Once data is in use, encryption falls short. A tested approach that replaces sensitive values with realistic substitutes could make stolen information far less useful to hackers.

The regulations on “controlled unclassified information” include security rules and requirements for reporting when they’re breached, including by cyberattacks.

The huge data company says it will offer free credit monitoring to anyone who wants it, whether their personal information was was stolen or not.