Show HN: Comparing stock returns after cyber incidents

Yes, but (always but!) we also need to take into account what we're aiming at, which is an impact on stock performance. So the company needs to be (1) listed on a stock exchange and (2) have a significant publicly disclosed incident. And it turns out that such cases aren't as common as one might think. :)

As a side note, one can learn a lot from Verizon's DBIR. People familiar with it might even recognize my inspiration.

I was about to say the exact same thing! This could easily go 10x to 100x for better info.