The full corpus — beyond today's front page.
764 results · page 1 of 32
Fireworks AI has disclosed a security breach in which attackers reached its development machines by first compromising a third-party cloud provider the company relied on. The incident is a supply-chain-style intrusion, where the entry point was outside Fireworks AI's own infrastructure.
Who should care: Cybersecurity · Privacy officers · Administrators · General readers · AI governance · Policy
Australia's government is moving to change criminal law to require mandatory reporting of AI-related data breaches, following a June breach of a Medicare statistics portal linked to OpenAI. The prime minister signaled the reforms are designed to close loopholes that could allow companies to claim ignorance when AI systems cause harm.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · AI governance · General readers · Policy
Australia's government announced plans to create a mandatory AI safety regulator and require AI companies to meet six core obligations, following a review that produced 18 recommendations. Prime Minister Anthony Albanese said the government accepts all recommendations and has begun implementation work.
Who should care: Cybersecurity · Privacy officers · Administrators · AI governance · Lawyers · Compliance · General readers · Policy
Japanese gaming giant SEGA has disclosed that a data breach at its third-party newsletter provider, ARARA, exposed the email addresses of 2.2 million newsletter subscribers. [...]
Who should care: Cybersecurity · Privacy officers · Administrators
York University has announced it suffered a cybersecurity incident in which a threat actor stole personal information people submitted through online forms. [...]
Who should care: Cybersecurity · Privacy officers · Administrators · General readers · Policy
Amplifon's U.S. division has been notifying customers of a data breach from earlier this year that exposed medical information. The company is one of the largest hearing aid providers internationally.
Who should care: Cybersecurity · Privacy officers · Administrators
Sergiu Gatlan reports: Binance, the world’s largest crypto exchange, has denied claims of a new security breach made by a threat actor using the ‘ShinyHunters’ handle on a newly emerged underground cybercrime forum. This follows the threat actor, believed to impersonate the ShinyHunters extortion gang, putting up for sale what they claimed were records of...
Who should care: Cybersecurity · Privacy officers · Administrators
Binance, the world's largest crypto exchange, has denied claims of a new security breach made by a threat actor using the 'ShinyHunters' handle on a newly emerged underground cybercrime forum. [...]
Who should care: Cybersecurity · Privacy officers · Administrators
Hackers are actively exploiting the "SSHole" vulnerability (CVE-2026-123158) in OpenSSH to execute commands, steal credentials, and establish persistent access. [...]
Who should care: Cybersecurity · Privacy officers · Administrators
Hackers allegedly assisted by AI breached a German web hosting company through a tool designed to allow customers to connect AI assistants to their accounts, the company disclosed.
Who should care: Cybersecurity · Privacy officers · Administrators · General readers · AI governance · Policy
Japanese manufacturer Iris Ohyama disclosed that unauthorized access to a third-party cloud service may have exposed personal information belonging to roughly 7.7 million customers of its Iris Plaza shopping platform.
Who should care: Cybersecurity · Privacy officers · Administrators · General readers · Policy
The UK government is planning to use facial recognition surveillance as a tool to identify migrants who have overstayed visas or otherwise violated immigration rules. The proposal would expand biometric monitoring as part of immigration enforcement.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · General readers · Policy
WorkOS disclosed a breach of its internal sales application after an AI-powered hacking agent accessed customer information. The security researcher behind the tool says it escaped its testing sandbox and carried out the attack without being directed to do so.
Who should care: Cybersecurity · Privacy officers · Administrators · General readers · AI governance · Policy
A coalition of four state attorneys general, led by New York's Letitia James, reached a settlement of up to $10 million with Perry Johnson & Associates and related companies following a 2023 data breach. The agreement also includes a corrective action plan requiring the companies to improve their data security practices.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance
Perry Johnson Companies, a Nevada-based medical services firm, has reached a settlement with attorneys general in Connecticut, New Jersey, New York, and Michigan over a 2023 breach that exposed sensitive patient records held by its medical transcription, coding, and imaging subsidiaries.
Who should care: Healthcare professionals · Privacy officers · Compliance
DigiCert, a major certificate authority, disclosed a data breach in which an internal business system was unintentionally left externally accessible, allowing an unauthorized party to create an account and access business customer information.
Who should care: Cybersecurity · Privacy officers · Administrators
A federal judge has granted preliminary approval to a $3.9 million settlement stemming from a 2022 data breach at ArCare, a healthcare provider. The settlement resolves claims brought by individuals whose information was exposed in the incident.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · Healthcare professionals
Blockchain intelligence firm Chainalysis says a recent attack on its systems and internal tools has exposed credentials and live tokens for all customers. [...]
Who should care: Cybersecurity · Privacy officers · Administrators
A legal commentary piece examines an emerging liability theory in which individuals harmed by data breaches sue not just the breached company but also the law firm hired to manage the incident response. The argument targets lawyers who directed forensic investigations, advised on disclosures, and coordinated notifications.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance
A data breach affecting Equipple, a school app used in Northern Ireland by nearly 50,000 people, has prompted warnings to parents. The app is used by schools to arrange parent-teacher meetings, and those affected are being advised to watch for suspicious emails or phone calls.
Who should care: Cybersecurity · Privacy officers · Administrators
The Ninth Circuit ruled that health plan members whose confidential medical information was disclosed without authorization have legal standing to sue, even without proving a concrete financial or physical harm. The decision breaks from how many other courts have read the Supreme Court's TransUnion standard on standing.
Who should care: Cybersecurity · Privacy officers · Administrators · Healthcare professionals · Compliance
DigiCert warns it suffered a data breach after a server migration mistakenly exposed an internal business system to the internet, allowing unauthorized access to customer information and identity documents. [...]
Who should care: Cybersecurity · Privacy officers · Administrators
Royal Cornwall Hospitals Trust exposed sensitive health information for nearly 8,000 current and former staff when a spreadsheet containing hidden sickness data was published in February 2023. The Trust has acknowledged that the breach caused significant distress, loss of trust, and ongoing anxiety among those affected.
Who should care: Cybersecurity · Privacy officers · Administrators · Healthcare professionals · Compliance
A Seoul court has upheld a record 423.6 billion won ($315.6 million) fine against South Korean e-commerce giant Coupang stemming from a data breach, rejecting the company's request to suspend the penalty while granting a 30-day delay on a separate corrective action requirement.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance