The Federal Trade Commission (FTC) has amended the Safeguards Rule requiring non-banking financial institutions to report data breaches.
https://www.securitymagazine.com/articles/100076-ftc-says-financial-institutions-must-disclose-data-breaches-in-30-days