Under federal law, FTC can already penalize companies for violating consumer data security standards, but GAO found its current authorities are ill-equipped to handle breaches on the scale and scope of Equifax. For one, the agency isn't allowed to punish companies for first time offenses, but more importantly, it can only fine companies to compensate for consumer damages. Given the sheer number of victims and the difficulty of tying identity theft to a single breach, it's nearly impossible to calculate the financial loss caused by a breach like Equifax, according to auditors. By broadening the commission's civil penalty authorities, GAO said regulators could punish bureaus for data security incidents without needing to calculate exact monetary losses, which could incentivize companies to invest more heavily in security. Auditors previously recommended a similar policy change to help the commission better pursue firms that violate privacy policies.