FTC Safeguards Rule Breach Notification: 163 Reports in 2025, 42% Over the FTC’s Estimate, and No Public List We Could Find

As of November 2, 2026, the FTC Safeguards Rule breach notification duty applies when unencrypted customer information of at least 500 consumers is acquired without authorization: file on the FTC’s online form as soon as possible and no later than 30 days after discovery (16 CFR 314.4(j)). The FTC says about 163 notices arrived in 2025, but we found no public list of them.

What triggers notice, and the deadline

Two lines in that table catch firms out. First, the small-firm exception does not reach the notice: a tax preparer with 800 clients on file has no written risk assessment duty, yet a breach of 500 of them is reportable. Second, the clock can start before management knows, because the rule treats what an “other agent” knows as known to you, 16 CFR 314.4(j)(2). State duties run separately, and in Washington the attorney general notice is also due within 30 days of discovery once more than 500 residents are involved (RCW 19.255.010(7)).

What the FTC has said about notices filed

The only official count we found sits in a footnote. In an August 25, 2026 paperwork notice (91 FR 54872, comments closed October 26, 2026), the FTC wrote: “In 2025, the Commission received approximately 163 breach notifications.” 2025 is the first full calendar year under the duty. When it finished the rule in 2023, FTC staff estimated about 115 reporting firms a year (88 FR 77506), so the real number ran 42% higher. The FTC has raised its forward estimate to 163, or 815 hours and $60,310 a year at $370 per report.

Notice-level data is the gap. In 2023 the Commission wrote that it “intends to enter notification event reports into a publicly available database” (88 FR 77506). The FTC’s guide still says only that a report “might be included in a public listing of breach notifications or in response to a Freedom of Information Act request.” We read the seven FTC pages most likely to host such a list and scanned every link in their main content. None pointed to one. That does not prove no list exists, and one could appear at any time. A FOIA request, which we have not filed, is the obvious next step.

A proxy: how fast similar firms told a state regulator

Because the FTC data is not public, we turned to the two state lists with usable dates. They are not FTC filings, and nothing here shows that any named firm did or did not file with the FTC. We kept only firms whose own name states an activity the rule lists (auto dealer, tax or accounting, mortgage, title, escrow, consumer lending, check cashing, credit counseling), dropped banks, credit unions, insurers and government bodies, and added 700Credit by hand. Name-silent firms are left out, so these are undercounts.

Washington is the cleanest comparison because its statute sets the same 30-day clock and a threshold of more than 500 residents, so each notice on the list involves more than 500 people, the same scale as the FTC line. Among 13 such firms that became aware on or after May 13, 2024, the median gap from awareness to the Washington notice was 83 days, and 2 of 13 met 30 days. Every Washington notice in the same window ran a median of 96.5 days, with 55 of 406 inside 30, so these firms look slow but not unusual. Washington’s statute has exceptions for consumer notices, including law enforcement requests and determining a breach’s scope, so a late date here is not proof of a violation. Our full study of Washington notices covers the longer trend.

Days from date aware to date submitted, Washington AG dataset sb4j-ca4h, latest notice 2026-10-13. n = 13, name rule above. Blue met 30 days, red did not. Washington residents affected across these notices: 163,573.

Indiana’s 2026 year-to-date list adds national totals. It holds 23 notices from firms passing the same name rule with at least 500 people affected in total and a breach date on or after May 13, 2024, last notice 2026-09-28: 9 mortgage, title or escrow, 9 tax or accounting, 3 auto dealers and 2 consumer lenders. Together they report 5,254,613 people, and the median gap is 139 days. That gap starts at the breach, not discovery, so it is not comparable with the 30-day clock. One firm, Heights Finance Holdings, accounts for 79% of the total.

The FTC Safeguards Rule security event reporting form

The Safeguards Rule Security Event Reporting Form is a web form under OMB control number 3084-0171, marked to expire December 31, 2026; the August notice seeks a three-year extension. The FTC estimates 5 hours per report. If you lack a figure, the guide says “just report what you know, and submit a new updated report” later, so an open investigation is no reason to miss day 30.

