This paper seeks to show that data relating to the profiles of organizations and individuals subject to targeted attacks is amenable to study using epidemiological techniques. They design case-control studies to calculate odds ratios reflecting the degree of association between the identified risk factors and the receipt of targeted attack.