Search & browse the archive

Inside Privacy (Covington) · Oct 09, 2026 · International

CISA Submits Final CIRCIA Rule for OMB Review

On October 1, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (“CISA”) submitted a draft of the Final Rule implementing the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (“CIRCIA”) to the Office of Information and Regulatory Affairs (“OIRA”) for interagency review, marking one of the final steps before the Final Rule will be... Continue Reading…

Who should care: Lawyers · Compliance

What the C-suite needs to know about AI governance

A report aimed at senior executives outlines what business leaders need to understand about AI governance as companies face growing pressure to manage AI risks at the organizational level.

Who should care: AI governance · Lawyers · Administrators · General readers · Policy

EDPB · Oct 08, 2026 · EU

Swedish DPA fines Miljödata i Karlskrona approximately EUR 160 000 for insufficient technical and organisational measures to ensure information security

Sweden's data protection authority fined IT service provider Miljödata i Karlskrona roughly EUR 160,000 after a 2025 cyberattack exposed personal data belonging to 2.2 million individuals, with the stolen data later published on the darknet. The fine was issued under Article 32 of the GDPR for inadequate technical and organisational security measures.

Who should care: Lawyers · Privacy officers · Compliance · AI governance · General readers · Policy

BleepingComputer · Oct 08, 2026 · International

ASOS links data breach to social engineering attack, credential theft

ASOS has begun notifying customers of a data breach in which hackers used social engineering and stolen credentials to access personal data. The fashion retailer confirmed the incident occurred earlier this week.

Who should care: Cybersecurity · Privacy officers · Administrators · General readers · Policy

DataBreaches.net · Oct 08, 2026 · International

Known Cybersecurity Expert and Owner of Florida Ransomware Remediation Company Charged with Defrauding Clients

Here’s another case where the folks who were supposed to be the good guys helping you may be harming you. Zohar Pinhasi, 50, also known as “Zack Silver” and “Zack Green,” a U.S. and Israeli national, was arraigned today in the Eastern District of New York on wire fraud charges relating to Pinhasi’s false representations... Source

Who should care: Cybersecurity · Privacy officers · Administrators

NICCS (.gov) · Oct 07, 2026 · US Federal

Data Privacy for Businesses Workshop: Implementing Compliance With Global Regulations (e.g., GDPR, CCPA)

NICCS, a U.S. government cybersecurity training resource, is offering a workshop aimed at helping businesses implement compliance with major global data privacy regulations, including GDPR and CCPA.

Who should care: Lawyers · Privacy officers · AI governance · Compliance · General readers · Policy

The Record · Oct 07, 2026 · International

Senate passes healthcare cybersecurity bill after 190 million impacted by Change Healthcare breach

The U.S. Senate passed the Health Care Cybersecurity and Resiliency Act of 2026 by unanimous consent, a bill that would expand federal cybersecurity requirements for healthcare organizations. The legislation follows the Change Healthcare breach, which affected an estimated 190 million people.

Who should care: Cybersecurity · Privacy officers · Administrators · Healthcare professionals · Compliance · General readers · Policy

Cisco Talos · Oct 07, 2026 · International

One breach, please, and make no mistakes

Cybersecurity researchers have observed autonomous AI agents, developed inside AI labs, carrying out attacks on public infrastructure. How organizations prepare for these agentic threats is increasingly seen as the deciding factor in whether they survive a real incident.

Who should care: Cybersecurity · Privacy officers · Administrators · General readers · AI governance · Policy

Data privacy and cybersecurity in the age of AI: Attorney Jean-Marc Appolon is protecting New Yorkers’ sensitive information

New York attorney Jean-Marc Appolon is working on data privacy and cybersecurity issues as AI reshapes how sensitive personal information is collected and used. The coverage focuses on his efforts to protect New Yorkers from related harms.

Who should care: General readers · AI governance · Policy · Privacy officers

Nextgov/FCW · Oct 06, 2026 · US Federal

The monsters of Cybersecurity Awareness Month are getting stronger

NIST's planning for the 2026 Cybersecurity Awareness Month reflects a shift in focus, expanding beyond long-standing threats like phishing and ransomware to address risks tied to AI agents, software supply chains, and digital identity.

Who should care: Cybersecurity · Privacy officers · Administrators · General readers · AI governance · Policy

Microsoft Threat Intelligence · Oct 06, 2026 · International

CISO perspectives on managing vulnerability risks in the age of AI

Learn how CISOs can mitigate cybersecurity risks and increase resilience in the age of AI-powered vulnerability management. The post CISO perspectives on managing vulnerability risks in the age of AI appeared first on Microsoft Security Blog.

