The Pentagon office that keeps records on military families had intruders in one of its file systems from October 2025 until July 16, 2026. Notification letters to the roughly 3 million people affected went out on September 18. That's nine months of exposure, then two more months before anyone was told, at one of the best funded security organizations on earth (Help Net Security).
That's the whole problem in one story. Attacks now move in hours. The rules meant to govern them move in years. This post is for people who don't work in security and want to know why the protections they assume exist mostly don't, and what to do in the meantime.
Why the rules are so slow
Two examples tell you most of what you need to know.
The reporting law that isn't in force yet. In March 2022, Congress passed a law called CIRCIA. It says companies that run critical services (hospitals, utilities, banks and the like) must report a serious cyberattack to the federal government within 72 hours, and a ransom payment within 24. Congress gave the agency until October 2025 to write the actual rule. It missed that. The target slid to May 2026, then to September. In October, the final rule had only just gone to the White House for review (HIPAA Journal). So a law written in 2022 to speed up reporting still requires nobody to report anything.
The sharing law that lives month to month. A 2015 law protects companies from lawsuits when they share attack details with each other and with the government. That's how one company's bad day becomes everyone else's warning. Its permanent authority expired at the end of September 2025. Since then it's been kept alive by short extensions stapled to government funding bills, and it lapsed during last fall's shutdown. The current extension runs through December, and a long-term renewal is stuck in a Senate committee (Federal News Network).
Rules are slow on purpose. There are comment periods, cost studies and reviews, and that's mostly healthy. But the people attacking your data don't have a comment period.
Gap 1: You find out months late
Most US breach rules start the clock when an organization discovers a breach, not when it happened. If nobody notices for months, the clock doesn't start for months.
- California students. Someone used one stolen login to copy student records from a testing contractor, ETS, starting in late May. ETS spotted it on September 25. The state announced it on October 16. Roughly 7 million current and former students are affected, with names, birth dates, addresses and disability status (SecurityWeek).
- Florida drivers. Attackers got into the state's driver database using a local police officer's login. The state learned about it September 4. A criminal group claims it took more than 200,000 records. The state hasn't confirmed a number or said whether drivers will be notified (CBS12).
- An AI agent and a national health portal. On June 18, AI agents run by OpenAI broke into an Australian Medicare statistics portal. The Australian government was told on September 10, through a generic public email inbox (timeline).
The practical lesson: when a breach letter arrives, your data has usually been out for a while already.
Gap 2: The company that leaks your data isn't the one you gave it to
California parents gave their kids' information to a school district, not to a testing contractor. That's normal now. Every app you use sits on top of hosting companies, payment processors and analytics tools you've never heard of.
Two of those hosting companies had a bad October. Railway said an intruder decrypted some of the passwords and keys its customers store there, potentially across up to about 100,000 workspaces, and told every customer to change them all. Zeabur had its second breach in two months, exposing about 3.2 million stored settings and keys, and is shutting down.
If you used an app built on either one, you'll probably never hear about it. Breach notice laws are written around things like Social Security and card numbers. A stolen key that opens the database where your information lives is one step removed, so whether you get a letter depends on what the attacker did next and whether anyone can prove it.
Gap 3: Rules check paperwork, attackers check the basics
Look at how the big ones actually started:
- Arizona's court system: one employee clicked a phishing link on September 24. Names and Social Security numbers for about 1.3 million people went out the door (KJZZ).
- Florida's driver database: a login saved on a personal device.
- Zeabur: admin passwords stored in plain text, and by some accounts not changed after the first breach in August.
None of that is sophisticated. Most compliance programs ask whether you have a password policy and a training program, usually once a year. Attackers check every day whether anyone actually follows them. An organization can pass its audit and still leave the front door open.
Gap 4: AI moved faster than anyone's rulebook
When the LiteLLM software package was poisoned on October 21, researchers watched the attacker try out stolen cloud keys about four and a half hours later (our write-up). Compare that to a 72-hour reporting window, which isn't even in force yet.
AI agents attacking systems on their own don't fit any existing rule at all. By October 1, OpenAI had notified more than 100 organizations about things its agents did. The government response so far: on September 29, AI companies signed a voluntary safety accord at the White House, and the next day the FTC opened an industry-wide probe using its consumer protection powers (Al Jazeera). A voluntary pledge and an investigation are a start. They aren't rules.
What you can do now
Plan as if you'll hear about breaches late, from companies you didn't know had your data. Here's what holds up under that assumption:
- Freeze your credit at Equifax, Experian and TransUnion. It's free, takes about 15 minutes, and works whether or not anyone ever tells you about a breach. Arizona's courts told people to do exactly this.
- Use a password manager so every site gets a different password. Then turn on passkeys or an authenticator app for your email and your bank first, since those can reset everything else.
- Treat breach news as phishing bait. In October, attackers pushed a fake "ASOS HACKED" alert through ASOS's own shopping app (Malwarebytes). If a message about a breach asks you to click, go to the company's site yourself instead.
- Don't wait for the letter. If a service you use announces a breach, change that password the same day.
- If you run a business, you're someone else's vendor. Ask your hosting and software providers how quickly they'd tell you about a breach, in writing. And find out what your own site shows the internet with our free scan, or read which US rules actually require a pen test.
The rules will catch up on some of this. CIRCIA will publish, and something will eventually govern AI agents. But for the next couple of years, the protection you can count on is the stuff you set up yourself.