The California Legislature is considering enacting Assembly Bill 1859 (“AB 1859”), which would impose substantial new security obligations on consumer credit reporting agencies and companies that contract with such agencies. Under AB 1859, credit reporting agencies and their contractors would be required to expediently apply software updates to their systems, proactively identify and address vulnerabilities, and regularly test their systems. A credit reporting agency or contractor that fails to take these steps and subsequently suffers a data breach could be liable for civil penalties, damages and attorney’s fees.