Data Privacy

Policy & Government

European Parliament Advances "Chat Control 2.0," Clearing Big Tech to Scan Messages for CSAM

A pointed EU privacy-and-messaging shift — compliance implications for Big Tech and civil-society groups this week.

Data Privacy

Pegasus Spyware Infected the Phone of an MEP Investigating Spyware, TechCrunch and WIRED Report

A pointed export-control-policy disclosure — the spyware-inquiry rapporteur becomes the target.

Artificial Intelligence (AI)

"BioShocking" Research Tricks AI Browsers Into Leaking User Credentials

A multi-vendor AI-browser research disclosure — defender posture-review work for organizations deploying agentic browsers this week.

Policy & Government

House Passes Kids Internet and Digital Safety (KIDS) Act 267-117; Senate Approval Unlikely

A bipartisan House vote on child-safety platform obligations — Senate outlook and industry response in focus this week.

Flat white line-art of a smartphone with an app grid, a key, and flowing connection lines, on a Charcoal background — 282 iOS AI apps leaking API keys in network traffic.

Mobile Security

Researchers Disclose 282 iOS AI Apps Leaking API Keys in Network Traffic

A scale-significant AI-app privacy disclosure with developer accountability implications: Wake Forest researchers found 282 of 444 iOS AI apps exposing usable LLM credentials in their own network traffic, and most stayed open months after notification.

Flat white line-art of an open umbrella beside a tall stack of record cards, on a Cobalt background — Aflac Japan data breach affecting 4.38 million people.

Data Breaches

Aflac Japan Discloses Data Breach Affecting 4.38 Million People

Another scale-significant Japanese-sector disclosure: Aflac Life Insurance Japan says intruders sat in its policyholder portal for ten days and exfiltrated the personal data of roughly 4.38 million customers and agents.

Flat white line-art of a browser window, an extension puzzle piece and an image tile on a Terracotta background — Microsoft removes 119 Edge extensions.

Threat Intelligence

Microsoft Removes 119 Edge Extensions That Hid Malicious Content in Images and Fonts

Browser-extension enforcement action at scale from Microsoft. The company pulled 119 Edge add-ons that concealed payloads inside image and font files, with a combined install base reported at up to 2.6 million, and suspended the developer accounts behind them.

Flat white line-art of a notice board, a phone with a chat bubble, and a key, on a Raspberry background — US reward over Russian Signal and WhatsApp phishing.

Cybercrime

US Posts $10 Million Reward Over Russian-Intelligence Signal and WhatsApp Phishing

A coordinated US law-enforcement push against a Russian-intelligence messaging-app campaign pairs a Rewards for Justice bounty with an FBI advisory on Signal backup-recovery-key theft.

Flat white line-art of a passport booklet beside a few scattered ID cards, on a Brick Rust background — one million passport records reported leaked online.

Data Breaches

One Million Passport Records Reported Leaked Online From Cannabis-Club App

Identity-data exposures continue at scale. A cannabis-club membership platform reportedly left nearly a million passports and ID photos reachable on the open internet with no password — a consumer-notification story for the week.

Flat white line-art of a phone with a chat bubble, an SMS form, and a key, on a Cobalt background — CERT-UA Russian-intelligence messaging-credential phishing.

Nation-State Cyber Threats

Ukraine and CERT-UA Document Russian Intelligence Phishing of Messaging Credentials

A Russian-intelligence campaign against messaging-app credentials, documented by Ukraine, uses fake support texts to coax Signal and WhatsApp users into surrendering the codes that unlock their accounts.

Flat white line-art of a balance-scale prediction panel beside a wallet form, on a Moss background — Polymarket user-fund theft after account compromise.

Data Breaches

Polymarket Discloses $3.1M User-Fund Theft After Vendor Compromise

A high-profile prediction-market disclosure of user-fund theft: a compromised third-party vendor injected a malicious script into Polymarket's frontend, draining roughly $3.1 million from eleven user wallets, with the platform pledging full refunds.

Flat white line-art of a smartphone cabled to a forensic analysis box beside a magnifier, on a Crimson background — Cellebrite use on activist iPhone after stated Russia cutoff.

Mobile Security

Cellebrite Tooling Documented on Jailed Activist's iPhone After Stated Russia Cutoff

Cellebrite's stated sales-restriction practice gets fresh scrutiny via human-rights documentation, after researchers tied its forensic tooling to a jailed Russian activist's iPhone months after the company said it had pulled out.

See all