[SPONSOREDNUBIVANCE]
Know a small business winging it on security?
No IT department, no security budget, real exposure. Nubivance builds right-sized security foundations for small companies. Send them this.
Send it alongData Protection
UK Police Face Data Watchdog Action Over Unchecked Use of Retail Crime Platform
The UK police are in hot water with the data watchdog for recklessly signing up around 500 free accounts on a retail crime platform, Auror, without proper checks or formal approval. This lack of oversight raises serious concerns about data protection and accountability.
UK Watchdog Cites Police for Data Leak Lapses
The UK's Information Commissioner's Office has reprimanded the Metropolitan Police Service for failing to properly protect data when using a retail crime intelligence platform, highlighting the importance of balancing innovation with robust data safeguards. Organizations must prioritize risk assessments and effective oversight to avoid similar data protection lapses.
Norway Fines Xandr $9.6 Million for Illicit Grindr Data Sharing
Norway's data watchdog has slapped Xandr with a whopping $9.6 million fine for illegally sharing Grindr users' sensitive info, including their sexual orientation, with thousands of companies. The massive penalty reflects the seriousness of the breach, which involved relaying personal data to advertisers without a lawful basis.
Norway Fines Microsoft's Xandr $9.6 Million Over Grindr Data Misuse
Norway's Data Protection Authority slapped Xandr, a Microsoft advertising arm, with a whopping $9.6 million fine for recklessly sharing Grindr user data without consent. The massive penalty reflects the severity of the breach, which put thousands of Norwegian users' sensitive information at risk.
UK Watchdog Secures AI Firms' Data Protection Pledges
The UK's data watchdog has secured pledges from AI firms to prioritize data protection, reassuring people that their personal info will be safeguarded as AI innovation continues to advance. This move aims to build trust, with the watchdog ensuring companies meet four key tests to guarantee responsible data use.
New Federal Rules to Tighten Contractor Cybersecurity Reporting
Get ready for a seismic shift in cybersecurity reporting: new federal rules will soon require contractors to report unauthorized access to sensitive information within a tight 72-hour window. This stricter timeline aligns with upcoming CISA regulations, putting companies on notice to strengthen their incident response game.
IQVIA Fined $7.8 Million for Lax Health Data Anonymization Practices
Italy just slapped IQVIA with a whopping $7.8 million fine for failing to properly anonymize health data, putting nearly one million patients at risk of being reidentified. The country's Data Protection Authority found that IQVIA's lax practices left sensitive info vulnerable.
UK's ICO Reconstitutes with New Board, HQ Amid Regulatory Overhaul
Britain's data protection watchdog has undergone a major overhaul, rebranding as the Information Commission with a new board and HQ, marking a fresh start for the regulatory body. This change comes as part of a broader modernization effort, aimed at strengthening data protection regulation in the UK.
SOC 2 Faces AI Agent Test
As AI agents increasingly infiltrate enterprise systems, the authenticity of SOC 2 compliance comes under scrutiny - can a certificate that verifies controls at a single point in time truly guarantee security in a rapidly changing environment? Token Security argues that SOC 2 may be more about appearances than actual protection.
Ofcom Probes Pornhub's Apple-Powered Age Checks
Ofcom is cracking down on online safety, launching an investigation into Pornhub owner Aylo's age checks, which rely on Apple technology to verify users' ages. The probe will examine whether Aylo is doing enough to keep kids safe from explicit content.
Sweden Fines Miljödata $183,000 for GDPR Breach Over Inadequate Security
A massive GDPR breach has hit Sweden, exposing sensitive personal records of 2.2 million people after a cyberattack on Miljödata, a widely-used municipal HR and work-environment software provider, on August 25, 2025. The breach led to a hefty $183,000 fine for inadequate security measures.
DORA Drives Network Visibility to Combat Cyber Threats
With DORA now in effect, financial institutions must turbocharge their network visibility to stay ahead of cyber threats and meet the regulation's stringent requirements. By moving beyond basic asset inventories, organizations can uncover hidden blind spots and ensure the security and resilience of their ICT ecosystem.
