The UK police are in hot water with the data watchdog for recklessly signing up around 500 free accounts on a retail crime platform, Auror, without proper checks or formal approval. This lack of oversight raises serious concerns about data protection and accountability.
The UK's Information Commissioner's Office has reprimanded the Metropolitan Police Service for failing to properly protect data when using a retail crime intelligence platform, highlighting the importance of balancing innovation with robust data safeguards. Organizations must prioritize risk assessments and effective oversight to avoid similar data protection lapses.
Norway's data watchdog has slapped Xandr with a whopping $9.6 million fine for illegally sharing Grindr users' sensitive info, including their sexual orientation, with thousands of companies. The massive penalty reflects the seriousness of the breach, which involved relaying personal data to advertisers without a lawful basis.
Norway's Data Protection Authority slapped Xandr, a Microsoft advertising arm, with a whopping $9.6 million fine for recklessly sharing Grindr user data without consent. The massive penalty reflects the severity of the breach, which put thousands of Norwegian users' sensitive information at risk.
The UK's data watchdog has secured pledges from AI firms to prioritize data protection, reassuring people that their personal info will be safeguarded as AI innovation continues to advance. This move aims to build trust, with the watchdog ensuring companies meet four key tests to guarantee responsible data use.
Get ready for a seismic shift in cybersecurity reporting: new federal rules will soon require contractors to report unauthorized access to sensitive information within a tight 72-hour window. This stricter timeline aligns with upcoming CISA regulations, putting companies on notice to strengthen their incident response game.
Italy just slapped IQVIA with a whopping $7.8 million fine for failing to properly anonymize health data, putting nearly one million patients at risk of being reidentified. The country's Data Protection Authority found that IQVIA's lax practices left sensitive info vulnerable.
Britain's data protection watchdog has undergone a major overhaul, rebranding as the Information Commission with a new board and HQ, marking a fresh start for the regulatory body. This change comes as part of a broader modernization effort, aimed at strengthening data protection regulation in the UK.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
As AI agents increasingly infiltrate enterprise systems, the authenticity of SOC 2 compliance comes under scrutiny - can a certificate that verifies controls at a single point in time truly guarantee security in a rapidly changing environment? Token Security argues that SOC 2 may be more about appearances than actual protection.
Ofcom is cracking down on online safety, launching an investigation into Pornhub owner Aylo's age checks, which rely on Apple technology to verify users' ages. The probe will examine whether Aylo is doing enough to keep kids safe from explicit content.
A massive GDPR breach has hit Sweden, exposing sensitive personal records of 2.2 million people after a cyberattack on Miljödata, a widely-used municipal HR and work-environment software provider, on August 25, 2025. The breach led to a hefty $183,000 fine for inadequate security measures.
With DORA now in effect, financial institutions must turbocharge their network visibility to stay ahead of cyber threats and meet the regulation's stringent requirements. By moving beyond basic asset inventories, organizations can uncover hidden blind spots and ensure the security and resilience of their ICT ecosystem.
Google just got slapped with a whopping €403 million fine by Ireland's Data Protection Commission for violating EU data protection rules - specifically mishandling people's location data for nearly two years. The penalty sends a strong message that lax data handling practices won't be tolerated, with the watchdog warning that delayed enforcement can be just as damaging as none at all.
Google's careless handling of location data has landed it a hefty €403 million fine for GDPR violations, sparking concerns that users may have unknowingly surrendered control over their personal info to influence ad targeting and infer interests.
The Irish Data Protection Commission has fined Google a whopping €403m for mishandling users' location data, violating the EU's strict General Data Protection Regulation (GDPR) rules. This hefty penalty comes after a two-year investigation into how Google handled location information from 2018 to 2020.
The FBI's latest update to the CJIS Security Policy, version 6.1, strengthens encryption rules and closes security gaps, building on the December 2024 modernization. Key changes include upgraded encryption requirements, now mandating 256-bit strength for SC-13 and SC-28.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
Despite a record 61,430 Cyber Essentials certificates issued in the past year, many small businesses are still struggling to prioritise cyber security over day-to-day operations. For SMEs, cyber security competes with immediate pressures of running and growing a business, highlighting a need for greater support and awareness.
In a major victory for data privacy, a New Jersey judge has ordered the seizure of Radaris domains, marking a significant step forward in the enforcement of Daniel's Law, which protects personal information of state officials and their families from data brokers. This move follows Atlas Data Privacy Corp's lawsuit against Radaris, which accused the company of using delaying tactics to avoid accountability.
The Federal Trade Commission has reversed its policy on breach notification for health apps, deeming the previous guidance unnecessary and superseded by ongoing rulemaking. This move aligns with the White House's push for a deregulatory approach, aiming to reduce unnecessary guidance.
The House's short-term renewal of the Cybersecurity Information Sharing Act leaves companies with a temporary reprieve, but experts like Doc McConnell warn that predictability is key to building trust - and a 90-day risk calculus just won't cut it. Without a permanent solution, uncertainty remains for companies relying on this crucial legislation.
Grindr is shelling out $35.2 million to settle a UK lawsuit alleging the company mishandled users' personal data, including sensitive info on HIV status, ethnicity, and more, before 2020. The settlement, reached on September 2, resolves claims that Grindr unlawfully processed and misused private information.
Grindr is shelling out $35 million to settle a UK lawsuit that claimed the company shared users' personal info, including their HIV status, with third parties without their consent. The settlement, which doesn't admit any wrongdoing, resolves a class-action suit filed on behalf of over 10,000 users.
Could holding senior executives personally accountable for cyber security breaches be the key to driving cultural change within organisations and preventing costly penalties? Baroness Kidron says the goal is to ensure preventative action is taken to avoid penalties by making cybersecurity a top-level responsibility.
California is taking a bold step to safeguard kids from potentially harmful AI-powered toys, with a new bill that could ban chatbot-equipped toys for children under 16 through 2031. If approved, this legislation would give lawmakers time to create vital consumer protections for these emerging products.