Hardware from the decommissioning of two facilities in 2016 still had some customer data on it by the time it reached recyclers.

The company says its improved its security practices since the incident.

The declaration from a Treasury Department office comes amid an environment where attackers are multiplying and the threat surface is rapidly expanding.

Three professional associations for bean-counters argue that any regulation should only set high-level principles or flexible frameworks — not specific or prescriptive rules which might be duplicative…