@7d506386 I'd normally say threat intel firms, but 20 years back... is a lot.

Maybe Risk Based Security?

Cyber-insurers might have that data too. 

 @14abadff 2003, when data breaches began! Or California notifications at least.