to store breach event information collected by the reporting entity relating to a breach event 70 in a reporting database 36. The memory 32 is of sufficient size and speed for the handling and communication of the breach event information by the reporting entity administering the reporting server 40. In an illustrative example, the BC server 12 receives breach information regarding a breach event 70 at the time the breach is initially reported and may continue to receive information periodically thereafter regarding the breach event 70, such that the breach information related to the breach event 70 may be periodically updated in data structure 22 as additional breach information is learned and/or becomes available. The BC server 12 may continue to monitor and/or receive breach information periodically after the occurrence of each specific breach event 70, relating to the observed availability of the breached data (for that specific breach event 70) on unauthorized websites, e.g., in unauthorized circulation. In one example, the BC server 12 receives breach information regarding the observed availability of the breached data on “DARK” websites, on the darknet, also referred to herein as the DARK WEB 202, or otherwise through other sources, including non-network locations, including, e.g., the availability of the breached data for sale or other distribution for unauthorized uses. The BC server 12 and/or algorithms 10, in response to the breach information regarding the observed availability of the breached data, may, for example, modify the exposure classification 132, reclassify the mitigation actions 116, and/or modify the probability of harm, for example, the risk distribution 134 of the risks associated with that particular breach event 70.

[0037] The report server 40 includes a report interface 38, which in an illustrative example may be configured as a modem, browser, or similar means suitable for accessing a network 130. In one example, the BC server 12 collects breach event information from one or more report servers 40 via the network 130 and stores the collected breach event information within the BC memory 16 and/or data structure 22 for use in generating BC risk related outputs using BC algorithms 10 and/or applications 20. The BC Breach Intelligence Network including the BC data structure 22 may include one or more data mapping tables, functions, and/or applications BC 20 for mediating the import of data from a report server 40 and/or reporting database 36, including applications BC 20 for mapping data fields from a specific reporting database 40 to corresponding fields in the BC data structure 22. The BC Breach Intelligence Network and/or the BC data structure The BC data structure 22 may include a plurality of data mapping applications, wherein each application may be configured for a specific reporting database 36, to improve the efficiency and effectiveness of importing and consolidating data into the BC data structure 22 from multiple reporting databases 36 administered by multiple reporting entities. For example, the BC data structure 22 may include a first data mapping application for mediating the import of data from a first reporting database 36 administered by a government regulatory agency that receives reports of data breach events 70 from various types of organizations (banks, brokerages, etc.) in the financial sector, a second data mapping application for mediating the import of data from a retail entity that has experienced a data breach event 70, a third data mapping application for mediating the import of breached data reported by an individual consumer, a fourth data mapping application for mediating the import of breached data reported by a medical institution, and so on. As such, the BC data structure 22 and the BC methods for generating risk results provide a standardized database of breach information and an efficient, standardized approach for quantifying the risks and harms 72 to a victim consumer associated with a data breach event 70, for that breach event 70, and relative to other breach events 70.

[0038] The system 100 may include one or more resource servers 50 configured to provide resources, including mitigation actions 116 (see Figure 8), to consumers who are victims of a data breach. Each of the resource servers 50 is administered and/or operated by a resource provider, which may also be referred to herein as an institution. A resource provider may be, by way of non-limiting example, a financial institution such as a bank or brokerage institution that provides a notification service to a consumer victim subject to a breach of the financial institution's customer information, a credit bureau or similar institution that monitors the consumer victim's account for fraud and/or identity theft, a provider of identity protection software, and/or the breached entity, e.g., to change a password or other breached information such as a payment card account number, etc. In one example, the resource provider/institution is a sponsoring entity 23 that may be integrated into the BC 100 system through either or both BC Premium and/or BC Professional. In an illustrative example, the resource server 50 includes a memory 42 and a central processing unit (CPU) 44. The memory 42 of the resource server 50 may include, by way of example, Read Only Memory (ROM), Random Access Memory (RAM), Electrically Erasable Programmable Read Only Memory (EEPROM), etc., i.e., non-transitory/tangible machine memory of sufficient size and speed to provide resource services, which may include mitigation actions 16, related to the breach event and/or breached information, which may be stored and/or accessed via a resource database 46. The resource server 50 includes a resource interface 48, which in an illustrative example may be configured as a modem, browser, website, or similar means suitable for accessing a network 130. In an illustrative example, the resource server 50 may be accessed via a consumer user interface 90 provided by the BC system to a user device. consumer-victim 30, to activate a mitigation action 116. In one example, the resource server 50 and the BC server 12 are connected via one or more application programming interfaces (APIs) 43, 24, respectively, such that one or more mitigation actions 116 may be automatically activated on a consumer's accounts based on breach status information and preferences of the consumer and/or the resource provider, and/or breach data from the BC server 10 and/or customer data from the institution 23. By way of illustration, the resource server 50 may be an administrator of a specific consumer account, such as a financial, healthcare, or other account including sensitive and/or private information (PII), wherein the administrative functions of the resource server 60 include customizing consumer-specific account alerts, limit thresholds for transfers and other activities, etc., based on input and/or preferences of the consumer and/or resource provider. The BC server 12, in the present example, may be integrated with the resource server 50, e.g., a banking institution or healthcare provider, such that consumer-specific account settings may be automatically configured based on the consumer's risk profile determined by the BC server 12. In one example, the integration of the BC server 12 with the resource server 50 for consumer-specific account customization may occur during a subscription process, during which the consumer subscribes to the BC system 100 and authorizes the integration and automatic updating of the resource provider's consumer-specific account settings by the BC server 12 based on the subscriber-consumer's BC risk profile. As changes occur in the consumer's risk profile on the BC server 12 over time, for example, when a consumer becomes a victim of a breach event 70 for which a harm 72 and/or a mitigation action 116 is identified by the BC system 100 related to the specific consumer account administered by the resource server 50 and integrated with the BC server 12, the BC server 12 via the integration API automatically changes settings on the specific consumer account, for example, to review alert settings, change authorization limits, notify the integrated resource provider of breach information potentially affecting the specific consumer account administered by the resource server 50, etc.

[0039] In another illustrative example, resource server 50 may incorporate a third party source of breach status information or other details, such as IDtheftcenter.org, a credit reporting agency, an activity monitoring system for monitoring online activity related to a consumer's online accounts, email addresses, etc., such as the website www.haveIbeenpwned.com, a breached entity's own website established for a consumer to obtain breach information from that breached entity, such as the website https://trustedidpremier.com/eligibility/eligibility.html established for victims of the Equifax breach event. In this example, the resource server 50 may be integrated with the BC server 12, via an API or similar system, such that the resource server 50 may automatically provide breach information to the BC server 12. In one example, the BC system 100 is operable and/or configured such that, when breach information related to a specific consumer account is received by the BC server 12 from an integrated resource server 50, the BC server 12 updates the consumer's BC risk profile, including recommended mitigation actions 116, exposure ratings 132, and the like, and automatically provides notifications to the affected consumer.

[0040] In the example shown in Figure 1, the BC server 12, the user device(s) 30, the report server(s) 40, and the resource server(s) 50 may selectively communicate with each other over a network 130, which in an illustrative example may be the Internet. In the example shown, one or more of the email service provider servers 87, payment service provider servers 89, DARK WEB service provider servers 11 may be in communication with the Internet and, as such, may selectively communicate via network 130 with one or more of the BC server 12, user device(s) 30, reporting server(s) 40, and resource server(s) 50. In a non-limiting example, the DARK WEB service provider server 11 selectively communicates with, monitors, and/or accesses one or more dark web sites 202, via network 130, to retrieve information, including breach event information, from one or more of the DARK WEBSITES sites 202. The dark web sites 202 may be referred to individually or collectively herein as the DARK WEB 202 and/or as the Darknet.

