Law would require firms to give notice of hacked accounts