US Bill Threatens Jail Time for Failing to Disclose a Data Breach Within 30 Days

A group of U.S. senators recently introduced a bill that proposes up to five years in prison for executives who fail to report a data breach within 30 days.

The Data Security and Breach Notification Act outlined measures organizations would have to take to safeguard Social Security numbers, credit card data and other personally identifiable information (PII). Though the penalties around data breaches are severe, organizations can be exempt if they demonstrate efforts to protect data with encryption.

New Law to Broaden Data Breach Requirements

Given some of the most recent high-profile cybersecurity incidents, the government’s effort to look for a legislative solution comes as no surprise. In fact, as Bleeping Computer noted, a similar bill was introduced during the Obama administration in 2014 following data breaches at major retailers. That bill was never passed into law.

According to Wired, existing laws already penalize actions that could lead to a data breach, but these regulations vary by state. The national scope of the current bill, along with the potentially huge impacts from recent security incidents, might motivate Congress to act this time around.

Playing the Get Out of Jail Free Card

In addition to mandating timely disclosure, the bill also outlined specific forms the disclosure should take. This includes an alert to the Federal Trade Commission (FTC) and a notification to customers via email, letter and a posting on the organization’s website, eWeek reported. Organizations must also provide advice to help those affected by a breach remediate the threat.

While the prospect of jail time may sound onerous to senior business leaders, a close reading of the bill by TechTarget revealed some circumstances in which organizations could have more than a month to disclose a data breach. If business leaders can prove that the organization needed to pinpoint exactly which of its customers’ data might have been lost or stolen, for instance, or that it had made efforts to ward off further attacks, the penalties might not be as severe.

Shane Schick

Writer & Editor

Evolving red teaming for AI environments

2 min read - As AI becomes more ingrained in businesses and daily life, the importance of security grows more paramount. In fact, according to the IBM Institute for Business Value, 96% of executives say adopting generative AI (GenAI) makes a security breach likely in their organization in the next three years. Whether it’s a model performing unintended actions, generating misleading or harmful responses or revealing sensitive information, in the AI era security can no longer be an afterthought to innovation.AI red teaming is emerging…

What we can learn from the best collegiate cyber defenders

3 min read - This year marked the 19th season of the National Collegiate Cyber Defense Competition (NCCDC). For those unfamiliar, CCDC is a competition that puts student teams in charge of managing IT for a fictitious company as the network is undergoing a fundamental transformation. This year the challenge involved a common scenario: a merger. Ten finalist teams were tasked with managing IT infrastructure during this migrational period and, as an added bonus, the networks were simultaneously attacked by a group of red…

A spotlight on Akira ransomware from X-Force Incident Response and Threat Intelligence

7 min read - This article was made possible thanks to contributions from Aaron Gdanski.IBM X-Force Incident Response and Threat Intelligence teams have investigated several Akira ransomware attacks since this threat actor group emerged in March 2023. This blog will share X-Force’s unique perspective on Akira gained while observing the threat actors behind this ransomware, including commands used to deploy the ransomware, active exploitation of CVE-2023-20269 and analysis of the ransomware binary.The Akira ransomware group has gained notoriety in the current cybersecurity landscape, underscored…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

New Law to Broaden Data Breach Requirements

Playing the Get Out of Jail Free Card

More from

Evolving red teaming for AI environments

What we can learn from the best collegiate cyber defenders

A spotlight on Akira ransomware from X-Force Incident Response and Threat Intelligence

Topic updates