[0041] The example shown in Figure 1 is not limiting, such that one or more of the BC server 12, user device 30, reporting server 40, resource server 50, email service provider server 87, payment service provider server 89, and/or DARK WEB service provider server 11 could be selectively connected directly, e.g., for direct access to each other and/or for off-network data communication between one or more of the BC server 12, user device 30, reporting server 40, resource server 50. The example shown in Figure 1 is not limiting, such that a victim consumer could contact a BC provider, e.g., contact center, that has access to the BC server 12 using means other than a user device 30, e.g., using one or more of personal contacts, telephone, fax, short message service (SMS), multimedia messaging service (MMS), written (outgoing) mail, etc., to obtain the risk services and outputs provided by the BC system 100 and/or BC server 12. Similarly, a victim consumer may contact a resource provider with access to resource server 50 to obtain resource services that may include taking one or more mitigation actions 116 and/or may contact a reporting provider with access to reporting server 40 to obtain reporting services that may include determining whether the consumer has been the victim of a data breach event and/or reporting a data breach event, using a user device 30 and/or means such as one or more personal contacts, telephone, fax, short message service (SMS), multimedia messaging service (MMS), written correspondence (mail), etc. In one example, one or more of the services provided by the report server 40 and/or the resource server 50 may be integrated with the consumer's BC risk profiles and/or the BC server 12, via an API, etc., such that the consumer may receive notifications via the BC server 12 and/or the BC system 100 and/or access information from the report server 40 and/or the resource server 50 via the BC server 12 and/or the BC system 100, including notifications of breach activity including breach events 70, prompts to activate mitigation actions 116, changes in observed activity including, for example, fraudulent transactions, unauthorized distribution of breached consumer information, etc. For example, reporting an occurrence of a specific type of harm on a specific consumer account by a reporting provider to the BC system 100, such as a fraudulent transaction on the consumer account, for example, through integration of the reporting server 40 with the BC server 12, could trigger a review by the BC server 12 of the consumer's BC risk profile. The BC server 12, using the additional information, may apply algorithms 10 to update the consumer's mitigation actions 116 and/or ratings of those mitigation actions 116 and may issue notifications to the consumer and/or to a resource server 50 or resource provider associated with and/or potentially affected by the reported occurrence. The BC system 100 may be operable in real-time, such that, in real-time upon identification of a breach event 70 impacting a consumer, the BC system 100 may generate and issue a breach notification to the consumer(s) impacted by the breach event 70, via a consumer interface, such as BC Freemium and/or BC Premium, and/or via an institution user interface 90, such as BC Professional or a sponsoring institution interface 25. For example, the occurrence of a fraudulent in-store payment card transaction using breached codes stored on the magnetic stripe of a consumer’s payment card and reported via a reporting server 40 to the BC server 12, may initiate a review by the BC server 12 of the consumer’s exposure classification 132 and/or mitigation actions 116, including issuing a notification to a resource server 50 of a resource provider, such as the payment card issuer, to modify fraud alerts and/or authorization requirements for transactions at the store where the consumer payment card is presented for use. The payment card issuer may provide a fraud alert notification to the affected consumer or, in one example, the BC server 12 may be operable to generate and issue a fraud alert notification to the affected consumer. In another example, the BC system 100 may issue a mitigation action 116 and/or provide a notification or alert to a consumer victim of a breach event 70 that includes their telephone number and/or email address as breached information elements 68, to advise the victim consumer that they are at increased risk of receiving phone calls or emails from identity theft.

[0042] Referring to Figures 1 and 2, Figure 2 is a flowchart 105 illustrating a high-level overview of a method by which a consumer accesses the Breach Clarity™ system 100 and BC processes using the BC Premium application. In the example shown, the consumer at 107 accesses a BC Premium interface and creates a BC account, which includes, for example, creating a BC account name such that the consumer is identifiable in the BC Breach Intelligence Network with the BC account name. The consumer at 107 may also provide consumer profile information that may include personally identifiable information (PII) at 107, to be used by the BC system 100 to create a consumer breach history profile 57, also referred to herein as My Breach Clarity History profile. In one example, the consumer may be prompted to create a password or provide other authentication information to access the consumer's BC account. The consumer at 107 may access the BC Premium interface directly, or through a BC portal 29 integrated with the interface of the sponsoring institution 23. In a non-limiting example, the consumer may be a customer of the sponsoring institution 23, and the creation of the account at 107 may include the association of the consumer's BC account name and with information that identifies the consumer as a customer of the institution, for example, via BC professional APIs and/or via BC and/or institution made available for this purpose.

[0043] At 109 and 111, the registered consumer may be prompted, via a BC Premium interface 90, to provide account information related to one or more electronic transaction accounts associated with the registered consumer and/or provide access via the BC system 100 to one or more electronic transaction accounts associated with the consumer, for example, by providing account access credentials and/or by executing or installing a plug-in or widget to enable retrieval of electronic transaction data by the BC server 12 from the transaction account. In an illustrative example, the electronic transaction account is configured to execute a consumer transaction between the consumer and a consumer transaction party. Electronic transaction information associated with the consumer transaction is generated through the electronic transaction account and retrieved through network 130, wherein, in an illustrative example, the electronic transaction information includes a consumer identifier corresponding to the consumer, a party identifier corresponding to the party, and a transaction time corresponding to the time the consumer transaction was executed through the electronic transaction account.

[0044] In one example, the consumer profile information includes account credentials corresponding to the electronic transaction account, and the method includes accessing the electronic transaction account using the account credentials. The account credentials may include one or more of an account identifier, such as an account number or account name, an account password, an account authentication code, etc., as necessary for the breach system 100 and/or the BC server 12 to access the electronic transaction account and/or retrieve electronic transaction information from the electronic transaction account. In one example, accessing the electronic transaction account includes receiving, via the network, a plug-in for accessing the electronic transaction account and executing the plug-in to transmit the transaction account information over the network, such that the electronic transaction information is retrieved from the account via the account plug-in.

[0045] In an illustrative example, the electronic transaction account is an electronic mail (e-mail) account, the consumer transaction is an e-mail transaction between an e-mail sender and an e-mail recipient, and the consumer transaction party is one of the e-mail senders and the e-mail recipient, and comparing the electronic transaction information to the breach information includes determining a match between the breach information of the respective data breach and at least one e-mail sender or e-mail recipient. In one example, the consumer identifier is an e-mail address associated with the consumer. The e-mail account may be provided to the consumer and serviced by an e-mail hosting service provider, which may also be referred to herein as an e-mail hosting provider, a webmail provider, or an e-mail provider, and, for example, via an e-mail server 87 administered and/or operated by the e-mail provider. Non-limiting examples of email service providers include Gmail, Outlook, Yahoo!, AOL Mail, and the like, and may further include non-public email service providers. As shown in Figure 1, a consumer email account holder may access an email provider server 87 via consumer user device 30 via network 130. Email server 87, in an illustrative example, includes a central processing unit (CPU) 141 and memory 143. Memory 143 of email server 87 may include, by way of example, Read Only Memory (ROM), Random Access Memory (RAM), Electrically Erasable Programmable Read Only Memory (EEPROM), etc., i.e., non-transitory/tangible machine memory of sufficient size and speed to store a database 161 and to store algorithms, APIs, plugins, widgets, etc. as needed to provide email hosting services. The email server 87 includes an email interface 163, which in an illustrative example may be configured as a modem, browser, or similar means suitable for accessing a network 130. In one example, a consumer may access the consumer's email account and/or other email service provider services through a user device 30 in communication with the email server 87 over the network 130.

[0046] Referring to Figure 2, at step 109, the consumer may be requested, via the BC Premium interface, to provide access to the consumer's email account to the BC server 12 to retrieve electronic transaction account information from the consumer's email account. In one example, the consumer provides login credentials, e.g., the consumer's email address and account password, to the BC server 12 for use by the BC server 12 in retrieving electronic transaction information from the consumer's email account. In one example, a plug-in for accessing the email account is provided such that the BC server 12 can retrieve electronic transaction information from the consumer's email account by executing the plug-in.

[0047] In use, the email plug-in provides, for email transactions occurring through the consumer's email account, e.g., for each email sent or received from the account, the name and/or email address of the email recipient, the name and/or email address of the email sender, and the date the email was received or sent. Additional transaction information, such as the time of day the email was received or sent, may also be retrieved. If the consumer has more than one email account, the process of registering for the consumer's email account to retrieve email transaction information from the email account may be repeated for each of the consumer's email accounts.

