Breach Records Scoping Estimator
On day one of a breach, someone asks “how many people?” and the honest answer is a range. Enter the systems and tables that were touched, the data in each, how much the sources overlap and where people live. Get an estimate of unique individuals, a sensitivity tier, the notification regimes likely to trigger, and a rough cost range — then replace each estimate with facts as forensics confirms them.
1. Systems and tables touched
One row per table, bucket or file set. “Rows per person” turns rows into people (an orders table may hold several rows per customer).
2. Where the affected people live (%)
Total: 100%
3. Estimate
Includes financial account or card numbers, credentials (username/email + password).
- United States290,666
- United Kingdom96,889
- EU / EEA72,666
- Australia24,222
- Contact details484,443
- Other personal data (DOB, purchases, location)484,443
- Financial account or card numbers413,043
- Credentials (username/email + password)412,000
- LikelyEU GDPR — supervisory authorityGDPR Art. 3372,666 people
Required unless the breach is unlikely to result in a risk to people. Record the decision either way.
- LikelyEU GDPR — individualsGDPR Art. 3472,666 people
Sensitive categories make a high risk likely.
- LikelyUK GDPR — ICOUK GDPR Art. 3396,889 people
Separate from the EU regime: UK residents need a UK notice.
- LikelyUK GDPR — individualsUK GDPR Art. 3496,889 people
Only where the risk to people is high.
- LikelyUS state breach laws — residentsState statutes290,666 people
Government ID, financial account, health or credential data are covered data elements in most or many states.
- LikelyUS state attorneys general and agenciesState statutes290,666 people
Many states require a regulator notice above a resident threshold (commonly 250 to 1,000). Check each state's count.
- LikelyAustralia NDB schemePrivacy Act 1988 Part IIIC (NDB)24,222 people
Notifiable when serious harm is likely. Assess within 30 days.
Turn these into dated deadlines with the Breach Notification Clock Calculator. Check with counsel.
From the same model as the PlayCISO Breach Cost Calculator (an estimate grounded in IBM's Cost of a Data Breach 2024), using 484,443 people, data type PCI and the largest jurisdiction share as the region. Open the calculator to see the breakdown and adjust the assumptions. Directional only.
What this estimator does
- List the systems and tables an attacker touched, with row counts and the data categories in each. Rows per person turn rows into people.
- An overlap percentage de-duplicates people who appear in more than one source, giving an estimate of unique individuals — the number regulators and state laws count.
- A jurisdiction split shows how many people sit under each regime, and the data categories set a sensitivity tier: lower, moderate or high.
- The result lists which notification regimes are likely, possible or unlikely to trigger, with the reason, and a rough cost range from the PlayCISO Breach Cost Calculator model.
- Everything runs in your browser. Copy the summary into the incident log, and replace estimates with real joins as forensics confirms scope.
Frequently asked questions
How do I estimate how many people were affected by a breach?
Start from the tables or files that were accessed, convert rows to people (an orders table holds several rows per customer), then remove people who appear in more than one source. A join on email address or customer ID is the real answer; an overlap estimate is the first-day answer. Report rows and unique individuals separately — they are different numbers.
Do contact details alone trigger breach notification?
Often not under US state laws, which usually need a name combined with a data element such as a Social Security number, financial account number or medical information — or a username or email with a password. Under GDPR any personal data counts, but the regulator notice can be skipped if the breach is unlikely to create a risk to people. Contact data still fuels phishing, so assess it rather than assume. Check with counsel.
Where does the cost range come from?
From the same model as the PlayCISO Breach Cost Calculator, which is grounded in IBM's Cost of a Data Breach 2024 report and adjusted for data type, industry, region and organisation size. It is directional. Open the Breach Cost Calculator for the breakdown.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.