The law requires businesses to limit how and when they display consumers' Social Security numbers, including a ban on printing a customer's number on cards needed to access services. Some health insurers use Social Security numbers as members' ID numbers and stamp it on membership cards, creating a risk if a card is stolen.

The credit industry "has been relatively slow in taking more security steps than they already have in place because they sort of felt they could tolerate the loss," said Robert Richardson of the Computer Security Institute, an organization for security professionals. New steps could include employing identification technologies such as fingerprint scans.

More merchants will disclose security breaches like the one at BJ's if other states follow California's lead, Richardson said.

Carol Baroudi, a retail and computer security analyst with the research firm Baroudi Bloor, believes most such cases escape public scrutiny.

"I don't think this case was that much of an anomaly," Baroudi said. "I think the fact that we've actually heard about it is different. . . . BJ's had the guts to come forward. They took the risk that people would stigmatize them for this."