IT Security & Privacy

The Privacy Commissioner of Canada has published new guidance explaining how financial reporting entities should seek approval for codes of practice governing the sharing of personal information to detect money laundering, terrorist financing, and sanctions evasion. On its face, the document is procedural. It explains what organizations need to submit and what the Commissioner will expect before approving a code. But procedural documents often reveal where policymakers believe the difficult work actually lies, and this one suggests the challenge is no longer whether institutions should collaborate. It is how they can do so without weakening the privacy protections that made collaboration difficult in the first place.

In guidance published Tuesday, Luxembourg's Commission de Surveillance du Secteur Financier (CSSF) warned that frontier artificial intelligence models are reshaping the cyber threat landscape by accelerating the speed, scale, and sophistication of attacks. While the technology presents significant opportunities, the regulator said it also gives malicious actors new tools to automate complex tasks, generate sophisticated code, and exploit vulnerabilities more quickly than traditional defensive practices were designed to withstand.

For all the attention artificial intelligence receives in boardrooms, one number in KPMG's latest cybersecurity survey stands out because of how ordinary it is. Only 24% of large organizations say AI is fully integrated into their cybersecurity programs. The rest are somewhere in between, testing it in isolated functions, weighing its value, or waiting for confidence to catch up with capability.

There were 1,205 data breaches reported to the Australian privacy regulator in 2025. The new figures, released by the Office of the Australian Information Commissioner, show an 8% increase over the 1,112 notifications received in 2024. They do not necessarily mean organizations have become less secure; they do show that serious breaches remain a persistent feature of Australian business and government, and that reporting obligations under the Notifiable Data Breaches (NDB) scheme continue to generate a steady stream of disclosures whenever individuals are likely to face serious harm.

A cyberattack that corrupts data presents a different kind of crisis from one that simply takes systems offline. Restoring servers is one challenge. Restoring confidence that the information inside them can still be trusted is another. Denmark's financial authorities chose that distinction as the foundation for a new operational resilience exercise whose conclusions reached well beyond the fictional attack itself.

For years, cybersecurity has rested on a bargain that most organizations scarcely questioned. Not every asset could receive the same level of protection, so security leaders concentrated their attention where the consequences of failure would be greatest. The systems most critical to the business became the crown jewels. Everything else received what time, people and budgets allowed. It was an imperfect arrangement, but for a long time it was a practical one.

New rules introduced by the Australian Communications and Media Authority now require mobile network operators to publish standardized 4G and 5G coverage maps using four common ratings (good, moderate, basic and no coverage) alongside plain-English explanations of what each category actually means. The maps must be refreshed at least every three months, giving Australians a consistent basis for comparing competing networks.