Risk data aggregation: the great unknowns revealed