I was about to say the exact same thing! This could easily go 10x to 100x for better info.

Yes, but (always but!) we also need to take into account what we're aiming at, which is an impact on stock performance. So the company needs to be (1) listed on a stock exchange and (2) have a significant publicly disclosed incident. And it turns out that such cases aren't as common as one might think. :)

As a side note, one can learn a lot from Verizon's DBIR. People familiar with it might even recognize my inspiration.