January 16, 2018 By Shane Schick 2 min read

Two U.S. senators recently proposed a cybersecurity legislation that will allow the Federal Trade Commission (FTC) to penalize credit rating industry organizations that don’t properly safeguard data.

Cybersecurity Legislation Imposes Penalties for Breaches

In a public statement outlining the proposed Data Breach Prevention and Compensation Act, Sens. Elizabeth Warren (D-Mass.) and Mark Warner (D-Va.) explained that the bill would create a new office at the FTC focused on information protection.

If passed, it would enact strict penalties for breaches in customer data. Specifically, credit rating agencies would receive $100 fines for each piece of personally identifiable information (PII) lost in a data breach, plus $50 for each additional PII file per customer. According to SecurityWeek, the bill also requires agencies that fail to comply to pay a maximum penalty of 50 percent their gross revenue from the year before the incident took place.

In addition to giving the FTC greater oversight and power over data protection practices, this cybersecurity legislation actually hits harder in terms of fines than the EU’s General Data Protection Regulation (GDPR). While many firms are bracing for GDPR to come into effect later this year, it’s clear that recent security headlines are creating just as much concern among lawmakers on this side of the Atlantic.

Protecting Consumer Data

The bill aims to ensure that consumers, whose personal information becomes the ultimate casualty when cybercriminals break into large corporate systems, will be fairly compensated: 50 percent of the fines collected by the FTC would go to the victims. The other half would go toward security research and inspections, SecurityWeek noted, ensuring that the law would also reduce the risk of similar occurrences in the future.

It’s not unusual for modern governments to consider cybersecurity legislation. Just as credit agencies keep a close eye on how consumers spend their money, the government wants to keep an even closer eye on how these firms are keeping data from prying eyes.

More from

We are moving!

< 1 min read - SecurityIntelligence.com is being sunset, but have no fear!We have a new home for all of your favorite security and X-Force content.Follow us to www.ibm.com/think to maintain access to the stories and news you love, both new and old.Security Intelligence will officially sunset on Friday, March 28, 2025. To access the latest security thought leadership, go here. To access the latest X-Force research, go here.If you are experiencing cybersecurity issues or an incident, contact X-Force® to help:US hotline: 1-888-241-9812 | Global hotline:…

Bypassing Windows Defender Application Control with Loki C2

10 min read - Windows Defender Application Control (WDAC) is a security solution that restricts execution to trusted software. Since it is classified as a security boundary, Microsoft offers bug bounty payouts for qualifying bypasses, making it an active and competitive field of research.Typical outcomes of a WDAC bypass bug bounty submission:Bypass is fixed; possible bounty awardedBypass is not fixed but instead "mitigated" by being added to the WDAC recommended block list. Likely no bounty awarded but honorable mention is typically givenBypass is not…

FYSA — VMware Critical Vulnerabilities Patched

< 1 min read - SummaryBroadcom has released a security bulletin, VMSA-2025-0004, addressing and remediating three vulnerabilities that, if exploited, could lead to system compromise. Products affected include vCenter Server, vRealize Operations Manager, and vCloud Director.Threat TopographyThreat Type: Critical VulnerabilitiesIndustry: VirtualizationGeolocation: GlobalOverviewX-Force Incident Command is monitoring activity surrounding Broadcom’s Security Bulletin (VMSA-2025-0004) for three potentially critical vulnerabilities in VMware products. These vulnerabilities, identified as CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226, have reportedly been exploited in attacks. X-Force has not been able to validate those claims. The vulnerabilities…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today