IT Security & Privacy

The legal fallout from 23andMe's 2023 data breach is now colliding with the company's bankruptcy proceedings. A coalition of 42 state attorneys general announced Tuesday that it has reached an $18 million settlement with the bankruptcy trustee for 23andMe, resolving allegations that the genetic testing company failed to implement reasonable safeguards before a breach that exposed the information of 6.9 million customers worldwide.

The Canadian Securities Administrators did not set out to measure how many firms had suffered cyber incidents. Instead, it examined something more revealing: whether the safeguards meant to prevent those incidents were keeping pace with the way financial firms now operate.

The European Data Protection Board is attempting to answer some of the questions that have lingered around the GDPR almost since the regulation took effect. When is data truly anonymous? What obligations apply when developers scrape the web to train generative AI? And how should organizations think about personal data on blockchain networks?

Nearly two-thirds of the small and medium-sized businesses surveyed by the European Union’s cybersecurity agency had heard of the Cyber Resilience Act. Knowing that a law exists, however, is not the same as knowing what to do about it.

Five Dutch regulators have asked the government and corporate sector to reconsider a choice that rarely feels momentous when it is made: who supplies the technology beneath the business.

The Privacy Commissioner of Canada has published new guidance explaining how financial reporting entities should seek approval for codes of practice governing the sharing of personal information to detect money laundering, terrorist financing, and sanctions evasion. On its face, the document is procedural. It explains what organizations need to submit and what the Commissioner will expect before approving a code. But procedural documents often reveal where policymakers believe the difficult work actually lies, and this one suggests the challenge is no longer whether institutions should collaborate. It is how they can do so without weakening the privacy protections that made collaboration difficult in the first place.

In guidance published Tuesday, Luxembourg's Commission de Surveillance du Secteur Financier (CSSF) warned that frontier artificial intelligence models are reshaping the cyber threat landscape by accelerating the speed, scale, and sophistication of attacks. While the technology presents significant opportunities, the regulator said it also gives malicious actors new tools to automate complex tasks, generate sophisticated code, and exploit vulnerabilities more quickly than traditional defensive practices were designed to withstand.