Google Fined €403 Million for GDPR Violations on Location Data Handling
Google just got slapped with a whopping €403 million fine by Ireland's Data Protection Commission for violating EU data protection rules - specifically mishandling people's location data for nearly two years. The penalty sends a strong message that lax data handling practices won't be tolerated, with the watchdog warning that delayed enforcement can be just as damaging as none at all.
Google Fined $463M for GDPR Violations on Location Data Handling
Google's careless handling of location data has landed it a hefty €403 million fine for GDPR violations, sparking concerns that users may have unknowingly surrendered control over their personal info to influence ad targeting and infer interests.
Google Fined €403m for GDPR Breach on Location Data Handling
The Irish Data Protection Commission has fined Google a whopping €403m for mishandling users' location data, violating the EU's strict General Data Protection Regulation (GDPR) rules. This hefty penalty comes after a two-year investigation into how Google handled location information from 2018 to 2020.
FBI Tightens CJIS Encryption, Vulnerability Rules
The FBI's latest update to the CJIS Security Policy, version 6.1, strengthens encryption rules and closes security gaps, building on the December 2024 modernization. Key changes include upgraded encryption requirements, now mandating 256-bit strength for SC-13 and SC-28.
[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
UK Cyber Certification Scheme Sees Record Takeup but Remains Underwhelming
Despite a record 61,430 Cyber Essentials certificates issued in the past year, many small businesses are still struggling to prioritise cyber security over day-to-day operations. For SMEs, cyber security competes with immediate pressures of running and growing a business, highlighting a need for greater support and awareness.
Court Seizes Radaris Domains in Data Broker Privacy Case
In a major victory for data privacy, a New Jersey judge has ordered the seizure of Radaris domains, marking a significant step forward in the enforcement of Daniel's Law, which protects personal information of state officials and their families from data brokers. This move follows Atlas Data Privacy Corp's lawsuit against Radaris, which accused the company of using delaying tactics to avoid accountability.
FTC Reverses Health App Breach Notification Policy
The Federal Trade Commission has reversed its policy on breach notification for health apps, deeming the previous guidance unnecessary and superseded by ongoing rulemaking. This move aligns with the White House's push for a deregulatory approach, aiming to reduce unnecessary guidance.
Congress Extends Cybersecurity Info Sharing Act, But Uncertainty Remains
The House's short-term renewal of the Cybersecurity Information Sharing Act leaves companies with a temporary reprieve, but experts like Doc McConnell warn that predictability is key to building trust - and a 90-day risk calculus just won't cut it. Without a permanent solution, uncertainty remains for companies relying on this crucial legislation.
Grindr Settles UK Data Privacy Claims for $35.2 Million
Grindr is shelling out $35.2 million to settle a UK lawsuit alleging the company mishandled users' personal data, including sensitive info on HIV status, ethnicity, and more, before 2020. The settlement, reached on September 2, resolves claims that Grindr unlawfully processed and misused private information.
Grindr Settles UK Data Suit for $35 Million Over HIV Status Sharing
Grindr is shelling out $35 million to settle a UK lawsuit that claimed the company shared users' personal info, including their HIV status, with third parties without their consent. The settlement, which doesn't admit any wrongdoing, resolves a class-action suit filed on behalf of over 10,000 users.
UK Cyber Bill Spurs Debate on Executive Liability
Could holding senior executives personally accountable for cyber security breaches be the key to driving cultural change within organisations and preventing costly penalties? Baroness Kidron says the goal is to ensure preventative action is taken to avoid penalties by making cybersecurity a top-level responsibility.
California Targets AI Chatbot Toys for Kids with New Regs
California is taking a bold step to safeguard kids from potentially harmful AI-powered toys, with a new bill that could ban chatbot-equipped toys for children under 16 through 2031. If approved, this legislation would give lawmakers time to create vital consumer protections for these emerging products.