Following the massive security breach at Equifax Inc. disclosed earlier this month, New York Gov. Andrew Cuomo on Monday proposed new regulations that would subject consumer credit reporting agencies to the same cybersecurity rules that the state recently enacted for banks and insurance companies.

Under the proposed rules, credit reporting agencies such as Equifax, TransUnion and Experian would have to register with the state Department of Financial Services beginning in February and every year thereafter. Their registration form would also have to include the agency's officers or directors who would be responsible for compliance with the recently enacted regulations aimed at deterring cyberattacks on the financial services industry (NYLJ, Aug. 25)

The state's cybersecurity regulations, billed as the first in the nation, require banks and insurance companies regulated by DFS to have department-approved plans to deter cyberattacks and report any attacks within 72 hours of when they occur to the department, but the existing rules didn't cover consumer credit reporting agencies. Under the proposed regulations announced by Cuomo on Monday—which are slated to appear in the State Register on Oct. 4 and are subject to a public comment period—credit reporting agencies would have to comply with the regulations on a phased-in schedule beginning April 4.