Or the SEC, because one the breach/incident is public, the share price drops and failure to have disclosed those factors prior constitutes "securities fraud." Increasingly this it the default method of corporate regulation.
FTC will come knocking at your door even if you do pass an external audit and have Soc2/soc1/iso certification. Equifax is an example.
Who will promptly slap you on the wrist, wag their finger at you and send you on your way.
The FTC will absolutely not knock on your door if you expose users's SSN to the internet.