FTC Safeguards Rule for tax preparers

The rule names them: “an accountant or other tax preparation service that is in the business of completing income tax returns”, 16 CFR 314.2(h)(2)(viii). IRS Publication 5708 (Rev. 8-2024) says tax and accounting professionals are financial institutions “regardless of size”, calls a written information security plan a requirement and repeats the 500-person, 30-day report. Publication 4557 (Rev. 6-2024) warns that failing to do so “may result in an FTC investigation”. The FTC’s nearest case is TaxSlayer in 2017, an online service with more than 950,000 filers in 2016 and, as alleged, no written security program until November 2015. Publication 4557 also tells preparers to report client data theft to their IRS stakeholder liaison, which is a separate channel from the FTC form. 9 of the 23 firms on the Indiana proxy are tax or accounting firms, including Mercadien PC (402,760 people) and Forrestall CPAs (60,843).

FTC Safeguards Rule for auto dealers

FTC staff published dealer FAQs on June 16, 2025. They say the rule covers “most automobile dealers who finance or lease automobiles”, and the rule text names leases longer than 90 days. Not every record counts: staff list service and maintenance records as outside customer information unless combined with it. Systems do count if connected: the FAQs say you must secure those “connected to a system containing customer information”, and that in effect the protections reach your network unless you maintain two separate networks that are not connected. The FAQs are staff views and do not bind the Commission.

The 700Credit incident is the live precedent. Washington’s list shows it became aware on October 25, 2025 and notified the state on December 12, 2025, 48 days later, with 121,828 Washington residents affected. According to Auto Remarketing’s December 4, 2025 report quoting NADA and 700Credit, the FTC accepted one consolidated notice for affected dealer clients, and NADA told dealers they had no separate FTC filing to make for that incident, while state duties remained. That is trade-press reporting of one arrangement, and we found no FTC statement of it. The form’s secure-transfer box for multi-institution filings shows the channel exists, but do not assume it for your own vendor’s breach. Dealer data has drawn FTC action before: DealerBuilt in 2019 and Franklin’s Budget Car Sales in 2012.

Requirements checklist with CFR cites

The 2021 amendments (86 FR 70272, with the rule text at 70307 to 70308) created most of this list, and the operative provisions applied from June 9, 2023 (87 FR 71509). The notice duty came from the 2023 amendment (88 FR 77499, rule text at 77508 to 77509), effective May 13, 2024. The last column applies 314.6.

FTC enforcement citing the rule

We verified 13 matters, 12 from Federal Register consent notices and one from a federal complaint, and the newest is from December 2020, before the amended rule applied. The FTC’s own Legal Library filter for the Gramm-Leach-Bliley topic returned 40 entries on November 2, 2026, with Ascension at the top, and a Federal Register search of FTC notices found no later Safeguards Rule consent order. So we found no public case yet that tests the 2021 requirements or the 2024 notice duty. Investigations are not public and federal court cases may not be tagged, so treat that as “none found”. Compare the steady flow on the health side in our HIPAA enforcement tracker, which logs 162 OCR actions.

What this means for MSPs

Under this rule an MSP with access to client customer information is a “service provider” (16 CFR 314.2(r)). The client must bind you by contract and reassess you periodically under 314.4(f), and the Qualified Individual may be your employee under 314.4(a), though the client keeps responsibility and needs a senior person overseeing you. The rule puts the filing duty on the financial institution, not on you, but your knowledge may start its clock if you count as its “other agent”. Write the escalation deadline into the contract: same-day notice of suspected access leaves the client most of its 30 days.

Build a notice runbook now: event start and end dates, consumer count, data types and a short summary are all the form needs, and a third party may file. Keep key-custody records, since an accessed key turns encrypted data into a reportable event. The MFA duty is broad, and our review of 2,571 online services found only 73.9% offer MFA, so plan written equivalents for the rest. For consumer privacy duties beyond breach, see our comparison of 23 state privacy laws, and for clients with defense work, the separate timeline in our CMMC certification data.

