General Motors has agreed to a $220 million settlement with 36 states and the District of Columbia over allegations it collected and sold driver data to insurers without consent. This hefty fine resolves claims that GM shared precise driving habits with brokers, putting drivers' privacy at risk.
Meta's empty promises about user data control have landed the company a whopping $25 billion penalty, following a court ruling that uncovered over 43 million privacy violations. A New Mexico state court judge slammed Meta for making misleading statements about how user data would be handled.
The European Commission is cracking down on scam risks, and Booking.com is under the spotlight - will the popular platform step up to protect travelers from fake listings and phishing scams? The investigation will determine if Booking.com has breached EU security and transparency rules.
The EU is cracking down on Booking.com's lackluster efforts to prevent scams on its platform, with officials describing their current approach as absolutely substandard. A formal probe under the Digital Services Act could force the company to overhaul how it handles billions of euros in travel bookings.
Stolen credentials are a major threat, involved in nearly 45% of breaches - and with CJIS v6.1 explicitly requiring multi-factor authentication for all accounts, it's clear that agencies must act fast to ensure robust protection across their entire environment.
The Financial Conduct Authority's chief data officer warns that poorly governed AI can wreak havoc on consumers and operations - and is calling for firms to report major AI failures and near-misses to prevent harm.
The UK police are in hot water with the data watchdog for recklessly signing up around 500 free accounts on a retail crime platform, Auror, without proper checks or formal approval. This lack of oversight raises serious concerns about data protection and accountability.
The UK's Information Commissioner's Office has reprimanded the Metropolitan Police Service for failing to properly protect data when using a retail crime intelligence platform, highlighting the importance of balancing innovation with robust data safeguards. Organizations must prioritize risk assessments and effective oversight to avoid similar data protection lapses.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
The Federal Trade Commission is cracking down on a group of so-called sextortion protection firms, accusing them of deceiving customers out of at least $60 million. The FTC lawsuit claims Dmitry Belkin and his 12 companies used misleading tactics to sell their services, allegedly preying on people targeted by romance and sextortion scams.
Norway's data watchdog has slapped Xandr with a whopping $9.6 million fine for illegally sharing Grindr users' sensitive info, including their sexual orientation, with thousands of companies. The massive penalty reflects the seriousness of the breach, which involved relaying personal data to advertisers without a lawful basis.
Norway's Data Protection Authority slapped Xandr, a Microsoft advertising arm, with a whopping $9.6 million fine for recklessly sharing Grindr user data without consent. The massive penalty reflects the severity of the breach, which put thousands of Norwegian users' sensitive information at risk.
The UK's data watchdog has secured pledges from AI firms to prioritize data protection, reassuring people that their personal info will be safeguarded as AI innovation continues to advance. This move aims to build trust, with the watchdog ensuring companies meet four key tests to guarantee responsible data use.
Get ready for a seismic shift in cybersecurity reporting: new federal rules will soon require contractors to report unauthorized access to sensitive information within a tight 72-hour window. This stricter timeline aligns with upcoming CISA regulations, putting companies on notice to strengthen their incident response game.
The Operational Technology Cybersecurity Coalition is urging CISA to set mandatory security rules for operational technology used in over 8,000 federal facilities, including labs, hospitals, and ports, to protect critical systems like HVAC, power, and water. A binding directive would establish much-needed minimum security practices for federal OT systems.
California Governor Gavin Newsom just signed a bill aimed at curbing the misuse of CIPA lawsuits, which have been used to shake down small businesses for settlement cash over innocent website software installs. The new law, SB 690, updates the California Invasion of Privacy Act to prevent these vexatious lawsuits.
The Operational Technology Cybersecurity Coalition is urging CISA to set mandatory OT security standards for federal agencies, ensuring the government practices what it preaches when it comes to cybersecurity. By doing so, agencies will have clear responsibility for OT cybersecurity and a baseline for protection.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
Italy just slapped IQVIA with a whopping $7.8 million fine for failing to properly anonymize health data, putting nearly one million patients at risk of being reidentified. The country's Data Protection Authority found that IQVIA's lax practices left sensitive info vulnerable.
Britain's data protection watchdog has undergone a major overhaul, rebranding as the Information Commission with a new board and HQ, marking a fresh start for the regulatory body. This change comes as part of a broader modernization effort, aimed at strengthening data protection regulation in the UK.
Pakistan is revolutionizing its public procurement process with the introduction of the Public Procurement Rules 2026, making digital transactions mandatory for federal agencies through the E-Pak Acquisition and Disposal System (EPADS). Any procurement activities outside of EPADS will be flagged as mis-procurement, ensuring a transparent and accountable process.
As AI agents increasingly infiltrate enterprise systems, the authenticity of SOC 2 compliance comes under scrutiny - can a certificate that verifies controls at a single point in time truly guarantee security in a rapidly changing environment? Token Security argues that SOC 2 may be more about appearances than actual protection.
Get ready for a major shake-up in FedRAMP certification: by December 7, 2026, all cloud service offerings will be required to undergo daily vulnerability scans as part of the new Vulnerability Detection and Response rules.
A recent report by the DHS Office of Inspector General found that a staggering 86% of federal agencies are failing to comply with cloud security directives, leaving them vulnerable to preventable cyberattacks. This widespread non-compliance puts the entire national cloud security posture at risk.
Ofcom is cracking down on online safety, launching an investigation into Pornhub owner Aylo's age checks, which rely on Apple technology to verify users' ages. The probe will examine whether Aylo is doing enough to keep kids safe from explicit content.
A massive GDPR breach has hit Sweden, exposing sensitive personal records of 2.2 million people after a cyberattack on Miljödata, a widely-used municipal HR and work-environment software provider, on August 25, 2025. The breach led to a hefty $183,000 fine for inadequate security measures.