[0048] Once registered, the BC server 12 continuously or at predetermined intervals, e.g., hourly, daily, weekly, retrieves email transaction information from the consumer's registered email account(s) and compares the email transaction information to a database of publicly reported breach events 70 and/or to other data breach information collected in the Breach Intelligence Network and/or data structure 22, to match the email transaction with breach information from a breach event 70, e.g., by matching the names of senders and/or recipients with the name of a breached organization and the dates of emails with date ranges known to be associated with compromised data in each breach event 70. When a match is determined, the corresponding breach event 70 is then processed through the BC algorithm and assigned a BC score 80, and the consumer's My Breach Clarity History profile is appended with the corresponding breach event information in step 22. 121. At 123, a notification may be generated and transmitted to the consumer to inform them of changes and updates to My Breach Clarity History, including reminders to complete mitigation actions 116 associated with the corresponding breach event 70.

[0049] In an illustrative example, the electronic transaction account is an electronic payment account, the consumer transaction is an electronic payment transaction between a payer and a payee, and the consumer transaction party is one between the payer and the payee, such that comparing the electronic transaction information with the breach information includes determining a match between the breach information of the respective data breach and at least one of the payer and the payee. In one example, the consumer identifier is a payment account number associated with the consumer, which may be a payment card number.

[0050] The payment account may be made available to the consumer and administered by a payment service provider, which may also be referred to herein as a payment processor, and which may be, for example, an issuing bank from which the consumer's payment card (Mastercard, Visa, etc.) was issued, a third party online payment provider/processor, such as PayPal, Square, etc., via a payment server 89 administered and/or operated by the payment service provider. As shown in Figure 1, the consumer electronic payment account holder may access the payment provider server 89 through the consumer user device 30, over the network 130. The payment provider server 89, in an illustrative example, includes a central processing unit (CPU) 171 and a memory 173. The memory 173 of the payment provider server 89 may include, by way of example, Read Only Memory (ROM), Random Access Memory (RAM), Electrically Erasable Programmable Read Only Memory (EEPROM), etc., i.e., non-transitory/tangible machine memory of sufficient size and speed to store a database 201 and to store algorithms, APIs, plug-ins, widgets, etc. as needed to provide electronic payment transaction services. The payment provider server 89 includes a payment transaction interface 203, which in an illustrative example may be configured as a modem, browser, or similar means suitable for accessing a network 130. In one example, a consumer may access the consumer's payment transaction account and/or other services of the payment service provider through a user device 30 in communication with the payment provider server 89 over the network 130.

[0051] Referring to Figure 2, at step 111, the consumer may be requested, via the BC Premium interface, to provide access to the consumer's payment account to the BC server 12 to retrieve electronic transaction account information, including bill payment and card transaction data, from the consumer's payment account. In one example, the consumer provides login credentials, e.g., the consumer's account number and account password, to the BC server 12, for use by the BC server 12 in retrieving payment transaction information from the consumer's payment account. In one example, a plug-in, widget, or other software-based solution for accessing the payment account is provided to the payment provider server 89 so that the BC server 12 can retrieve payment transaction information from the consumer's payment account by executing the plug-in. In one example, APIs and/or software code that is specific to the payment provider may be provided by the BC server 12 to the payment provider server 89 for use in accessing the consumer's payment account information.

[0052] In use, the BC server 12 retrieves and/or receives payment transaction information from the consumer's payment account, including transactions in which the paying consumer made payments, and analyzes users' payment histories to identify organizations in which a payment was processed in a period of time, comparing the names of those organizations with those associated with a breach event 70 in the data structure 22 and/or the Breach Intelligence Network, and comparing the dates of those payments with the dates on which those organizations experienced a data breach event 70, to identify whether the consumer was also using a payment account provided by the organization at the time the identified breach event 70 occurred.

[0053] If the consumer has more than one payment account, the process of registering the consumer's payment account to retrieve payment transaction information from the payment account may be repeated for each of the consumer's payment accounts. As described for step 209, in step 111, once registered, the BC server 12 continuously or at predetermined intervals, e.g., hourly, daily, weekly, retrieves payment transaction information from the consumer's registered payment account(s) and compares the payment transaction information to a database of publicly reported breach events 70 and/or to other data breach information collected in the Breach Intelligence Network and/or data structure 22, to match the payment transaction to breach information from a breach event 70, e.g., by matching the names of payees to the name of a breached organization and the dates of payment transactions to date ranges known to be associated with compromised data in each breach event 70. When a match is determined, the corresponding breach event 70 is then processed through the BC algorithm and assigned a BC score 80, and the consumer's My Breach Clarity History profile is appended with the corresponding breach event information in step 112. 121. One or more mitigation actions related to breach event 70 may be identified for completion by the consumer related to the consumer's payment account, including, for example, changing an account password, changing an account number, implementing transaction limits and/or alerts, etc. In one example, where payment provider 89 is also the subscribing institution through which the consumer accessed BC Premium, the mitigation actions suggested to the consumer may be communicated to the consumer through the subscribing institution's website and/or through the BC Premium link accessible through the subscribing institution's website, to facilitate consumer access and encourage timely completion of mitigation action 116 by the consumer. At 123, a notification may be generated and transmitted to the consumer to inform of changes and updates to the consumer's My Breach Clarity History, including reminders to complete the mitigation actions 116 associated with the corresponding breach event 70.

[0054] At 113, the registered consumer accesses the BC Premium interfaces 90 to, for example, search for breach information related to one or more breach events 70 of interest to the consumer and/or by which the consumer has been victimized. At 115, a My Breach Clarity History profile 57 may be generated for the registered consumer, listing the breach events 70 associated with the consumer in the Breach Intelligence Network and/or BC data structure 22. In one example, the consumer at 115 may input breach information through a BC Premium interface 90, to be added to the consumer's My Breach Clarity History as a breach event reported by the consumer.

[0055] At 117, additional information related to the violation, including, for example, an ordered list of mitigation actions 116 that are recommended to the consumer based on the consumer's violation profile 57, may be displayed to the consumer. In one example a <<describe Consumer Identity Roadmap 218>> may be generated at 117. In one example, the mitigation actions 116 may be linked via an interface element 118, URL, etc., to a resource provider 50, to facilitate the consumer's adoption and/or execution of the recommended mitigation actions 116. In the example of a sponsored enrollment, one or more of the mitigation actions 116 may be linked via an institution link 31 to the sponsoring institution 23, for activation of the mitigation action 116 via the sponsoring institution 23, as shown in a non-limiting example in Figures 11-17. The BC system at 121 updates the Breach Intelligence Network in real-time, which may include updating the consumer’s My Breach Clarity History based on breach information received at the BC system 100, which may include breach event information, mitigation action completion status, and/or consumer transaction information, such as email and payment transaction information. At 123, a notification may be generated and transmitted to the consumer to inform them of changes and updates to the consumer’s My Breach Clarity History, including reminders to complete mitigation actions 116 and updates to the consumer’s identity roadmap 218. The method returns to 109 on an ongoing basis, e.g., each time the enrolled consumer accesses the BC Premium application 90, each time the Breach Intelligence Network receives additional breach event information, consumer transaction information, and/or revised mitigation action status, and/or on a set frequency, e.g., daily, weekly, etc.

[0056] Figures 7-17 provide illustrative examples of a consumer interaction with the BC Freemium and BC Premium applications. Figure 7 illustrates an exemplary consumer user interface 90, 90T of the BC Freemium application that may be accessed from the BC interface 18, for example, via a user device 30 and the network 130. The BC interface 90T includes a violation input field 124 for inputting a violation identifier 70 of a violation event for which the consumer is seeking additional information. In the example shown in Figure 8, the consumer inputs "equifax" as the violation identifier 70, and in response, the BC system 100 issues five violation events 70A, 70B, 70C, 70D, 70E that are associated in the BC data structure 22 with the violation identifier "equifax." The consumer selects violation event 70B and, in response, the BC Freemium application outputs the exemplary user interface shown in Figure 9, which provides the consumer with a violation clarity score 80 of “4” out of “10” for the overall risk level assigned to violation event 70B, wherein the violation clarity score 80 may be displayed in a graphical representation, herein for example color-coded on a yellow-orange-red spectrum, based on the magnitude and/or risk associated with the BC score of “4” displayed for the selected violation event 70B. A consolidated risk distribution 134 may also be displayed, which in the present example is configured as a segmented annular ring color coded in a Yellow-Orange-Red spectrum to illustrate the relative severity of the top risks 72 displayed in ordered order adjacent to the consolidated risk distribution 134. Also included in the breach information interface 90T shown in Figure 19 is a listing of the likely exposed records and/or personal information elements 68 compromised by the breach event 70B.

