Findings · 12 of 16

Empty rows measure the disclosure regime

What it is

Dozens of rows (roughly 86 at the last internal count; not re-counted in this pass) are explicitly marked 'unverified rather than clean.' The absence of findings correlates strongly with the absence of institutions that would produce findings.

Why it matters

Never read a blank row as a clean record. Every documented finding in this tracker exists because some regulator, court or notification law forced it into daylight - so the blank rows are a map of where those mechanisms are missing.

Companies and rows it touches

Gulf state carriers (Qatar, Etihad, Saudia) - breach notification is mandatory on paper (Saudi PDPL: notify SDAIA within 72 hours; Qatar Law No. 13 of 2016: notify the National Cyber Security Agency's NCGAA and affected individuals within 72 hours where damage is likely; UAE Federal Decree-Law 45/2021 Art. 9: notify the UAE Data Office 'immediately'), but the regulators are state agencies rather than demonstrably independent DPAs, the UAE Data Office had not been established and the UAE Executive Regulations had not been issued as of January 2025, and little enforcement is published. Chinese state-owned carriers. Privately held regional chains (Royal Farms, Sheetz, Publix) - no SEC filings, no analyst scrutiny. Member-owned electric cooperatives. Federated organisations (AAA, YMCA) where a national search misses local incidents.

Where to look

Global Airlines (Gulf and Chinese carriers); Mid-Atlantic Convenience Chains; Power Utilities (co-ops); Gyms (YMCA); Student Loans Hotels & Auto (AAA)