Credit-reporting agencies operating in New York must register with the state Department of Financial Services by Sept. 15 under a final regulation passed in June to protect state residents' private data from breaches such as the massive Equifax data breach that exposed information on millions of Americans last year.

DFS launched an online registration form last month for credit-reporting agencies to comply with the new rules issued after public hearings last year, Superintendent Maria Vullo announced recently. The regulations were passed in June in response to the Equifax data breach disclosed a year ago Friday, which exposed the Social Security numbers and other private information of nearly 148 million Americans, including more than 8 million New Yorkers, according to updated figures.

“In the face of lax federal government oversight, New York has led the nation in protecting consumers and safeguarding the financial services industry from the threat of data breaches and other cyber-attacks,” Superintendent Vullo said in a statement. “This online registration process is an important step as DFS continues to take steps to promote strong, modern state regulation and to ensure that the sensitive data of consumers remains safe.”

The new rule requires consumer credit agencies with reports on 1,000 New Yorkers or more in the past year to register annually with the department beginning on or before Sept. 15, and by Feb. 1 of each year thereafter. The form requires the agencies to identify the officers and directors who are responsible for complying with state laws regulating financial services, banking and insurance. It also requires the agencies to comply with the state's sweeping cybersecurity regulation by Nov. 1, including having a cybersecurity program, a written policy approved by the board or a senior officer to protect consumers' data and a chief information security officer.

Aside from the public hearings held in New York last year, congressional hearings also were held in Washington, D.C., last October, during which Senate Judiciary Committee Chairman Chuck Grassley, R-Iowa, called for federal standards. But no legislation actually passed, and the Consumer Financial Protection Bureau pulled the plug on a full-scale investigation of the Equifax incident earlier this year.

Chi Chi Wu, staff attorney for the National Consumer Law Center, said in a news release Thursday, “despite all the outrage and media attention last year, Congress has done little except make security freezes free, and Equifax has not been held accountable.”

The Federal Trade Commission is still probing the breach and Equifax could still face financial penalties, according to news reports. Andrew Smith, the FTC's new director, is a former partner at Covington & Burling who testified before Congress at the Equifax data breach hearings in October 2017 on behalf of the Consumer Data Industry Association, which represents the credit-reporting agencies, according to Reuters.

Equifax's latest filing with the U.S. Securities and Exchange Commission states that company is being investigated by attorneys general in 48 states and the District of Columbia, and faces lawsuits brought by the attorneys general of Massachusetts, Puerto Rico and West Virginia, according to the U.S. Public Interest Research Group Education Fund in a report released Thursday.