[0057] The breach information interface 90T further includes a list of recommended mitigation actions 116, which may also be ordered according to the nominal effectiveness in mitigating damages of the selected breach event 70B. One or more of the mitigation actions 116 may be associated with or linked to a user interface element 118 that, when selected, directs the user to a resource interface for triggering the recommended mitigation action 116. Referring again to Figure 9 , the breach information interface 90T may further include an input field 21 for searching for an institution with which the consumer is associated. In an illustrative example shown in Figure 10 , the consumer enters the name of the consumer’s financial institution, “Giant Bank,” into input field 21. The BC system 100 seeks to determine whether the financial institution “Giant Bank” is a sponsoring institution 23, e.g., is an institution that has signed up for BC Premium to offer the BC Premium application to its customer population. Upon determining that “Giant Bank” is a sponsoring institution 23, the consumer is directed to an institution user interface 25, 25A of the sponsoring institution 23, as shown in Figure 11. In the example shown in Figure 11 , the consumer, in this example “Bob Jones,” also a customer of “Giant Bank,” enters login information into input field 27, and is directed to an institution interface 25, 25B that displays a summary of the consumer/client account of Jones. Included in the interface of institution 25B is a Breach Clarity portal 29 that provides direct access from the interface of institution 25B to the BC Premium application, sponsored by institution 23. In the example shown in Figure 12, the customer again enters the breach identifier 70 "Equifax" into the breach input field 134 and, in this case, is directed to a display of BC Premium breach information 90, 90W, which in this example is displayed in the interface of institution 25C. The BC Premium 90W breach information display includes additional information compared to the BC Freemium 90T breach information display shown in Figure 10, including, for example, extended lists of risks 72 and mitigation actions 116. The interface 25C includes an interface element 37 for switching between the screens shown in Figures 13 and 14, for example, to display additional breach information, such as the listing of compromised information elements 68 shown in Figure 14. The BC Premium 90W information display may additionally include interface elements 33, 35, which may be activated by the consumer/client to save the displayed breach event 70B to the consumer/client's breach history profile 57 (see Figure 17) by activating interface element 33 to "Save Record" and/or to view the consumer/client's breach history profile 57 by activating interface element 35.

[0058] In the examples shown in Figures 14, 14, 33 and 34, one or more of the mitigation actions 116 may be associated with an institution interface element 31, which when activated by the consumer/client directs the consumer/client to an exemplary institution interface 25D shown in Figure 15, configured such that the consumer/client may immediately determine whether the linked mitigation actions have been completed and/or activate the recommended mitigation actions, via interface elements 31A, 31B, 31C in the illustrative example. The institution interface 25D may display additional information and/or interface elements 31, 31D that may be activated to provide additional mitigation information and/or resources to the consumer/client. Conveniently linking the activation interfaces 31 for the mitigation actions 116 to the breach information display 90W allows the consumer/client to activate the mitigation actions 116 without having to seek out additional resources, e.g., without having to leave the institution's interface 25. In this way, the rate of adoption of the mitigation actions by the consumer/client is likely to increase, thereby decreasing the risk of harm to the consumer/client and the sponsoring institution 23.

[0059] Furthermore, by providing convenient access to the BC Premium interface 90 within the consumer/client's institution interface 25, the consumer/client can quickly search for other breach events that have impacted the consumer/client and add them to the consumer/client's breach history profile 57. In the example shown in Figures 16 and 17, the consumer/client enters the breach identifier 70F “hino” into the breach search input field 124, and in response, the breach information display 90X is generated by BR Premium and displayed in the institution interface 25C for viewing by the consumer/client. The consumer/client can conveniently activate the interface elements 35 and/or 33 to determine whether the Hino breach event 70F has been added to the consumer/client's breach history profile 57, and if not, can immediately complete this action. As described for Figure 14, a ranked list of mitigation actions 116 is provided for the breach event 70F shown in Figure 16, including interface elements 31 that link these mitigation actions to an institution interface 25B. Notably, the mitigation actions 116 identified for breach event 70F and for breach event 70B may be different, such that when viewing the second surveyed breach event 70F, the consumer/client may activate interfaces 31 for any mitigation actions 116 that have not previously been adopted by the consumer/client, to conveniently and expeditiously implement these new mitigation actions 116, thereby reducing the risk of harm to the consumer/client and the sponsoring entity 23.

[0060] Referring now to Figure 3, there is shown a flowchart 125 illustrating an overview of a method by which an institution accesses and/or uses the BC Professional application described herein and illustrated in use in exemplary Figures 28-42. In one example, the BC Professional application is configured as an application platform including one or more of the BreachFeed, Build-a-Breach, breach research, consumer research, and fraud risk profiling and analytics applications described herein, and provides access to an institution's breach histories of the institution's consumer population residing in the BC data structures 22 and/or the Breach Intelligence Network of the BC system 100. The BC Professional application is configured for use by an institution 23, such as a financial institution, to assess the risk to the institution 23 and the institution's customer population resulting from breach events 70 that have impacted the institution's customer population and, because of the breach of the customers' personal information, also pose a risk to the institution in the form of fraud at the institution. account takeover, etc. Referring to Figures 1 and 3, in a method 125 shown in Figure 3, implementation of the BC Professional platform by an institution 23 may include, at 127, installing one or more BC APIs 24 installed on BC server 12 and installing one or more institution APIs 43 installed on institution server 50, wherein the APIs 24, 43 are configured to enable data exchange between BC breach information data structures 22 and/or Breach Intelligence Network and an institution database 46 populated by customer information, including, for example, customer personally identifiable information (PII), payment card industry (PCI) data, etc.

[0061] Method 125 at 129 and with reference to Figure 18 includes an institution user entering login credentials 61 into a BC Professional interface 59, 59A to authenticate an institution user 101 to the BC Professional platform. As shown at 42, the BC Professional platform may include an administrative interface 59H for use by the institution in managing access rights and account types 103 for the various institution users with access to the BC Professional platform. For example, an institution user may be assigned a “user” account type 103 that allows viewing and searching of information available on the BC Professional platform, but prohibits modification of the data. An “admin” account type 103 may allow the admin user to modify and/or manipulate data within the BC Professional platform including, for example, modifying information within a customer’s breach history profile and/or taking actions to modify customer controls, security levels, etc. based on the customer's risk profile, etc.

[0062] Once authenticated to the BC Professional platform, the BC Professional platform, in the example illustrated in Figure 19-21 and at 131 in method 125 illustrated in Figure 3, displays to the institution user an overview of breach activity that has occurred in a selected or specified reporting period, e.g., the week prior to the time the institution user accesses the system at 129. The overview and information displayed in the BC Professional interface 59B may be referred to herein as a BreachFeed, as it generates and displays a real-time breach data feed to the institution user. The BreachFeed application may accumulate and consolidate breach information from one or more sources, including the BC Breach Intelligence Network, breach reporting sources 36, 40, the institution's customer information database 46, DARK WEB reporting sources, etc. In the illustrative examples shown in Figures 19-21, the information displayed in the BreachFeed interface 59B may include an activity summary 69 of the breach activity that was reported in the specified reporting period. The activity summary 69 may include absolute data, e.g., the number of breach events reported, the number of users affected, etc., and/or it may include relative data, e.g., a percentage change in the level of activity in the current reporting period compared to a prior reporting period. The BreachFeed interface 59B may further display breach exposure information 63 relative to the institution's customer population, including, e.g., the percentage of customers for whom breach activity was self-reported via BC Premium, the percentage of customers for whom breach activity was detected from DARK WEB intelligence, etc. In an example shown in Figures 19 and 20, the breach exposure 63 of the institution's customer population may be displayed, as shown in Figure 19, in a heat map or other color-based graphical display, or may be displayed, as shown in Figure 20, using bullseye charts to indicate areas of higher and lower exposure rates to data breaches. The BreachFeed interface 59B may display a credential exposure summary 65, which in the examples shown in Figures 19 and 21 may include a graphical risk distribution 134 of the harm descriptors 72 affecting the institution's customer population, which in the present example is shown as a segmented annular ring 134. The harm descriptors in the examples shown in Figures 19 and 21 are shown in relative incident ranking, e.g., associated with the percentage of total harm descriptors affecting the institution's customer population. In another example shown in Figure 20, the credential exposure summary 65 may be configured to show absolute incidents of credential breaches, which in Figure 20 is displayed as a bar graph showing the incident rate at which each of the credentials shown along the horizontal axis was breached within the specified reporting period, indicated in this example as a one-year reporting period. The BreachFeed interface 59B may include a breach listing 67 of recently reported breach events 70 within the specified reporting period. In one example, a BC score 80 indicating an overall risk rating of each of the listed breach events 70 may be displayed in breach listing 67. In one example, the BreachFeed interface 59B may include a thumbnail display 71 of selected data breach events 70, which may be selected for display by the institution user as breach events 70 that the institution user is monitoring, which may be selected due to substantial changes in the risk assessment of the thumbnail breach event 70 during the reporting period, and/or which may be selected using other criteria selected by the institution, e.g., the breach events 70 that impacted the greatest number of the institution's customers. In a non-limiting example, the BreachFeed interface 59B is displayed in real time, such that the information displayed is current at the time viewed by the institution user.

