“Regulatory announcement focusing on fraud prevention and policy adjustments, framing security measures as a responsible corrective action.”