FCC gets tough: Telcos must now tell you when your personal info is stolen

The FCC finalized new telecom breach reporting rules requiring carriers to report security incidents to the FCC, FBI, and Secret Service within seven days of discovery, notify customers without unreasonable delay and within 30 days, and expand covered data beyond CPNI to include PII and inadvertent disclosures, with limited exceptions where no harm is likely. The rule, effective March 13, also covers telecom relay service providers and arrives amid overlapping federal requirements (FTC, SEC) and anticipated CISA rules, despite industry and some congressional objections.