Editorial Criteria
D. Shettler - Etiolated.org
2007-07-26
What Etiolated Is/Is Not
What we are:
- A data loss index
What we are not:
- A breach index
Etiolated does not list every breach that occurs. To do such would require resources well beyond those at our disposal. Our data is derived from http://attrition.org/dataloss , and their editorial standards are what we’ve chosen to adopt. They and we categorize a data loss as an incident where sensitive consumer data has been exposed, or could have been exposed. They and we do not consider directory information to be a data loss. In order to editorially qualify, a data loss must be a loss of directory information AND critical information required for identity theft, or the disclosure of personal information, such as:
Names, Addresses AND one or more of the following: social security numbers, medical records, credit card numbers, grades, financial information including account numbers, pin numbers, or other critical pieces of information.
An organization exposing names and addresses alone, even if industry compliance requirements forbid it, does not meet our editorial standards. For us to know all compliance laws governing all industries and their specifics is again, beyond our resources. There may be exceptions in egregious circumstances, but the directory rule applies in the vast majority of cases. We’ve chosen this standard as a baseline as a telephone book would otherwise constitute a data loss.
In addition, we do not publish an incident if the details about the incident are lacking. If a report states that “Names, Addresses, and other sensitive data…”, without detailing what other sensitive data consists of, crosses our path, we may choose to decline it.
Lastly, we do not index small incidents. A loss of less than a hundred records is generally disregarded. The purpose of etiolated is to highlight significant losses and breaches of consumer trust/rights, not to put every incident under a microscope. We make exceptions to this rule on rare occasions.
This being said, please do not hesitate to contribute an incident if you find one that we have yet to include. If it meets our guidelines, we’ll include it and credit you. If it does not meet our guidelines, we’ll let you know why and thank you kindly for your contribution regardless.