WASHINGTON (Reuters) – U.S. Senator Elizabeth Warren said on Friday she has begun an investigation into Equifax’s (EFX.N) massive data breach and, along with 11 other Democratic senators, introduced a bill to give consumers the ability to freeze their credit for free.

Warren, who has built a reputation as a fierce consumer champion, also signaled in a letter to the Consumer Financial Protection Bureau (CFPB), the agency she helped create in the wake of the 2007-2009 financial crisis, that it may require extra powers in order to ensure closer federal oversight of credit reporting agencies.

Although securing new powers for the CFPB could be a tough sell in a Republican-dominated Congress, the attention from Senator Warren and the growing public furor over the Equifax data leak could help protect the CFPB from conservative efforts to weaken the agency, said consumer advocates.

“Is there a silver lining to this breach? Could this protect the CFPB for a while? Possibly,” said Karl Frisch, executive director of consumer advocacy group Allied Progress, adding the scandal may convince some Republicans to preserve America’s top consumer watchdog.

Warren also wrote letters to Equifax and its rival credit monitoring agencies TransUnion (TRU.N) and Experian (EXPN.L), federal regulators, and the Government Accountability Office for information to see if new federal legislation was needed to protect consumers.

“I am troubled by this attack – described as ‘one of the largest risks to personally sensitive information in recent years’ – and by the fact that it represents the third recent instance of a data breach of Equifax or its subsidiaries that has endangered American’s personal information,” she wrote in a letter to Equifax chairman and chief executive Richard Smith.

Warren, the top Democrat on the Senate Subcommittee for Financial Institutions and Consumer Protection, said the proposed bill would stop companies like Equifax from charging consumers for freezing and unfreezing access to their credit files. A credit freeze restricts access to an individual’s credit report, which can stop account fraud when thieves apply for credit using another person’s information.

Equifax, which creates individual credit reports used by lenders to assess a consumer’s creditworthiness, has come under intense pressure from senators and members of the House in recent days for what has been described as a slow, inadequate and confusing response to the hack.

Investors have dumped Equifax’s stock as a result, driving it down 36 percent since the company disclosed the hack on Sept. 7. The company’s shares fell below $93 early on Friday, and were trading near $91 late Friday morning.

BROADER CHANGES

Equifax, which disclosed the breach more than a month after it learned of it on July 29, said at the time that thieves may have stolen the personal information of 143 million Americans in one of the largest hacks ever.

In her letters to the regulators, Warren raised questions regarding the overall regulatory framework for credit report agencies, which are not subject to the same levels of intense scrutiny as other consumer finance firms such as mortgage lenders or credit card providers.

The CFPB supervises credit reporting firms’ compliance with consumer protection laws and earlier this year fined Equifax and TransUnion $5.5 million in total for misstating the cost and usefulness of the scores they provide. But the bureau does not directly license or intensively monitor the companies.

In her letter to the CFPB, which is under attack by Republicans who believe it is already too powerful, Warren asked if the agency has “adequate statutory authority to regulate credit reporting agencies and protect consumers” and solicited the CFPB’s feedback on what other powers it might require to better regulate them.

At least three bills were introduced on Thursday in response to the hack. Four Democratic senators, including Ed Markey of Massachusetts, sponsored legislation that would require Equifax and other data brokers be held accountable for errors.

A spokesperson for the CFPB was not immediately able to provide comment.