The full corpus — beyond today's front page.
504 results · page 21 of 21
A data breach in New Zealand is prompting discussion about potential reforms to the country's privacy legislation, according to reporting from the IAPP. The incident may accelerate legislative changes to how personal data is protected under New Zealand law.
Who should care: Cybersecurity · Privacy officers · Administrators · General readers · Policy
A data exposure at Dialog, described as an exclusive, invite-only organization, left membership information accessible without any breach in the conventional sense. The organization reportedly framed the incident as a hack, though the data appears to have been leaking rather than stolen through an intrusion.
Who should care: Cybersecurity · Privacy officers · Administrators
Bradford Health Services and Bradford Health Partners have agreed to settle a lawsuit stemming from a December 2023 cybersecurity incident that exposed patient data. The breach prompted legal action under privacy and healthcare data protection laws.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · Healthcare professionals
Hillcrest Convalescent Center, a skilled nursing and rehabilitation facility in Durham, North Carolina, has reached a settlement in a class action lawsuit stemming from a data breach affecting patient information.
Who should care: Cybersecurity · Privacy officers · Administrators · Healthcare professionals · Compliance
A British member of the Scattered Spider hacking group has pleaded guilty to cyberattacks on Transport for London, SSM Health Care, and Sutter Health, with a second British hacker also pleading guilty in connection with the TfL breach. The cases mark a rare instance of criminal accountability for a group linked to a string of high-profile intrusions.
Who should care: Healthcare professionals · Privacy officers · Compliance
Tata Electronics, a major supplier to companies including Apple and Tesla, has reportedly suffered a cyberattack in which threat actors claim to have obtained sensitive trade secrets tied to those client relationships. The full scope of the breach and the validity of the claims have not been independently confirmed.
Who should care: Cybersecurity · Privacy officers · Administrators
A lawsuit stemming from a data breach at MSG Entertainment is drawing attention to the company's use of facial recognition technology and how it handles the personal data of people who attend its venues.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · General readers · Policy
A blogpost by EDPS head Wojciech Wiewiórowski addresses the risks posed by unauthorized AI tools used inside organizations, noting that such tools can expose personal data, create regulatory blind spots, and introduce security vulnerabilities that official IT governance never sees.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · General readers · AI governance · Policy
The European Data Protection Board held its latest plenary session, meeting with EU Commissioner Michael McGrath to discuss shared priorities including the Digital Omnibus package, while also formally adopting a standardized template for data breach notifications across member states.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · AI governance · Compliance
The FTC has finalized a settlement with Illuminate Education over a data breach that exposed millions of students' personal information. The order mandates a formal security program, restrictions on how much student data the company may collect and retain, and deletion of data deemed unnecessary.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · General readers · Policy
A new analysis warns that adversaries may not need to hack U.S. military systems directly — they can study the publicly available commercial AI models that underpin Pentagon platforms and reverse-engineer their logic. As the Defense Department builds its warfighting capabilities on top of frontier AI from major tech companies, that commercial availability becomes a structural vulnerability.
Who should care: Cybersecurity · Privacy officers · Administrators · General readers · AI governance · Policy
Italy's data protection authority issued an administrative fine against insurance firm Poste Vita S.p.A. following a customer complaint alleging unauthorized disclosure of personal data. The regulator found violations of GDPR principles governing data processing and breach-notification obligations.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · General readers · Policy
Italy's data protection authority fined LTL S.p.A. €40,000 for accessing a former employee's work email account after his employment ended, breaching GDPR principles on lawful processing, transparency, and the individual's right to access his own data.
Who should care: Lawyers · Privacy officers · Compliance · General readers · Policy
Following a HIPAA breach, covered entities are effectively compelled to conduct extensive data mining to identify which records were exposed, assess the scope of harm, and meet regulatory notification obligations — making deep internal data analysis a practical necessity rather than an optional step.
Who should care: Cybersecurity · Privacy officers · Administrators · Healthcare professionals · Compliance
A CISA contractor deliberately posted AWS GovCloud credentials and a large cache of agency secrets to a public GitHub repository, according to KrebsOnSecurity. Lawmakers in both chambers are now pressing CISA for answers while the agency works to revoke the exposed credentials.
Who should care: Cybersecurity · Privacy officers · Administrators
Trump Mobile has acknowledged that a data exposure incident leaked customer personal information, including phone numbers and home addresses. The company attributed the breach to a third-party platform and said it is still assessing whether formal customer notification is required.
Who should care: Cybersecurity · Privacy officers · Administrators · General readers · Policy
A special report discussed at IAPP Canada has renewed scrutiny over privacy breaches at the Canada Revenue Agency, drawing attention to how sensitive taxpayer data has been compromised. The report surfaces ongoing concerns about the CRA's ability to protect the personal and financial information it holds on virtually every Canadian adult.
Who should care: General readers · Privacy officers · Policy
The UK's Information Commissioner's Office has levied a fine of approximately £1 million against South Staffordshire Plc and its water utility subsidiary following a significant cyberattack that resulted in a personal data breach affecting customers.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance
I need to work from what the headline implies: Canada's Privacy Commissioner investigated data breaches at the Canada Revenue Agency, and the CRA has committed to improving its security practices as a result. ```json { "summary": "Canada's Privacy Commissioner completed an investigation into data
Who should care: Lawyers · Privacy officers · Compliance · General readers · Policy
Dragos has documented a case in which an adversary used AI tools to target the operational technology systems of a water utility. The incident marks a notable shift in how attackers are approaching critical infrastructure, using AI to probe or exploit systems that control physical processes.
Who should care: Cybersecurity · Privacy officers · Administrators · General readers · AI governance · Policy
A dataset from UK Biobank — a large longitudinal health research repository — reportedly appeared for sale on Alibaba's platform in China, prompting concern among researchers and a warning from UK Science Minister Patrick Vallance that further such attempts are anticipated. Columnist Polly Toynbee argues the research value of such studies outweighs the risks.
Who should care: Cybersecurity · Privacy officers · Administrators · Healthcare professionals · Compliance
Additional confidential health records from UK Biobank's 500,000 volunteers have appeared for sale on Alibaba following last week's initial breach, with Science Minister Patrick Vallance confirming the government is coordinating with Chinese authorities to remove the listings and anticipating further exposures.
Who should care: Cybersecurity · Privacy officers · Administrators · Healthcare professionals · Compliance
Eurail, the company behind Interrail passes, has disclosed that personal data from a December breach affecting around 300,000 travellers — including passport numbers, names, addresses, phone numbers, and dates of birth — has appeared for sale on the dark web. Some affected customers are now being advised to cancel and replace their passports.
Who should care: Cybersecurity · Privacy officers · Administrators · General readers · Policy
A congressional investigation, prompted by a Markup inquiry, estimates that data broker security breaches have resulted in roughly $20 billion in consumer identity theft losses. Several major brokers have responded by pledging to simplify the process for individuals to remove themselves from their databases.
Who should care: Lawyers · Privacy officers · Compliance · General readers · Policy