With DORA now in effect, financial institutions must turbocharge their network visibility to stay ahead of cyber threats and meet the regulation's stringent requirements. By moving beyond basic asset inventories, organizations can uncover hidden blind spots and ensure the security and resilience of their ICT ecosystem.
Google just got slapped with a whopping €403 million fine by Ireland's Data Protection Commission for violating EU data protection rules - specifically mishandling people's location data for nearly two years. The penalty sends a strong message that lax data handling practices won't be tolerated, with the watchdog warning that delayed enforcement can be just as damaging as none at all.
Google's careless handling of location data has landed it a hefty €403 million fine for GDPR violations, sparking concerns that users may have unknowingly surrendered control over their personal info to influence ad targeting and infer interests.
The Irish Data Protection Commission has fined Google a whopping €403m for mishandling users' location data, violating the EU's strict General Data Protection Regulation (GDPR) rules. This hefty penalty comes after a two-year investigation into how Google handled location information from 2018 to 2020.
The FBI's latest update to the CJIS Security Policy, version 6.1, strengthens encryption rules and closes security gaps, building on the December 2024 modernization. Key changes include upgraded encryption requirements, now mandating 256-bit strength for SC-13 and SC-28.
Federal agencies are turning to outcomes-based contracting to eliminate risk and ensure successful project delivery. By tying payments to actual results, agencies can align incentives with contractors and guarantee that they only pay for value delivered.
Despite a record 61,430 Cyber Essentials certificates issued in the past year, many small businesses are still struggling to prioritise cyber security over day-to-day operations. For SMEs, cyber security competes with immediate pressures of running and growing a business, highlighting a need for greater support and awareness.
Ofcom's tough stance on online safety has resulted in $9.4 million in fines, but surprisingly, most of this amount remains uncollected, with the regulator admitting that many fines have not been paid. The struggle to collect these fines raises questions about the effectiveness of Ofcom's enforcement powers.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
In a major victory for data privacy, a New Jersey judge has ordered the seizure of Radaris domains, marking a significant step forward in the enforcement of Daniel's Law, which protects personal information of state officials and their families from data brokers. This move follows Atlas Data Privacy Corp's lawsuit against Radaris, which accused the company of using delaying tactics to avoid accountability.
As the federal government's fiscal year-end deadline looms in September, agencies face a critical choice: spend remaining budget authority wisely to drive IT modernization forward, or risk losing funding that could hinder progress for years to come. This September is more than just a ledger-closing exercise - it's a make-or-break moment for modernization programs that will impact the future of federal agencies.
The Department of Transportation just gave airlines a get-out-of-jail-free card for flight delays and cancellations caused by cyberattacks, shielding them from liability and compensation requirements. Now, airlines can blame cyberattacks for disruptions and avoid providing amenities or refunds to affected passengers.
The EU's Cyber Resilience Act is now in effect, requiring manufacturers to report actively exploited vulnerabilities to cybersecurity authorities within 24 hours of discovery, no matter where they're based. This new rule creates a sense of urgency, pushing companies to act fast and share critical info to protect users.
The Federal Trade Commission has reversed its policy on breach notification for health apps, deeming the previous guidance unnecessary and superseded by ongoing rulemaking. This move aligns with the White House's push for a deregulatory approach, aiming to reduce unnecessary guidance.
Get ready for a new era of cyber transparency: by September 11, 2026, EU manufacturers with digital products must report vulnerabilities to ENISA within 24 hours of discovery, and provide a detailed report within 72 hours. This mandate is just the beginning, with stricter engineering requirements kicking in on December 11, 2027.
The House's short-term renewal of the Cybersecurity Information Sharing Act leaves companies with a temporary reprieve, but experts like Doc McConnell warn that predictability is key to building trust - and a 90-day risk calculus just won't cut it. Without a permanent solution, uncertainty remains for companies relying on this crucial legislation.
Grindr is shelling out $35.2 million to settle a UK lawsuit alleging the company mishandled users' personal data, including sensitive info on HIV status, ethnicity, and more, before 2020. The settlement, reached on September 2, resolves claims that Grindr unlawfully processed and misused private information.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
Grindr is shelling out $35 million to settle a UK lawsuit that claimed the company shared users' personal info, including their HIV status, with third parties without their consent. The settlement, which doesn't admit any wrongdoing, resolves a class-action suit filed on behalf of over 10,000 users.
Could holding senior executives personally accountable for cyber security breaches be the key to driving cultural change within organisations and preventing costly penalties? Baroness Kidron says the goal is to ensure preventative action is taken to avoid penalties by making cybersecurity a top-level responsibility.
California is taking a bold step to safeguard kids from potentially harmful AI-powered toys, with a new bill that could ban chatbot-equipped toys for children under 16 through 2031. If approved, this legislation would give lawmakers time to create vital consumer protections for these emerging products.
France's data protection authority slapped Hôpital privé de la Loire with a hefty €500,000 fine after a summer 2025 security breach exposed sensitive records of over 727,000 people, revealing major GDPR failures. The fine was issued for breaching obligations under the General Data Protection Regulation, specifically Articles 32 and 34.
Children have bluntly told the Children's Commissioner that the UK's Online Safety Act has failed to make a tangible impact on their online lives, with many saying it has made "absolutely no difference" to their exposure to harmful content. Despite being in effect for over a year, the law seems to be falling short of its promise to protect young people.
The FCC is taking a bold step to combat robocalls by introducing a public scorecard that will rate telecoms on their robocall protection efforts, giving consumers the power to make informed decisions about their service providers. This innovative tool will encourage providers to stay on top of their game and keep unwanted calls at bay.
The House has passed a short-term funding package that extends the Cybersecurity Information Sharing Act of 2015 through December 11, giving lawmakers more time to work on a longer-term reauthorization. This temporary reprieve preserves key cyber authorities that would have expired at the end of the federal fiscal year.
Federal agencies are struggling to keep up with a surge in FOIA requests that are not only increasing in volume but also growing more complex, involving large volumes of electronic records, multiple custodians, and sensitive data. This perfect storm is putting a strain on legacy eDiscovery systems and already limited staff, all while meeting a strict 20-day deadline.