In this paper we propose a methodology to analyze the heterogeneity of cyber claim databases. This heterogeneity is caused by the evolution of the risk but also by the evolution in the quality of data and of sources of information through time. We consider a public database, already studied by Eling and Loperfido [2017], which is considered as a benchmark for cyber event analysis. Using regression trees, we investigate the heterogeneity of the reported cyber claims. A particular attention is devoted to the tail of the distribution, using a Generalized Pareto likelihood as splitting criterion in the regression trees. Combining this analysis with a model for the frequency of the claims, we develop a simple model for pricing and reserving in cyber insurance.