Firms face $2m data breach fines