Yes, but (always but!) we also need to take into account what we're aiming at, which is an impact on stock performance. So the company needs to be (1) listed on a stock exchange and (2) have a significant publicly disclosed incident. And it turns out that such cases aren't as common as one might think. :)

As a side note, one can learn a lot from Verizon's DBIR. People familiar with it might even recognize my inspiration.