Much like with cybersecurity incidents. Regulators haven’t acted and they keep happening.