IT Security & Privacy

The legal fight over Bunnings may be over, but the Office of the Australian Information Commissioner is making sure its lessons are not left behind in a tribunal ruling. The regulator on Tuesday published updated guidance for organizations covered by the Australian Privacy Principles that are considering deploying facial recognition technology in busy, publicly accessible spaces such as retail storefronts. The revisions are not a change in the law. They are a statement of how the Office of the Australian Information Commissioner (OAIC) intends to apply it after the Administrative Review Tribunal's March 2026 decision in the long-running Bunnings case.

Anthropic’s Mythos did not merely find a weakness in a computer network. In testing, it followed the weakness through. The frontier artificial intelligence model identified vulnerabilities, developed exploits and carried an attack across multiple stages, adjusting its approach with limited human oversight. In some attempts, it completed a full network takeover. OpenAI’s GPT-5.5, released weeks later, showed similar capabilities and performed slightly better on a benchmark of expert-level cybersecurity tasks.

Since May, regulators, banks and financial infrastructure operators in Singapore have been sitting around the same table, confronting a problem that is becoming harder to dismiss with each new generation of artificial intelligence. On Tuesday, that quiet collaboration acquired a name. The Monetary Authority of Singapore (MAS) and the Association of Banks in Singapore (ABS) formally launched the AI-Driven Cyber and Technology Risk Taskforce, or ACT, an industry-wide initiative intended to strengthen the financial sector's defenses against threats created by frontier AI models.

The Italian Data Protection Authority imposed a €2 million fine on Lusha, the U.S.-based data broker, ordering it to stop processing the personal data of individuals in Italy while deleting the data it already holds. Read closely, the ruling is less about the existence of a commercial contact database than about what happens when that database is continuously refreshed, expanded and monetized over time.

Poland's Data Management Act took effect Thursday, completing a piece of legal architecture that has been waiting for its final support. The European Union's Data Governance Act has applied across the bloc since 2023. What entered into force now is the national legislation that gives the regulation a fully functioning home inside Poland's legal system.

A Chick-fil-A One account contains more than reward points. It can also hold payment methods, gift card balances, and enough personal information to make it worth trying a password that worked somewhere else. That, according to breach notification letters first reported by BleepingComputer, is what happened in June, when attackers used credentials stolen from an unrelated source to gain access to a limited number of customer loyalty accounts. The campaign did not depend on breaking into Chick-fil-A's systems. It depended on customers reusing passwords.

Poland recorded roughly 270,000 cybersecurity incidents last year, according to the country's Personal Data Protection Office. That was a 150% increase over 2024. The agency says it is seeing the same trajectory in reports of personal data breaches.