Yes, but (always
but!) we also need to take into account what we're aiming at, which is an impact on stock performance. So the company needs to be (1) listed on a stock exchange and (2) have a significant
publicly disclosed incident. And it turns out that such cases aren't as common as one might think. :)
As a side note, one can learn a lot from Verizon's DBIR. People familiar with it might even recognize my inspiration.