[0063] The method 125 at 133 may include the institution user conducting a breach search to generate an exemplary breach search report shown in a BC Professional interface 59C displayed in Figure 22 , wherein the breach search report interface 59C may include, for example, the overall risk score, also referred to herein as the BC score 80, or the breach event being searched for, a listing of the harms 72 that have been associated in the Breach Intelligence Network with the searched breach event, a list of mitigation actions 116 recommended for implementation to reduce the risk of harm from the searched breach event 70, wherein in the illustrative example the mitigation actions 116 may be classified between internal (institution-initiated) actions and external (customer-initiated) actions, and/or ranked or weighted by effectiveness in either or both groupings. The breach research report 59C may include an assessment of harm to the institution 73, which may display, for example, a list of potential sources of harm to the institution, which in the illustrative example shown in Figure 22 is a banking institution, and a quantitative parameter of each potential harm to the institution resulting from and/or attributable to the impact of the breach event on the institution's customer population. For example, the assessment of harm to the institution 73 may include the number of customers of the institution affected by the breach event 70 researched, the potential fraud losses to the institution estimated in dollars, and the number of fraud complaints against the institution, etc. The breach search report 59C may include a listing of affected customers 75 of the institution's customers who had information compromised by the researched breach event 70. The listing of affected customers 75 may report, for example, for each affected customer, the method by which the breach of the customer's information was identified, whether fraud was detected in the use of that customer's breached data, and/or the percentage of mitigation actions 116 that that customer has implemented. The method 125 at 133 may include the BC Professional breach search application outputting the exemplary BC Professional interface 59D shown in Figure 23, which displays a summary 77 of the breach searches performed by the institution's user during a specified time period, such as the user's current BC Professional session or a history of recently viewed breach searches for the user's convenience in reviewing search results.

[0064] Referring to Figure 3 and Figures 24 and 25, the method 125 may include the institution user at 135 conducting one or more customer surveys, for example, to assess and/or analyze the customer's consumer risk profile 57 based on breach events 70 affecting the customer, the customer's implementation status of recommended mitigation actions 116, etc. As shown in Figure 24, a BC Professional interface 59E for conducting a customer survey may include a customer identifier field 81 for inputting an identifier 83 of a customer to be surveyed. In the illustrative example, the customer name "Bob Jones" is entered as the customer identifier, however, it is understood that the customer identifier may be any type of personally identifiable information associated in the institution's customer information database 46 with the customer to be searched, including, for example, a government-issued identification number, a customer account number, a customer telephone number, a customer email address, etc. The institution user may enter the customer identifier 83 of the customer to be searched, or alternatively, the customer may be selected from a list of customers 79 that may be displayed in the customer search interface 59E. In an illustrative example, the customer search results 85 for the customer "Bob Jones" are shown in Figure 25 in a customer profile display interface 59E. In the example shown, customer identifying information such as customer name, email address, phone number, and/or location is displayed, along with a list of breach events 70 associated with the surveyed customer. For each of the breach events that affected the surveyed customer, the breach event report, the source of communication, an indicator of fraud detection in the breached customer's usage, and a percentage of completion of mitigation action steps may be included in the customer survey results 85.

[0065] In a non-limiting example, the customer survey report generated at 135 using the BC Professional customer survey application illustrated in Figures 24 and 25 may be used in conjunction with the BreachedID application and method shown in Figure 4. Referring to Figure 4, there is shown an exemplary method 145 for executing the BreachedID application of the BC system 100, including, for example, at 147, an account-related request, e.g., a request for the institution to perform an action on a customer's account, is input to the institution by a requester. The requester may be the customer, a person representing themselves as the customer or making the request on the customer's behalf, or a person or entity other than the customer. The input method may include a request made via an email message, a phone message, a text or SMS message, or other form of input. The requested action may include, by way of example, a request to open an account, to modify transaction limits and/or authentication requirements on an account, to close and/or distribute assets from an account, and/or other account requests that, when made by an unauthorized requester or using compromised data, may be collectively referred to herein as an account takeover request. At 149, the institution receives the account-related request made at 147 and analyzes at 151 the request for one or more elements of identifying information provided by the requester, which may include, for example, a customer email address, customer telephone number, customer identification number, customer account number, customer payment card number, or other element of customer and/or account identifying information provided by the requester. At 153, the identifying information element(s) identified from the account-related request at 151 is/are submitted by the institution to the BreachedID application for analysis to assess the potential risk of the account-related request being a fraudulent request, e.g., an acquisition request or new account application. At 155, the BreachedID application, using one or more of the BC algorithms 10, breach information data from the BC data structures 22 and/or the BC Breach Intelligence Network, customer information data from the institution's customer information database 46, provided, e.g., via APIs 24, 43, generates a risk assessment assessment that is issued to the institution. At 157, the institution analyzes the risk assessment assessment generated by the BreachedID application and determines a response to the account-related request. At 159, the institution triggers the response to the account-related request.

[0066] In one example, at 155, the BreachedID application generates a risk assessment evaluation indicating that the risk that the account-related request is fraudulent and/or an account takeover request is low or minimal, based on, for example, a determination that the identifying information element provided by the requestor has not been demonstrated to be compromised by any of the breach events associated with the customer/account owner in the Breach Intelligence Network, such that at 157, the institution, upon receiving the BreachedID risk assessment, determines that the request is likely a bona fide request and, with 159 actions, the request is made on behalf of the customer.

[0067] In another example, at 155, the BreachedID application generates a risk assessment evaluation indicating that the risk that the account-related request is fraudulent and/or an account takeover request is high, based on, for example, a determination that the identifying information element provided by the requestor has been shown to be compromised by one or more breach events associated with the customer/account owner in the Breach Intelligence Network and has been used in the execution of one or more fraudulent actions causing harm to the customer, such that, at 157, the institution upon receipt of the BreachedID risk assessment determines that the request is likely a fraudulent or account takeover request and, at 159, denies the request. In such a case, at 159, the institution may initiate additional investigative actions to determine the source of the fraudulent request and/or refer the fraudulent request to the appropriate investigative and/or enforcement authorities.

[0068] In another example, at 155, the BreachedID application generates a risk assessment evaluation indicating the risk that the account-related request is fraudulent and/or an account takeover request is moderated, based on, for example, a determination that the identifying information element provided by the requestor has been shown to be compromised by at least one breach event associated with the customer/account owner in the Breach Intelligence Network, but has not been associated with the commission of fraudulent actions causing harm to the customer, such that at 157, the institution upon receiving the moderate risk assessment from BreachedID determines that the request may be a bona fide request and, at 159, initiates additional actions to authenticate the request as a bona fide account-related request. Additional actions initiated by the institution at 159 may include, for example, contacting the account owner directly to request confirmation of the request, requesting additional authentication information from the requestor, etc. The BreachedID application, when used by the institution through the BC Professional platform, advantageously allows for the scrutiny of data from an account-related request, prior to the implementation of the request, to prevent and/or reduce the occurrence of account usurpation or other fraud on a customer's account.