Frequently asked questions

When is an FTC Safeguards Rule breach notification required?

When unencrypted customer information of at least 500 consumers is acquired without authorization. File on the FTC’s online form as soon as possible and no later than 30 days after discovery under 16 CFR 314.4(j). The duty took effect May 13, 2024.

Where is the FTC Safeguards Rule security event reporting form?

On ftc.gov under Business Guidance, Gramm-Leach-Bliley Act, Safeguards Rule Security Event Reporting Form. It runs under OMB control number 3084-0171, which expires December 31, 2026 unless renewed. The FTC estimates 5 hours per report, and attorneys or service providers may file for you.

How many Safeguards Rule breach notices has the FTC received?

About 163 in 2025, the FTC said in a Federal Register notice on August 25, 2026, against its 2023 estimate of 115 a year. We found no public FTC list of the notices themselves as of November 2, 2026.

Does the FTC Safeguards Rule apply to tax preparers?

Yes. 16 CFR 314.2(h)(2)(viii) names an accountant or other tax preparation service that completes income tax returns, and IRS Publication 5708 says tax and accounting professionals are financial institutions regardless of size. A preparer holding data on fewer than 5,000 consumers skips four provisions but not the FTC notice.

Does the FTC Safeguards Rule apply to auto dealers?

Most of them. FTC staff FAQs from June 16, 2025 say the rule covers most dealers who finance or lease automobiles, and 16 CFR 314.2(h)(2)(ii) names leases longer than 90 days. A dealer that neither finances, arranges financing nor leases would appear to fall outside that reasoning. The FAQs are staff views and do not bind the Commission.

Does the under-5,000-consumer exemption remove the breach notice?

No. Section 314.6 exempts only 314.4(b)(1) (written risk assessment), (d)(2) (pen test and scan schedule), (h) (incident response plan) and (i) (board report). The 500-consumer notice in 314.4(j) still applies.

Methodology

References

1. eCFR, 16 CFR Part 314, Standards for Safeguarding Customer Information. Accessed November 2026.
2. FTC, Agency Information Collection Activities, 91 FR 54872 (Aug. 25, 2026). Accessed November 2026.
3. FTC, Standards for Safeguarding Customer Information, 88 FR 77499 (Nov. 13, 2023). Accessed November 2026.
4. FTC, Standards for Safeguarding Customer Information, 86 FR 70272 (Dec. 9, 2021). Accessed November 2026.
5. FTC, delay of effectiveness, 87 FR 71509 (Nov. 23, 2022). Accessed November 2026.
6. FTC, Safeguards Rule Security Event Reporting Form. Accessed November 2026.
7. FTC, FTC Safeguards Rule: What Your Business Needs to Know. Accessed November 2026.
8. FTC, Automobile Dealers and the FTC’s Safeguards Rule: FAQs. Accessed November 2026.
9. FTC, FTC Provides Guidance on Updated Safeguards Rule (June 16, 2025). Accessed November 2026.
10. FTC, Legal Library, cases tagged Gramm-Leach-Bliley Act. Accessed November 2026.
11. FTC v. Equifax, complaint (N.D. Ga. 2019). Accessed November 2026.
12. Federal Register, FTC documents matching “Safeguards Rule” (consent notices cited in the table). Accessed November 2026.
13. IRS Publication 5708. Accessed November 2026.
14. IRS Publication 4557. Accessed November 2026.
15. Washington Attorney General, Data Breach Notifications Affecting Washington Residents. Accessed November 2026.
16. RCW 19.255.010. Accessed November 2026.
17. Indiana Attorney General, Data Breach Year-to-Date Report 2026. Accessed October 2026.
18. Auto Remarketing, 700Credit and NADA collaborate to help dealers navigate data breach (Dec. 4, 2025), trade press, used only for the consolidated notice. Accessed November 2026.