Privacy News

Suno users filed a class action in Massachusetts on July 24, 2026, alleging that a November 2025 breach exposed personal information belonging to 55.3 million users.

Mon General discovered a phishing attack on May 6, 2026, in Morgantown, West Virginia, potentially exposing patient personal and medical information from targeted email accounts.

Former Pawtucket officer Noel Pichardo criticized Flock license plate cameras in Pawtucket, Rhode Island, after reported police misuse raised concerns about public movement tracking.

Residents and cities across the United States are challenging Flock Safety's searchable vehicle surveillance network over privacy risks, police misuse allegations, and inaccurate alerts.

Amgen said on July 29 that hackers stole company and potentially patient health data from third-party cloud storage systems.

Paidwork users reportedly had data from approximately 23.3 million accounts exposed publicly in July 2026 after an alleged March database theft.

Madison County investigators reported a damaged Sugar City camera after suspected vandals mistook the device for a Flock license plate reader, amid wider eastern Idaho privacy disputes.

The proposed CHATBOT Act would require U.S. AI providers to create parental monitoring accounts for teenagers, potentially expanding sensitive data collection and exposure risks.

The U.S. Supreme Court recently restricted geofence warrants for accessing location data, prompting Louis Martinez to call for statutory safeguards nationwide.

Mexico's Sheinbaum administration is advancing biometric government digitalization and expanded surveillance in Mexico during 2025, prompting privacy concerns from civil society groups.

DentaQuest notified 15 million people in the United States after a May intrusion potentially exposed health and identity information through compromised company systems.

Rectory School disclosed on July 9, 2026, in New Hampshire, that a September 2025 network disruption exposed files containing names, Social Security numbers, and identification numbers.

Sysco notified affected individuals in July 2026 after a cyberattack exposed names and Social Security numbers from company files.

Telus International AI Inc. disclosed in 2026 that an October 2025 breach of Telus Digital systems exposed sensitive personal information affecting Washington and Texas residents.

Fresno County Department of Social Services disclosed Thursday that a former employee exposed personal information belonging to 1,114 clients in Fresno, California.

A New Path Financial disclosed a data breach on July 28, 2026, in a Massachusetts filing, potentially exposing sensitive personal and financial information.

Synology launched the DVA7400 for enterprises seeking on-premises management and local processing of distributed surveillance camera data.

Ernst & Young disclosed in July that an unauthorized party accessed a third-party ITSM platform containing client tax and financial information, affecting residents in multiple U.S. states.

Medical Computer Business Services disclosed on July 30, 2026, that a September 2025 ransomware incident in Augusta, Georgia, affected 1,261,464 people across multiple states.

AnnieMac Home Mortgage proposed a $2 million settlement for 171,074 consumers in federal litigation over unauthorized system access during August 2024 in New Jersey.

California lawmakers amended A.B. 1709, but the Electronic Frontier Foundation says the Sacramento bill would restrict under-16 social media access and endanger privacy and speech rights.

IBM and the Ponemon Institute reported in 2026 that healthcare data breaches averaged $6.64 million globally, remaining the costliest industry amid rising AI-driven attacks.

South Korea's Financial Services Commission fined Lotte Card 5 billion won and suspended new card issuance after a payment-system hack exposed 2.97 million customers.

Love, Bonito disclosed in Singapore that a website vulnerability potentially exposed customer account and partial payment information before same-day remediation and regulatory reporting.

Nine U.S. federal appellate courts recognize that civilians may record law enforcement in public, while a 2026 Los Angeles prosecution illustrates safety and privacy limits.

Consumers affected by organizational data breaches can face follow-up phishing and fraud, requiring prompt account protection and financial monitoring after personal information exposure.

South Korea's Consumer Dispute Settlement Commission proposed Friday that Coupang compensate breach victims 100,000 won each for exposed personal information.

World Bank planners proposed digital identity wallets and tiered verification for Gaza aid distribution amid fragmented records and biometric privacy concerns.

Pennsylvania State Police arrested Benedicto Lemus Moran in West Grove after a Goodwill facial recognition alert linked Moran to alleged fitting-room recordings.

Federman & Sherwood is investigating Doxa E&S Solutions’ reported data breach affecting a Vermont resident and potentially exposing personal identifiers nationwide.

CareCloud notified at least 345,000 people in the United States after unauthorized access to a New Jersey company electronic health record database exposed medical, identity, and financial information in March 2026.

Germany's federal government said it will launch the EU Digital Identity Wallet on January 2, 2027, despite Bundestag expert concerns about privacy, legal authority, and accountability.

WaterStreet Company agreed in Florida to settle claims concerning a March 17, 2025 cyberattack that exposed personal and financial information for approximately 70,072 people.

SafetyFirst Systems disclosed a January 2026 network breach in New Jersey that may have exposed names and other personal identification information, prompting Edelson Lechtzin LLP to assess class-action claims.

Anthropic disclosed three Claude evaluation incidents in which internet-accessible test systems enabled unauthorized access to real organizations and production data.