[0069] Referring again to Figure 3 and Figures 26-30, method 125 may further include the institution user at 137 using a Build-a-Breach application illustrated in example method 165 shown in Figure 5 and in a non-limiting example shown in Figures 26-30, to construct a breach event 70 that may be populated with one or more affected customers and saved, for example, to the Breach Intelligence Network, to capture and report on identified breach activity affecting one or more customers of the institution. Referring to method 165 and the example Build-a-Breach interface 59F shown in Figure 26, the Build-a-Breach process begins at 167 with the institution user activating the “Create New” interface element, selecting a breach type 47 associated with the breach event being constructed. For example, the breach event being created by the institution user may be a banking breach resulting from the unintentional unauthorized release of customer information to third parties by the institution. In a next step 169 illustrated by the Build-a-Breach interfaces 59F shown in Figures 27-29, the institution user selects from a list of information elements 68 those information elements that were compromised in the breach event being constructed and populates a selected information elements field 91 with the compromised information elements. The institution user at 171 then activates the “Calculate Breach” interface element to trigger the Build-a-Breach application to generate breach information for the constructed breach event 93, including, for example, a BC score 80 for the constructed breach event 93, a list of the top risks 72 associated with the constructed breach event 93, and a list of the top mitigation actions 116 recommended for implementation to mitigate the risks 72. At 173, the institution user inputs a breach identifier 70, for example, a breach name, for the constructed breach event 93 and uses interface elements 49 and 51, respectively, to associate the institution's affected customers with the constructed breach event 93 and to save the constructed breach event 93 to at least one of the institution's customer database 46 and the data structure 22 of the BC system 100.

[0070] In one example, the “Institution Built” breach event 70 created by the institution using the BC Professional platform’s Build-a-Breach application may be stored at step 173 in the Breach Intelligence Network and/or in data structure 22 of the BC system 100, such that other institutions accessing the Breach Intelligence Network through the BC Professional platform may access the “Institution Built” breach event. Similarly, breach events created by other institutions using the Build-a-Breach application may save such breach events in the Breach Intelligence Network, such that all institutions accessing the BC Breach Intelligence Network through the BC Professional platform may utilize the build breach events in assessing, managing, and mitigating risks and harms to their respective customer populations. In one example, the BC Professional platform and/or the BC Breach Intelligence Network may include a reporting feature through which an alert may be generated and sent to each institution that has access to the Breach Intelligence Network through BC Professional, to notify them when a breach event generated using the Build-a-Breach application has been reported to the Breach Intelligence Network.

[0071] In another example, still referring to Figure 5 and Figures 25-30, the Build-a-Breach application may be used to create a breach event using breach event data determined by and/or provided to the institution, wherein the breach event created by the institution may be input to, e.g., the BC Breach Intelligence Network. In another example, the Build-a-Breach application may be used to model a simulated breach event, e.g., to determine the risk potential associated with the simulated breach and use the risk and damage analysis and mitigation actions identified for the simulated breach to identify and implement preventative measures within the institution or for the benefit of the institution's customer base, to proactively prevent a breach event and/or implement mitigation actions in advance of a potential breach event.

[0072] Referring again to Figure 3 and Figure 31 , method 125 may include the BC Professional platform at 139 outputting results of an institution-related fraud analysis generated by a BC Professional fraud analysis application utilizing, for example, data available from the Breach Intelligence Network, data obtained from the institution's customer information database 46, for example via an API 43 , and/or data obtained from other data breach information reporting sources 36 , 40 . In an illustrative example, a fraud analysis reporting interface 59G is shown in Figure 31 and includes a fraud analysis summary 95. In the example shown, the fraud analysis summary 95 includes a fraud loss parameter 97 that reports dollar fraud losses incurred by the institution as a result of data breach events affecting the institution's customer population. The fraud loss parameter 97 is shown as both an absolute value and an average over time. The fraud analysis summary 95 further displays a loss parameter 99 that includes a listing of the institution's customer harmed by a specific risk, in the present example, an account takeover action perpetrated on the customer's account held by the institution. The fraud analysis summary 95 shown in Figure 31 is illustrative, for example, the institution user may have options in the fraud analysis application to select one or a grouping of breach events, one or a grouping of damages, one or a grouping of information elements, for analysis by the fraud analysis application to assess the impact of certain selected breach events, damages, information elements, or combinations thereof on the fraud incurred by the institution.

[0073] Figure 6 is a schematic illustration of a flowchart of an exemplary process 175 for integrated risk assessment and mitigation of data breach events using the BC system 100 of Figure 1. The process 175 includes at 177, receiving breach event information in the data structure 22 and/or the Breach Intelligence Network from various breach information sources, including, for example, from one or more reporting servers 40, resource servers 50, subscribing institutions, consumers, DARK WEB providers 202, email servers 87, and/or payment service providers 78.

[0074] At 179, the input breach information is normalized for storage in data structure 22, including, for example, inserting into data structure 22 a breach identifier (breach name) 70 for the breach event defined by the input breach information, inserting into data structure 22 one or more elements of information that were breached and associating them in data structure 22 with the breach identifier 70, and inserting into data structure 22 and associating with the breach identifier 70 in data structure 22 additional elements of the breach information, including, for example, dates of occurrence, consumer identifying information associated with the breached information, the type of breach, method of compromise, damages associated with the breach event, including, for example, incidents of unauthorized use, distribution, and/or sale of the breached information, etc.

[0075] At 181, for the breach event 70, the BC server 12 applies one or more algorithms 10 to associate particular risks and damages 72 with each of the breached information elements 68 and stores each information element-damage pair in data structure 22, associating the pair with the breach event 70. The BC further applies one or more algorithms 10 to calculate an element risk 74 for each information element-damage pair and stores the element risk 74 in data structure 22, as illustrated in the non-limiting example shown in Figure 36.

[0076] At 183, the BC server 12 applies one or more algorithms 10 to the accumulated element risks 74 identified for each information element-harm pair to generate, for each harm type 72, a harm risk 76, and to generate, for the breach event 70, using the accumulated harm risks 76 for all harm types associated with the specific breach event 70, an overall BC score 80, wherein the BC score 80 is normalized to provide a relative indicator of the consumer risk associated with the breach event 70.

[0077] At 185, the BC server 12 uses the harm risks 76 to classify the harms 72 associated with the breach event 70 and identifies mitigation actions 116 for the identified harms 72.

[0078] At 187, the BC server 12 applies one or more algorithms 10 to the identified mitigation actions 116 and harms 72 associated with the breach event 70 and, using other breach information, orders the mitigation actions 116 to identify the mitigation actions 116 that are likely to prevent the greatest harm, for notification to consumers impacted by the breach event 70.

[0079] At 189, the BC server 12 associates the breach event 70 in the data structure 22 with consumer breach profiles 57 (My Breach Clarity History profiles) of those consumers determined by the BC server 12 to be affected by the breach event 70. In one example, an identity roadmap 218 for the consumer is generated and/or updated to include prioritized mitigation actions 116 for the subject breach event 70. Example mitigation actions 116, including prevention and detection actions 116 that may be implemented through the BC System 100 described herein, are shown in Figure 35. The listing shown is illustrative and not limitative, such that additional mitigation actions 116 are anticipated within the scope of the description.

[0080] Method 175 further includes, at 191, notifying each consumer user affected by breach event 70 of the breach event via, for example, a BC Premium interface 90 or a sponsoring institution interface 25, wherein the consumer user may be a customer of sponsoring institution 50.

[0081] At 193, and referring to the examples shown in Figures 15, 33 and 34, an identity script 218 may be generated by the BC system 100 for the consumer subscriber, including a listing of the mitigation actions ordered by priority 116 for execution by the consumer subscriber. In the illustrative examples shown, at least some of the mitigation elements 31 may be activated, e.g., completed, by actuation of an interface element 31 associated in the display interface 90 with the mitigation action 116, as described previously herein.

[0082] The method 175 further includes, at 195, notifying each consumer subscriber of the mitigation actions 116 pending completion in the consumer identity script 218, by an electronic message transmitted to the consumer, e.g., as an email message, SMS, text message, or notification displayed on at least one of the BC interfaces 90 and/or the institution interface 25.

[0083] At 197, in response to the consumer's completion of a mediation action 116, the BC system 100 updates the consumer's identity script 218 including the list of mediation actions 116, to indicate the completion of the mediation action 116 or to remove the mediation action 116 from the listing 218 of mediation actions 116.

[0084] At 199, the process returns to step 177, either in response to receiving additional breach information, on an ongoing basis and/or at a predetermined interval, e.g., hourly, daily, weekly, etc.

