GRC Report Staff

Diopsys Inc., a medical device company based in Pennsylvania, is reaching into its coffers to settle a significant legal matter, agreeing to pay up to $14.25 million to resolve allegations of submitting false claims to Medicare and Medicaid. The claims were tied to the company’s NOVA device, a piece of equipment cleared by the FDA for visual evoked potential (VEP) testing. But it turns out, the device was being used in ways it wasn’t approved for—something the government says led to false claims for payment from both Medicare and Medicaid.

The financial landscape in Europe is facing increased pressure, as a combination of geopolitical tensions and escalating cyber risks poses a significant threat to the stability of the EU's financial system. This warning comes from the European Supervisory Authorities (ESAs) in their Spring 2025 Joint Committee update, released today. The EBA, EIOPA, and ESMA are calling for heightened vigilance and a proactive approach to safeguard the future of Europe's financial institutions and markets.

South Korea’s Personal Information Protection Commission (PIPC) has hit Woori Card with a massive fine of KRW 13.45 billion (roughly $9.1 million) following a major data breach. This decision comes alongside a set of corrective measures designed to overhaul the company’s data management practices, including stricter access controls, better employee training, and tighter oversight of personal information handling.

It’s no secret that banks are under increasing pressure to understand and manage their environmental, social, and governance (ESG) risks, and Banca d’Italia’s latest report on ESG disclosures shows just how challenging that can be. As the financial world moves toward a more sustainable future, Italian and European banks are slowly but surely stepping up to the plate—despite facing significant hurdles. Banca d’Italia’s Notes on Financial Stability and Supervision No. 45 delves into the current state of ESG risk assessment, tracking the progress these banks have made while highlighting the areas still in need of improvement.

Advanced Computer Software Group Ltd (Advanced) has been slapped with a £3.07 million fine following a ransomware attack that compromised the personal data of 79,404 individuals. The fine comes after the company’s health and care subsidiary failed to implement sufficient security measures, leaving their systems vulnerable to a cyberattack that had widespread repercussions for critical healthcare services.

In what is sure to be a controversial turn of events, the U.S. Securities and Exchange Commission (SEC) has decided to pull back from its defense of the much-debated climate disclosure rules. A move that may change the course of corporate environmental regulation, the SEC’s vote today marks a shift in its approach to climate-related corporate transparency.

Ofcom has imposed a £1.05 million fine on Fenix International Limited, the operator behind OnlyFans, for failing to provide accurate information about its age assurance measures. This penalty comes after the company provided misleading responses to formal requests made by the regulator in 2022 and 2023, raising concerns over its age verification processes for users.