GRC Report Staff

More than half of the cyber incidents recorded by the European Union’s cybersecurity agency last year were distributed denial-of-service attacks. Most were not especially damaging, but they were, however, remarkably easy to summon. A political statement, an election, a protest or another turn in the war in Ukraine could be enough. Hacktivist groups claimed 4,709 attacks against EU Member States during 2025, according to ENISA’s latest Threat Landscape report, and more than 89% involved DDoS attacks. Public administrations bore much of it.

The Spanish National Securities Market Commission (CNMV) published its annual reports on corporate governance and board remuneration on September 21, drawing together disclosures submitted by listed companies for the 2025 financial year. Spain’s listed companies reported greater adherence to the country’s Good Governance Code in 2025, even as the largest companies lost some ground on a measure the code is meant to encourage: independent oversight in the boardroom.

A study released Tuesday by France’s data protection authority, the CNIL, alongside the French Ministry of Labour and Solidarity and the French Association of Data Protection Officers (AFCDP), found that 55% of DPOs already consider the EU AI Act part of their responsibilities. Seventy-one percent would like their role formally extended to include compliance with the regulation.

New York will begin directing large frontier AI developers to register with the state in November, giving companies roughly two months to prepare before the central requirements of the state's RAISE Act take effect in January.

Europe’s data protection authorities have never lacked ways to punish a GDPR violation. They can warn an organization, reprimand it, order it to change what it is doing, restrict its processing or stop that processing altogether. And, of course, they can fine it. What has been less settled is how an authority should decide among those choices.

ASIC has found an improvement in climate-related financial disclosures under Australia’s new mandatory sustainability reporting regime, although the regulator says companies still have work to do on some of the disclosures that demand the most judgment. The Australian Securities and Investments Commission reviewed a sample of 40 sustainability reports lodged for financial years ending Dec. 31, 2025. Its findings provide an early picture of what mandatory reporting has changed after years in which companies largely disclosed climate information voluntarily.

Amway and two of its largest affiliates have agreed to a $225 million judgment to resolve allegations that they used unfair and deceptive practices to recruit people into Amway's multilevel marketing business and keep them buying products once they were there. Nearly all of the money would go to participants who lost money after being recruited by the two affiliates, World Wide Group LLC and Leadership Team Development Inc.