A system and method for calculating loss data associated with a data privacy and security breach event occurring within an organization based on collected data. Data describing a number of individuals affected by the event; an estimated number of hours spent by the organization on managing the event; enrollment by individuals affected by the event in a credit monitoring service; an estimated amount spent on communications within the organization relating to the event; an estimated number of hours of loss of productivity by the organization; an estimated credit monitoring service call center volume; an estimated amount spent on computer forensics; and an estimated amount spent on legal counsel is received. Data describing (i) an amount spent by the organization in managing the event; (ii) an amount spent by the organization in notifying individuals affected by the event; (iii) an amount spent by the organization on the credit monitoring service; (iv) an amount spent on loss of productivity; (v) an amount spent on loss of assets; and (vi) an amount spent on credit monitoring service call center activities is calculated. Data describing a total loss amount associated with the event is calculated based on the received data received and the calculations.