January 16, 2018 By Shane Schick 2 min read

Two U.S. senators recently proposed a cybersecurity legislation that will allow the Federal Trade Commission (FTC) to penalize credit rating industry organizations that don’t properly safeguard data.

Cybersecurity Legislation Imposes Penalties for Breaches

In a public statement outlining the proposed Data Breach Prevention and Compensation Act, Sens. Elizabeth Warren (D-Mass.) and Mark Warner (D-Va.) explained that the bill would create a new office at the FTC focused on information protection.

If passed, it would enact strict penalties for breaches in customer data. Specifically, credit rating agencies would receive $100 fines for each piece of personally identifiable information (PII) lost in a data breach, plus $50 for each additional PII file per customer. According to SecurityWeek, the bill also requires agencies that fail to comply to pay a maximum penalty of 50 percent their gross revenue from the year before the incident took place.

In addition to giving the FTC greater oversight and power over data protection practices, this cybersecurity legislation actually hits harder in terms of fines than the EU’s General Data Protection Regulation (GDPR). While many firms are bracing for GDPR to come into effect later this year, it’s clear that recent security headlines are creating just as much concern among lawmakers on this side of the Atlantic.

Protecting Consumer Data

The bill aims to ensure that consumers, whose personal information becomes the ultimate casualty when cybercriminals break into large corporate systems, will be fairly compensated: 50 percent of the fines collected by the FTC would go to the victims. The other half would go toward security research and inspections, SecurityWeek noted, ensuring that the law would also reduce the risk of similar occurrences in the future.

It’s not unusual for modern governments to consider cybersecurity legislation. Just as credit agencies keep a close eye on how consumers spend their money, the government wants to keep an even closer eye on how these firms are keeping data from prying eyes.

More from

Change Healthcare discloses $22M ransomware payment

3 min read - UnitedHealth Group CEO Andrew Witty found himself answering questions in front of Congress on May 1 regarding the Change Healthcare ransomware attack that occurred in February. During the hearing, he admitted that his organization paid the attacker's ransomware request. It has been reported that the hacker organization BlackCat, also known as ALPHV, received a payment of $22 million via Bitcoin.Even though they made the ransomware payment, Witty shared that Change Healthcare did not get its data back. This is a…

Phishing kit trends and the top 10 spoofed brands of 2023

4 min read -  The 2024 IBM X-Force Threat Intelligence Index reported that phishing was one of the top initial access vectors observed last year, accounting for 30% of incidents. To carry out their phishing campaigns, attackers often use phishing kits: a collection of tools, resources and scripts that are designed and assembled to ease deployment. Each phishing kit deployment corresponds to a single phishing attack, and a kit could be redeployed many times during a phishing campaign. IBM X-Force has analyzed thousands of…

How I got started: AI security researcher

4 min read - For the enterprise, there’s no escape from deploying AI in some form. Careers focused on AI are proliferating, but one you may not be familiar with is AI security researcher. These AI specialists are cybersecurity professionals who focus on the unique vulnerabilities and threats that arise from the use of AI and machine learning (ML) systems. Their responsibilities vary, but key roles include identifying and analyzing potential security flaws in AI models and developing and testing methods malicious actors could…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today