Despite those challenges, the two nonprofits say it's clear 2007 will end up a record year for the amount of information compromised, because of greater data loss and increased reporting of breaches.
Both groups acknowledge many breaches may be missing from their lists, because they largely count incidents reported in news media that they consider credible. Media coverage has risen in part because of the growing number of states requiring businesses and institutions to publicly disclose data losses. Thirty-seven states, plus Washington D.C., now have such requirements.
Because of proliferation of such laws, "it may take a year or two before things stabilize and we can see what's really happening," Foley said. "If that's the case, then we'll know whether businesses are practicing better information-handling techniques."