The US government has attempted to legislate penalties for data breaches, both federally and by state, in hopes of creating incentives for companies and government agencies to better protect personally identifiable information (PII). See all 50 states and their data breach regulations here. As a result, there was a small adjustment in security strategies within the private sector; however, these changes were clearly not enough in light of the massive data breaches we read about in the news each week.