; Civil Enforcement by Attorney General (1) In general The Attorney General may bring a civil action in the appropriate United States district court against any covered entity that engages in conduct constituting a violation of section 4. (2) Penalties (A) In general Upon proof of such conduct by a preponderance of the evidence, a covered entity shall be subject to a civil penalty of not more than $1,000 per individual whose personal information was or is reasonably believed to have been accessed or acquired as a result of the breach of security that is the basis of the violation, up to a maximum of $100,000 per day while such violation persists. (B) Limitations The total amount of the civil penalty assessed under this subsection against a covered entity for acts or omissions relating to a single breach of security shall not exceed $1,000,000, unless the conduct constituting a violation of section 4 was willful or intentional, in which case an additional civil penalty of up to $1,000,000 may be imposed. (C) Adjustment for inflation Beginning on the date that the Consumer Price Index is first published by the Bureau of Labor Statistics that is after 1 year after the date of enactment of this Act, and each year thereafter, the amounts specified in subparagraphs (A) and (B) shall be increased by the percentage increase in the Consumer Price Index published on that date from the Consumer Price Index published the previous year. (3) Injunctive actions If it appears that a covered entity has engaged, or is engaged, in any act or practice that constitutes a violation of section 4, the Attorney General may petition an appropriate United States district court for an order enjoining such practice or enforcing compliance with section 4. (4) Issuance of order A court may issue such an order under paragraph (3) if it finds that the conduct in question constitutes a violation of section 4. (f) Concealment of breaches of security (1) In general Chapter 47 of title 18, United States Code, is amended by adding at the end the