The breaches that were studied affected between 2,500 and more than 160,000 customers. Lost or stolen laptops, desktop computers, PDAs or thumb drives accounted for 45 percent, or 14 of the events. Lost or stolen files acquired or used by third-parties or outsourcers accounted for 29 percent of the breaches, or 9 events. Lost or stolen backup tapes or other media accounted for 26 percent of the incidents, or 8 events. And there were four incidents involving lost or stolen paper records, which made up 13 percent of the breaches.

The companies participating in the study included a software vendor, several banks, a credit card services company, a catalog retailer, a hotel business, a retail pharmaceutical company, an airline, a mortgage company, a utility company and an educational institution. They were not named.