[0085] Referring now to Figure 37, there is shown a schematic illustration of a flowchart 205 of an exemplary process 205 for generating an aggregated consumer identity risk score 216 for a consumer user of the BC system 100, wherein the aggregated consumer identity risk score, also referred to herein as Consumer Identity Score 216, is determined individually for each consumer based on the consumer's historical breach profile 57, the completion status of mitigation actions 116 recommended to the consumer based on the consumer's historical breach profile 57, and modified by the application of one or more algorithms 204, 206, 222, 224, 228 as described herein. By generating and providing the consumer with an individualized Consumer Identity Score 216, the consumer can monitor, over time, a quantified indicator of the consumer's identity risk, and can also observe the effect of mitigation actions 116 completed by the consumer on the consumer's identity risk, reflected, for example, as a reduction (improvement) in their Consumer Identity Score 216 as mitigation actions 116 are completed, when all other factors are constant. The consumer can also quickly assess the impact of new breach events 70 affecting the consumer by viewing the relative change in their Consumer Identity Score 216. As such, the Consumer Identity Score 216 provides an advantage to the consumer by consolidating a significant amount of breach information into a single identity risk indicator that the consumer can monitor as a measure of identity risk over time and in response to new breach events, and that the consumer can directly influence, e.g., improve, by completing mitigation actions 116 recommended to the consumer via the consumer's My Breach Clarity History profile 57 and/or included in the consumer's identity roadmap 218.

[0086] Referring to Figure 37, an illustrative example of a method 205 for generating a Consumer Identity Score 216 for an individual consumer is shown. At 210, the breach information from breach event 70 associated with the consumer breach history profile 57 in data structure 22 is compiled. At 215, a deprecation algorithm 204 is applied to the breach information to remove and/or modify elements of the breach information that should be devalued for purposes of generating the Consumer Identity Score 216. For example, a consumer account number that has been breached and is associated with an account that has been terminated or had the account number changed, may be deprecated and/or removed from the breach information because the risk of harm resulting from the breach of the consumer account number has been fully mitigated and/or estimated to be null. Similarly, aging factors may be applied to certain types of damage that are less likely to occur as time passes after the occurrence of the breach event. Other forms of information elements that are of limited longevity, for example, payment cards with a limited or expiring term, may be deprecated at step 215.

[0087] At 220, the stale breach information provided from 215 is combined with and/or modified by breach intelligence information 206, which may include, for example, information related to the type of breach, age of the breach, criminal activity associated with a breach event, and/or elements of breached consumer information, including, for example, the recent appearance of the consumer's breached credentials on a shady website, reported fraud on the consumer's accounts, etc., to supplement and/or modify the consumer's breach information for step 225.

[0088] In step 225, an algorithm 222 is applied to the breach information received from step 220 to manipulate the breach information using factors derived substantially in part from the consumer's breach history profile 57, including, in a non-limiting illustrative example, manipulating an information element risk vector 208 derived from the consumer's aggregate breached information elements 68 and a harm risk vector 214 derived from the aggregate harms 72 associated with the aggregate breached information elements 68, each of these vectors 208, 214, in a non-limiting example, modified by and/or including a breach frequency of each information element 68 and/or a harm exposure frequency of each harm 72, and/or further modified for cumulative effect of combinations of breached information elements 68 and/or harms 72, wherein the vectors 208, 214 are further manipulated by the application of mitigation action data 212, wherein the mitigation action data 212 is derived from the completion status of mitigation actions 116 recommended to the consumer, the relative ranking of the completed and incomplete mitigation actions 116 in impact on risk reduction, and the cumulative effects (interactions) of combinations of mitigation actions 116 in affecting the exposure to risk of one or more of the harms 72 associated with the consumer's violation history profile 57.

[0089] At 230, a scoring logic algorithm is applied to the output received from step 225 to generate a raw risk score 226. At 235, a normalization algorithm 228 is applied to the raw risk score 226 to normalize the raw risk score 226 to an index or scale, e.g., to normalize the raw risk score 226 to saturate on a scale of 100, to produce a normalized risk score 216. The normalized risk score 216 is also referred to herein as the consumer identity score 216. At step 240, the consumer identity score 216 may be reported to the consumer, e.g., via an electronic message or via one or more consumer BC interfaces 90, 25.

[0090] Process 205 returns to step 210, wherein the Consumer Identity Score 216 is regenerated, e.g., when a change in the consumer's historical breach profile is detected, when the consumer completes a mitigation action 116, at the consumer's request, or on a pre-determined frequency, e.g., daily, weekly, or monthly. In one example, the consumer's Consumer Identity Score 216 may be displayed over time via the consumer BC 90, 25 to provide a visual indicator of the trend (improving, deteriorating, constant) in the Consumer Identity Score 216, as a visual reminder to the consumer to complete mitigation actions 116, and/or to visually alert the consumer to changes in his or her identity risk exposure.

[0091] The detailed description and the drawings or Figures are supportive and descriptive of the description, but the scope of the description is defined only by the claims. Although some of the best modes and other embodiments for carrying out the claimed description have been described in detail, there are numerous alternative designs and embodiments for practicing the description set forth in the appended claims. Furthermore, the embodiments shown in the drawings or the features of several embodiments referred to in this description are not necessarily to be construed as independent embodiments of one another. Rather, it is possible that each of the features described in one of the examples of an embodiment may be combined with one or a plurality of other desired features of other embodiments, resulting in other embodiments not described in words or by reference to the drawings. Accordingly, such other embodiments are within the scope of the appended claims.

Claims (36)

