Another key fact taken from the PGP link:

"23 million U.S. adults have received notification that their data was compromised or lost"

Question then is - who has not been notified? Is the notification to loss ratio 10%? 20%? I think we can all agree that it is going to be in the below 50% range.

If we assume that there are (say) 200 million adults in the US, and 100 million of those are data-rich, then that would give us a lower bound of 23%. Otherwise we run out of people to leak!

Readers of this report should make careful note of Appendix A, in which the author points out that statistical inferences cannot be made here, because the sample (which he nonetheless calls 'representative') is not statistically valid.

The reported numbers do serve to describe the impact for the firms which decided to respond, however.

This sounds like a great way to measure the premium to charge for an insurance contract. Of course the results of such a contract would be to develope standards to avoid the risk while still maintaining the premium. So the cost for support and design of a security system is somewhere between the profit margin on the premium and the loss on the stolen records that have real economic loss involved. The dollar value is small relative to most policies but could be done if the companies adopted a standard and the standard bearers where the underwriters as well it might work. So a coop of large customer data sets could self insure and enforce the standards. Since the banking and financial industry is subject to these attacks because the rewards of stealing fungible assets are more rewarding that stealing toasters they should be the thrust of this standard. The top of the food chain as far as payments needs to be addressed or displaced.
The displacement of un-trusted entities that fail to protect the customer’s information is a critical advantage to be exploited by disruptive technological ventures. At the current time the post 9/11 world is focused on security from within the established and disreputable entities that have and continue to provide lip service protection for customers. They are backed by a battery of laws that are unenforceable in any real sense but occasional prosecution of the selective kind make the headlines. So there are no standards that’s why there is no insurance contract for the events. The companies go along as if this where un-avoidable and they suffered no reputational risk of monetary loss. So the world officially has shut its eyes to the rape of private information because it cannot see a way clear to avoid it without disrupting the established entities of which the regulators have a vested interest in. Fiat monetary shortfalls have failed to make the grade in the online environments where informational presence is required rather than physical. Hedge Funds exploit this by incorporating outside the domain of regulators yet have offices in Manhattan. The crisis arbitrage of the informational entity versus a world designed for the physical. When the informational entities organize they can and will over take the physical presence based laws and they are beginning to show a real effect. The physical law base was constructed from a body of common law whereby the long term trust of an entity within a community was transferred from that political sub-division to a national level. In the informational world only a few villages exist as is the case with the Hedge Funds they have been able to aggregate vast amounts of assets and power without the physical base of laws really affecting them. The online transactional world is the same community although perhaps not as well funded. By replicating the evolving standards of Hedge Funds entities that control information for non-physical entities can establish some means of controlling the losses. Since the established institutions that have provided the information have failed and continue to recognize the damage they are causing due to their sloppy standards the door have been opened for disruptive innovators to usurp the established institutional players. Of course there is the gap between legislation that still protects the franchise of the established institutions but that legislation was bought and paid for by the established entities and can be replicated to satisfy the disruptive entities once they have a bankroll. Washington is for sale 24/7 its just a question of the cost and a percentage of participation in the ongoing revenue stream. So the equation is not the losses but the opportunity provided and how long that will take to displace the established institutions, survive the transformation of the regulatory, and maximize the operational aspects to reduce cost. None of the processes really involve programming or logical thought they are marketing cost that result in an event. Back to the human engineering problem of changing minds to fill the treasure chest. The customer information is stolen because it has value and the value has is small and has not caused harm to the sloppy institution that allowed the theft. So people do not care because it cost so little to be robbed and they think is probably their fault to begin with. People are forgiving because the blame has been placed on their shoulders and they dare not start pointing monkeys out for fear they have one riding on their back as well. The institutions are now trapped in a deadly game of negative selling that they cannot win. So with diminished expectations and fear of being called an idiot the customer returns to the only game in town.
The strategy to displace these lazy bastards called customer information repositories is to use greed issue to every customer and merchant that signs up for a new monetary service a zero coupon debt redeemable in ten years. If you give them money they will come even if its not there right now. Place transactional levels of maintenance for the terms of the zero coupons accreted value and use the funds placed into the system to float the disruptive event of undoing the Fiat Currency and its reliance on the physical body of law. Trust is measurement of price since less people wish to hold US Treasuries the rate the US must pay goes up. The violation of trust is a measurement of the cost of change in the rate to borrower funds and in the case of stolen customer information the cost has been charged to the customer themselves rather than the facilitator of the theft and abuse the institutional repository this is a form of tyranny. There are no checks and balances for the repository since they have remained nameless in the press, bought off the regulatory entities, and mandated a monopoly on the use of currency and information.
The only way to fight a well financed army of tyranny is to obtain funding and cut their supply lines. The villages that have the ability to fight this have created the alternative to the fiat regime of currency transfer and implemented their own body of laws Hedge Funds are the emerging anarchist that have succeeded in escaping the insanity proposed as a solution for the abused and pillaged customer.