SolarWinds hack has lawmakers pushing for national breach notification law

Lawmakers will push to pass a mandatory data breach notification law following the high-profile attack last year on SolarWinds, the network management and IT security company.

The compromise of the SolarWinds Orion IT monitoring and management software package, suspected to be the work of hackers affiliated with the Russian government, has compromised about 100 companies and nine U.S. agencies, including the departments of Homeland Security, State, and Justice. Up to 17,000 SolarWinds customers downloaded the malware.

Microsoft President Brad Smith called the SolarWinds hack “the largest and most sophisticated attack the world has ever seen” during a Feb. 26 hearing before two House committees.

During the hearing, several lawmakers promised to push a national data breach notification law this year. An upcoming bill would require companies to share information about breaches with the U.S. Cybersecurity and Infrastructure Security Agency but allow them to keep their names anonymous to the general public, said Rep. Michael McCaul.

The bill McCaul plans to introduce with Rep. Jim Langevin would presumably include penalties for failing to disclose breaches. All 50 states have their own data breach notification laws, some with significant fines for failure to disclose.

Lawmakers have for years tried to pass a federal breach notification law but have so far failed. Advocates of a national law say it would create a consistent breach notification standard with consistent penalties. However, some critics question whether federal law would water down tougher state laws.

In addition to a handful of lawmakers calling for a national breach notification law during the hearing, Smith also said it’s time for federal rules. Sharing threat information is “something that doesn’t happen broadly enough across the industry,” he said during the hearing.

Currently, reporting data breaches can open up companies to scrutiny from Congress and the public, Smith said. “A lot of companies choose to say as little as possible, and often, that’s nothing,” he added. “But silence is not going to make this country…