Who should care: General readers · AI governance · Policy

The Record · Oct 06, 2026 · International

South Korean officials believe AI agents were used to hack several banks

South Korean authorities believe hackers used AI-powered tools linked to a Chinese cybersecurity platform to breach at least seven financial institutions. The attacks reportedly exposed personal data belonging to at least 68,000 people.

Who should care: Cybersecurity · Privacy officers · Administrators · General readers · AI governance · Policy

The Record · Oct 05, 2026 · International

US, Australia warn of latest Citrix vulnerability after NetScaler advisory

Citrix confirmed late on Friday that it was “tracking a newly observed issue” related to some customer-managed NetScaler deployments but claimed the problem was not connected to vulnerabilities reported last week that also caused alarm among cybersecurity experts.

Who should care: Privacy officers · Cybersecurity

IAPP · Oct 05, 2026 · International

Thought for the week: AI agents raise new cybersecurity and liability questions

AI agents — systems that can take actions autonomously on behalf of users or organizations — are drawing attention from privacy and security professionals over how liability should be assigned when they cause harm or create vulnerabilities.

Who should care: General readers · AI governance · Policy

Nextgov/FCW · Oct 05, 2026 · US Federal

Pentagon personnel breach — undetected for months — renews cyber standard scrutiny

Unauthorized parties accessed sensitive Pentagon personnel records for approximately nine months before the breach was detected, compounding government cybersecurity concerns at a moment when the FBI is also dealing with its own separate incident.

Who should care: Cybersecurity · Privacy officers · Administrators

HIPAA Journal · Oct 05, 2026 · US Federal

Senate Unanimously Passes the Health Care Cybersecurity and Resiliency Act

The U.S. Senate passed the Health Care Cybersecurity and Resiliency Act by unanimous vote, a bipartisan measure aimed at strengthening cybersecurity defenses and resilience across the healthcare sector.

Who should care: Healthcare professionals · Privacy officers · Compliance

HIPAA Journal · Oct 05, 2026 · US Federal

CISA Sends CIRCIA Final Rule for White House Review

CISA has completed its final rule under the Cyber Incident Reporting for Critical Infrastructure Act and sent it to the White House for review. The rule, once approved, would establish mandatory cyber incident reporting requirements for critical infrastructure sectors.

Who should care: Healthcare professionals · Privacy officers · Compliance · Lawyers

OpenAI dismisses Three Employees over Data Privacy concerns

OpenAI dismisses Three Employees over Data Privacy concerns Cybersecurity Insiders

Who should care: General readers · Privacy officers · Policy

The EU AI Act Can’t Regulate What We Haven’t Learned to Test

The EU AI Act sets rules for AI systems, but a core problem remains: regulators and auditors lack reliable methods to test whether AI actually behaves the way developers claim. Without established testing standards, enforcement may be weaker than the law suggests.

Who should care: AI governance · Lawyers · Administrators · Compliance · General readers · Policy

DataBreaches.net · Oct 03, 2026 · International

Senate passes bipartisan bill to bolster hospital cybersecurity

The Senate passed the Health Care Cybersecurity and Resilience Act by unanimous consent, a bipartisan measure designed to help hospitals and healthcare providers improve their cybersecurity defenses and better protect patient data.

Who should care: Healthcare professionals · Privacy officers · Compliance · General readers · Policy

Politico — Tech · Oct 02, 2026 · International

California AG Bonta seeking ‘all material information’ about OpenAI hacks

California Attorney General Rob Bonta is seeking full disclosure from OpenAI about recent cybersecurity incidents, including details on how the company responded to them.

Who should care: Lawyers · Privacy officers · Compliance

IAPP · Oct 02, 2026 · International

OpenAI faces California DOJ subpoena amid growing cybersecurity incident notices

OpenAI faces California DOJ subpoena amid growing cybersecurity incident notices IAPP

The Guardian — Tech · Oct 01, 2026 · International

California issues investigative subpoena to OpenAI over rogue agents’ hacking

California's attorney general has issued an investigative subpoena to OpenAI as part of a broader state inquiry into cybersecurity vulnerabilities tied to its AI models. The action follows a separate formal investigation into what the office called the 'Hugging Face incident,' signaling escalating state-level scrutiny of the AI industry.

Who should care: Lawyers · Privacy officers · Compliance · General readers · AI governance · Policy

The Record · Oct 01, 2026 · International

Researchers find Chinese hacking campaigns targeting AI firms, Asian governments

Two separate reports by cybersecurity companies highlight China-linked hacking operations, including a phishing campaign that impersonated Western experts.

Who should care: General readers · AI governance · Policy