When an organization suffers a data breach, laws in most jurisdictions require it to notify every affected individual. That means producing a definitive list of real people — a notification roster — with the personal details needed to reach them. Getting it wrong has legal and reputational consequences, so accuracy matters.
Why it's so hard
The data almost never arrives clean. A single incident can surface dozens of exports from different systems — payroll, HR, CRM, backups — each with its own format:
- Mismatched columns and cryptic headers ("EMP_NO", "empl nm", "BRTH_DT")
- The same person duplicated across files, with slightly different spellings
- Values stored inconsistently — SSNs missing leading zeros, dates in five formats
- Non-personal columns (hire date, department, salary) mixed in with the PII
The goal: one row per real person
A good roster collapses all of that into one row per unique affected individual, in a consistent schema, with a confidence score you can defend. That's exactly the problem CyberInci was built to solve — it maps the columns, normalizes the values, merges duplicates, and flags anything that needs a human eye.
The result is notification-ready data in minutes instead of days of manual spreadsheet reconciliation.