An information security manager is building risk scenarios for a quantitative analysis and needs to estimate how often a ransomware event is likely to affect the organization each year. Which source would provide the MOST reliable basis for estimating the annualized rate of occurrence?