In the case of the SolarWinds attack, since no personal information was lost, companies weren’t obligated to even report the attack.

John Katko, R-N.Y., said the absence means there’s “an undeniable gap in our country’s cybersecurity posture,” leaving companies without “a consistent overarching incentive for industry to disclose a breach.” As a result, “federal agencies are often operating in the dark instead of having access to the critical aggregate data regarding the tactics, techniques and procedures of bad actors,” he said.įireEye CEO Kevin Mandia told lawmakers that state laws requiring notification of data breaches address only loss of personally identifiable information of consumers. House Homeland Security Chairman Bennie Thompson, D-Miss., said that in the absence of federal law requiring information sharing, tech companies are unable to discuss breaches and attacks with members of Congress or the Cybersecurity and Infrastructure Security Agency, known as CISA. And then we had to say, ‘You need to go over to this person in this other part of the government to let them know.’ … We cannot do that for you.” In December, after FireEye revealed the SolarWinds hack and Microsoft began examining the breach among its federal clients, the company had to “go to each agency, tell them that we had identified that they were a victim of this. Companies also face a legal barrier because contracts with federal agencies “restrict a company like Microsoft from sharing with others in the federal government when a particular agency has been hacked in this way,” Smith said.

Solarwinds data breach