IT Security & Privacy

The Information Commissioner's Office did not describe the Metropolitan Police Service's latest data protection failures as isolated mistakes. After investigating two unrelated disclosures of highly sensitive personal information, the regulator concluded that both pointed to the same underlying problem: basic safeguards had been allowed to weaken inside one of Britain's largest police forces.

Italy's data protection authority has fined telecommunications provider TIM €9.516 million, concluding that failures in the company's telemarketing operation extended well beyond nuisance calls. According to the regulator, unauthorized call centers funneled unlawfully obtained customer information into TIM's legitimate sales network, exposing weaknesses in the company's oversight of third-party partners and turning illegally obtained contacts into apparently valid customer contracts.

The European Commission said that it has reached preliminary findings that TikTok's default account settings for minors do not meet the child protection standards required under the Digital Services Act, accusing the platform of exposing young users to unnecessary risks from the moment they create an account. The findings stop short of a final decision, but they mark another significant step in the Commission's increasingly broad scrutiny of TikTok's design.

Someone looking for treatment through Hims & Hers could reasonably believe they were beginning a conversation with a medical provider. The company's advertising invited them to connect with a clinician, discuss their symptoms, and determine whether a prescription made sense. According to the Federal Trade Commission, many consumers were doing something else entirely. They were setting a recurring subscription in motion before that conversation ever happened.

The Cybersecurity and Infrastructure Security Agency has released an updated framework for Software Bills of Materials, broadening the minimum information organizations should include when documenting software components as governments and businesses place growing emphasis on software supply chain security.

The legal fight over Bunnings may be over, but the Office of the Australian Information Commissioner is making sure its lessons are not left behind in a tribunal ruling. The regulator on Tuesday published updated guidance for organizations covered by the Australian Privacy Principles that are considering deploying facial recognition technology in busy, publicly accessible spaces such as retail storefronts. The revisions are not a change in the law. They are a statement of how the Office of the Australian Information Commissioner (OAIC) intends to apply it after the Administrative Review Tribunal's March 2026 decision in the long-running Bunnings case.

Anthropic’s Mythos did not merely find a weakness in a computer network. In testing, it followed the weakness through. The frontier artificial intelligence model identified vulnerabilities, developed exploits and carried an attack across multiple stages, adjusting its approach with limited human oversight. In some attempts, it completed a full network takeover. OpenAI’s GPT-5.5, released weeks later, showed similar capabilities and performed slightly better on a benchmark of expert-level cybersecurity tasks.