1. A method for generating a consumer violation history profile of a consumer over an electronic network by means of a computer server, comprising: receiving, over a network, consumer profile information corresponding to a consumer; generating, in a database and using the consumer profile information, a consumer violation history profile; associating, in the database, the consumer violation history profile with the consumer profile information; accessing, over a network, an electronic transaction account associated with the consumer; wherein accessing the electronic transaction account includes: receiving, over the network, an account plug-in for accessing the electronic transaction account; executing, the account plug-in for transmitting the transaction account information over a network; and retrieving, via the account plug-in, electronic transaction information from the account; wherein the electronic transaction account is configured to execute a consumer transaction between the consumer and a consumer transaction party; generating, via the electronic transaction account, electronic transaction information associated with the consumer transaction; retrieving, via the network, the electronic transaction information; wherein the electronic transaction information includes: a consumer identifier corresponding to the consumer; a party identifier corresponding to the party; and a transaction time corresponding to the time at which the consumer transaction was executed; associating, in a database, the electronic transaction information with the consumer; wherein the database includes breach information corresponding to a plurality of data breaches; comparing the electronic transaction information with the breach information of the plurality of data breaches; wherein comparing the electronic transaction information includes: determining a match between the electronic transaction information and the breach information of a respective data breach; attaching the consumer breach history profile when a match is determined; and where attaching the consumer breach history profile includes: associating, in the database, the respective data breach with the consumer breach history profile. 2. The method of claim 1, wherein attaching the consumer violation history profile further includes: generating a violation notification to the consumer. 3. The method of claim 1, wherein the transaction time includes the date on which the consumer transaction occurred. 4. The method of claim 1, wherein the consumer profile information includes account credentials corresponding to the electronic transaction account; the method further comprising: accessing the electronic transaction account using the account credentials. 5. The method of claim 1, wherein: the electronic transaction account is an e-mail account; the consumer transaction is an e-mail transaction between an e-mail sender and an e-mail recipient; and the consumer transaction party is one of the e-mail sender and e-mail recipient. 6. The method of claim 5, wherein comparing the electronic transaction information with the breach information includes: determining a match between the breach information of the respective data breach and at least one of the email sender or email recipient. 7. The method of claim 5, wherein the consumer identifier is an email address associated with the consumer. 8. The method of claim 1, wherein: the electronic transaction account is an electronic payment account; the consumer transaction is an electronic payment transaction between a payer and a payee; and the consumer transaction party is one of the payer and the payee. 9. The method of claim 8, wherein comparing the electronic transaction information with the breach information includes: determining a match between the breach information of the respective data breach and at least one of the payer and the payee. 10. The method of claim 8, wherein the consumer identifier is a payment account number associated with the consumer. 11. The method of claim 10, wherein the payment account number is a payment card number. 12. A method for generating a consumer violation history profile of a consumer over an electronic network by means of a computer server, comprising: receiving, over a network, consumer profile information including at least one consumer information element corresponding to the consumer; generating, in a database and using the consumer profile information, a consumer violation history profile; associating, in the database, the consumer violation history profile with the consumer profile information; wherein the database includes a plurality of violation events, each violation event associated with at least one violated information element; matching the consumer profile information with a respective violation event of the plurality of violation events; wherein matching the consumer profile information with the respective violation event includes: determining a correspondence between the at least one consumer information element and the at least one violated information element associated with the respective violation event; associating, in the database, the consumer violation history profile with the respective event of violation; selecting, via the server, at least one mitigation action defined by at least one violated information element; associating, in the database, the at least one mitigation action with the consumer's violation history profile; generating a notification to the consumer, wherein the notification includes the at least one mitigation action; displaying, via a user device, a violation system interface; displaying, via the violation system interface, the at least one mitigation action; associating, in the violation system interface, the at least one mitigation action with an interface element, wherein the interface element is actionable to complete the at least one mitigation action; and displaying, in the violation system interface, a visual indicator configured to indicate whether the at least one mitigation action is complete or incomplete. 13. The method of claim 12, further comprising: removing at least one mitigation action from the violation system interface when the mitigation action is completed. 14. The method of claim 12, further comprising: indicating, in the consumer violation history profile, a completion status of the mitigation action; and generating, via the consumer violation history profile, a consumer identity score defined by a combination of the at least one violated information element and one or more mitigation actions associated with the violation clarity history profile. 15. A method for generating a consumer violation history profile of a consumer over an electronic network by means of a computer server, comprising: receiving, over a network, consumer profile information corresponding to a consumer; generating, in a database and using the consumer profile information, a consumer violation history profile; associating, in the database, the consumer violation history profile with the consumer profile information; retrieving, over the network, violation event information from a violation information source; comparing the violation event information with the consumer profile information; wherein comparing the violation event information includes: determining a match between the violation event information and the consumer profile information; appending the consumer violation history profile when a match is determined; and wherein appending the consumer breach history profile includes: associating, in the database, breach event information with the consumer breach history profile; wherein the breach information source is a dark web service provider, the method further comprising: identifying, via the dark web service provider, dark web content including a breached information element; retrieving, via the network, the dark web content; extracting, from the dark web content, the breached information element; comparing the breached information element to consumer profile information; wherein comparing the breached information element includes: determining a match between the breached information element and consumer profile information; appending the consumer breach history profile when a match is determined; wherein appending the consumer breach history profile includes: generating, in the database, a breach event including the breached information element; and associate, in the database, the violation event with the consumer's violation history profile. 16. The method of claim 15, wherein the source of the violation information is the consumer. 17. A method for informing a consumer of an accumulated risk resulting from data breaches, comprising: receiving enrollment information from the consumer; generating a history of breaches of the consumer profile based on the enrollment information; accessing an electronic transaction account associated with the consumer, the electronic transaction account configured to execute a consumer transaction between the consumer and a party to the consumer transaction; generating electronic transaction information for the consumer transaction; accessing breach information for a plurality of data breaches; comparing the electronic transaction information to the breach information to determine one or more breach events, the breach events representing a match of the electronic transaction information to the breach information for one of the corresponding data breaches; appending the history of the consumer profile with a list of breaches, the list of breaches identifying each of the breach events; and appending the history of the consumer profile with an accumulated harm risk score, the accumulated harm risk score providing a relative indicator of accumulated risk to the consumer as a cumulative result of the breach events. 18. The method of claim 17, further comprising: displaying the consumer profile violation history with the list of violations and the accumulated harm risk score via a consumer user interface operable on a computing device. 19. The method of claim 18, further comprising: appending the violation history of the consumer profile to display one or more mitigation actions in relation to the one or more violation events, the mitigation actions detailing the options available to the consumer to reduce the risk and/or harm resulting from the one or more of the violation events. 20. The method of claim 19, further comprising: appending the violation history of the consumer profile to display one or more selectable links for mitigation actions, the selectable links being selectable through the consumer user interface to direct the consumer to a resource interface for performing one of the corresponding mitigation actions. 21. The method of claim 20, further comprising: prioritizing the display of the mitigation actions to identify a relatively stronger mitigation action, with each of the remaining mitigation actions subsequently ordered according to the level of strength. 22. The method of claim 20, further comprising: appending the breach history of the consumer profile to display one or more potential harms in relation to one or more of the breach events, the potential harms detailing the likely or possible impact, injury or damage to the consumer resulting from the one or more of the breach events. 23. The method of claim 22, further comprising: appending the consumer profile violation history to display an element risk score for each of the potential harms, the element risk scores providing a relative indicator of risk to the consumer for the respective potential harm. 24. The method of claim 17, further comprising: generating a violation notification to inform the consumer about the attachment of the consumer profile's violation history with the violation events. 25. The method of claim 17, further comprising: accessing the electronic transaction account via a network using an account plug-in for the electronic transaction account. 26. A computer-readable storage medium storing a plurality of non-transitory instructions, characterized in that, when executed with one or more processors of a computing system, they are operative to: identify a consumer profile breach history for a consumer; retrieve electronic transaction information for the consumer; retrieve breach information for a plurality of data breaches; compare the electronic transaction information with the breach information to determine one or more breach events, the breach events representing a match of the electronic transaction information with the breach information for one of the corresponding data breaches; and append the consumer profile breach history with an accumulated harm risk score, the accumulated harm risk score providing a relative indicator of accumulated risk to the consumer as a cumulative result of the breach events. 27. The computer-readable storage medium of claim 26, wherein the non-transitory instructions are operative to: access an electronic transaction account associated with the consumer via a network using an account add-on for the electronic transaction account; and retrieve electronic transaction information from the electronic transaction account. 28. The computer-readable storage medium of claim 26, wherein the non-transitory instructions are operative to: generate a consumer user interface for displaying the consumer's profile violation history via a computing device associated with the consumer. 29. The computer-readable storage medium of claim 28, wherein the non-transitory instructions are operative to: electronically transmit a notice of infringement to the consumer, the notice of infringement including a selectable link to direct the computing device to the consumer's user interface. 30. The computer-readable storage medium of claim 28, wherein the non-transitory instructions are operative to: display at the consumer user interface a tamper log that identifies each of the tamper events. 31. The computer-readable storage medium of claim 30, wherein the non-transitory instructions are operative to: display on the consumer user interface one or more potential damages for one or more of the breach events, the potential damages detailing the likely or probable impact, injury or damage to the consumer of the one or more of the breach events. 32. The computer-readable storage medium of claim 31, wherein the non-transitory instructions are operative to: display at the consumer user interface an element risk index for one or more of the potential harms, the element risk indices providing a relative indicator of risk to the consumer with respect to one of the corresponding potential harms. 33. The computer-readable storage medium of claim 32, wherein the non-transitory instructions are operative to: display on the consumer user interface one or more mitigation actions for one or more of the breach events, the mitigation actions detailing the options available to the consumer to reduce the risk associated with one or more of the potential harms. 34. A computer-readable storage medium storing a plurality of non-transitory instructions, characterized in that, when executed with one or more processors of a computing system, they are operative to: determine one or more breach events for a consumer; generate an index of accumulated risk of harm to the consumer, the index of accumulated risk of harm providing a relative indicator of the overall accumulated risk to the consumer as a result of the breach events; identify one or more potential harms for one or more of the breach events, the potential harms indicating a probable impact, injury, or harm to the consumer from one or more of the breach events; and identify one or more mitigation actions for one or more of the breach events, the mitigation actions detailing the options available to the consumer to reduce the risk associated with one or more of the potential harms. 35. The computer-readable storage medium of claim 34, wherein the non-transitory instructions are operative to: generate a consumer user interface for displaying a consumer profile violation history via a computing device associated with the consumer, the consumer profile violation history displaying the accumulated risk of harm index, the potential harms, and the mitigation actions. 36. The computer-readable storage medium of claim 35, wherein the non-transitory instructions are operative to: display within the consumer user interface a risk index of the element for one or more of the potential harms, the risk indices of the element providing a relative indicator of risk to the consumer as a result of the corresponding potential harms.