The FTC's Safeguards Rule requires certain financial businesses to report data breaches to the FTC. This page tracks the reporting requirement. It is our running watch, not the FTC's official list.
The number to know: the FTC says it received about 163 breach notifications in 2025. That was the first full year of the reporting rule.
The 30-day rule in plain English
Since May 13, 2024, a business covered by the Safeguards Rule must tell the FTC about a qualifying breach. The clock is short. You report as soon as possible, and no later than 30 days after you discover it.
A qualifying breach is called a notification event. It means someone got unencrypted customer information without permission. The rule counts 500 or more consumers. If the number hits 500, you file.
Three details catch small firms off guard.
First, access counts as acquisition. If someone who should not be there gets into a system holding unencrypted customer data, the rule presumes the data was taken. You need reliable evidence to show it was not.
Second, encryption only helps if the key stayed safe. If an unauthorized person got the encryption key, the data counts as unencrypted.
Third, small firms are not exempt from this part. The rule excuses the smallest firms from some written requirements. The 30-day reporting duty is not one of them.
You file through the FTC's online reporting form. Your report may be made public.
For the full rule, see our plain-English guide to the FTC Safeguards Rule.
Tracker log
Newest first. We update this page as new developments surface.
Oct 26, 2026 (upcoming). Comment deadline on the FTC's request to renew the breach reporting requirement for three more years. This is a paperwork renewal, not a new rule. The 30-day duty stays in place while it renews. (Federal Register notice 91 FR 54872.)
Aug 25, 2026. The FTC disclosed it received about 163 breach notifications in 2025, the first full year of the reporting rule. That count covers every non-bank financial institution the FTC oversees, from mortgage brokers to car dealers to tax preparers. The agency also asked to extend the reporting clearance that expires Dec 31, 2026.
Mar to Oct 2026. The FTC sent warning letters to 97 dealership groups on Mar 13, settled pricing cases with dealer groups in April, August, and October, and published price transparency FAQs on Sep 15. These were advertising and pricing actions, not Safeguards cases. They show the agency is paying attention to dealers again.
Feb 2026. CarGurus disclosed a cybersecurity incident. Attackers reportedly talked employees out of sign-on codes by phone. Leaked records reportedly included finance application details. A listing site is not your system, but the shoppers in it are your customers.
Jan 1, 2026. Oklahoma's amended breach law took effect. Breaches touching 500 or more residents now go to the state attorney general within 60 days of notifying people. One breach, two clocks. The FTC wants its report within 30 days of discovery, and the states keep their own deadlines.
May 13, 2024. The breach notification requirement took effect. From this date, covered businesses must report qualifying events within 30 days of discovery.
Oct 2023. The FTC announced the amendment adding the notification requirement to the Safeguards Rule, with six months for businesses to prepare.
What to watch next
The Oct 26 comment deadline. After that, the renewal moves forward and the 2026 notification count will eventually surface in a future FTC filing. We will add it here when it does.
This page is informational. It is not legal advice, not a compliance review, and not a complete record of FTC activity. For the rule text, see 16 CFR Part 314.