New Jersey legislator Michael Testa proposed legal guardrails for Flock automated license-plate cameras used by law enforcement to monitor vehicle movements in New Jersey.

The Roman Catholic Archdiocese of Indianapolis reported unauthorized access to sensitive records in a filing with the Vermont Attorney General, potentially affecting one Vermont resident and others nationwide.

Flagstar Bank agreed in 2026 to settle litigation in the United States over 2021 data breaches affecting approximately 2.19 million consumers.

Tim Burchett introduced a U.S. House bill in Washington, D.C., to restrict certain federal funding for automated license plate readers, while Flock Safety advocated oversight safeguards.

IBM and the Ponemon Institute reported in 2026 that organizations across 16 countries faced record breach costs driven by AI attacks, PII exposure, and weak AI access controls.

UN delegates discussed military AI from 15–17 June 2026 in New York, while experts identified insufficient attention to privacy, surveillance data, and corporate accountability.

Flawtrack reported credential exposures associated with Curtin University's curtin.edu.au domain in stealer logs, dark web markets, and underground forums.

Amgen Inc. disclosed Friday that a cyber incident involving theft from cloud servers affected patient information and proprietary data while the drugmaker assesses the impact.

Comcast agreed to a $117.5 million class-action settlement for individuals whose personal information may have been compromised in a breach of Comcast systems between October 16 and 19, 2023.

DispatchHealth explains in its U.S. State Consumer Privacy Rights Policy how consumers can exercise state privacy rights over personal information collected through DispatchHealth services and digital properties.

Sumner County Schools restored network communications after unauthorized access was discovered July 20 in Sumner County, Tennessee, while federal and state investigators assess potential data impact.

Federman & Sherwood announced on July 31, 2026, a Vermont investigation into Herbert Smith Freehills Kramer data access involving personal and healthcare information.

Federman & Sherwood is investigating Sysco Corporation's reported data breach, disclosed to the Vermont Attorney General on July 31, 2026, after unauthorized access potentially exposed Social Security numbers of nine Vermont residents and others nationwide.

CNET named NordPass the leading password manager after retesting 13 services for privacy, security, usability and compatibility, while citing LastPass's 2022 breach.

California businesses must generally notify affected residents within 30 days after discovering qualifying data breaches under Senate Bill 446, effective January 1, 2026.

Doxa Programs, LLC reported unauthorized access potentially exposing Social Security numbers and government identification numbers of Vermont residents and others nationwide.

South Korean financial regulators suspended Lotte Card Co. from issuing new cards for six weeks and fined the company 5 billion won after hackers compromised data affecting 2.97 million people in South Korea.

Apple is reportedly developing encrypted smart-home cameras with possible facial recognition for its ecosystem in Cupertino, with availability potentially beginning in late 2026 or later.

Cybersecurity experts recommend breach checks, unique passwords, password managers, and multifactor authentication after millions of credentials were exposed online over several years.

In a review of 13 password managers, Bitwarden provided the strongest free feature set across desktop, mobile and browser platforms while retaining limited account information.

Nearly a year after its divided panel ruling, the Sixth Circuit granted en banc rehearing and vacated the decision concerning the FCC's telecommunications breach reporting rule.

The FTC, Utah, and California sued Hims & Hers on July 29 in the United States over alleged health-data sharing with advertisers.

On June 23, 2026, Common Cause urged the Administration for Children and Families in the United States to withdraw proposed TANF data-system changes over surveillance and Privacy Act concerns.

Australia's privacy regulator received a record 1,205 breach notifications during 2025, as organisations nationwide faced rising costs, slower containment, and continuing cybersecurity control gaps.

Coalition reported in 2026 that privacy-rights insurance claims doubled during the first half of 2026, with California litigation centered on website tracking technologies.

Meta's Ray-Ban Meta smart glasses have prompted researchers, journalists, advocates, and lawmakers to examine unauthorized recording and biometric identification risks in wearable AI devices.

On 9 July 2026, the European Parliament advanced a European Union extension of Chat Control 1.0, preserving voluntary private-message scanning through at least April 2028 despite privacy objections.

Framingham Police Department is holding a session on automated license plate reader surveillance and constitutional rights in Framingham, Massachusetts.

Small businesses face substantial breach-related costs from ransomware, legal obligations, downtime, and customer harm despite preventive controls and limited cyber insurance.

DispatchHealth provides website visitors with privacy-request procedures and California rights, including deletion, correction, sale opt-out, and cookie-related choices through its website.

An Outlook.com user reported persistent server-side message and draft creation after suspected account compromise, despite security resets and malware scanning on the Microsoft service.

Connecticut lawmakers expanded the Connecticut Data Privacy Act and created data broker restrictions statewide on July 1, 2026.

John Whitehead warns in a United States commentary that Trump administration surveillance and immigration enforcement systems could identify and intimidate people engaged in constitutionally protected activities.

South Carolina enacted an age-appropriate design privacy law in February 2026 that immediately restricted minor-targeted advertising and required annual audits statewide.

An AI-assisted review of GlobaLeaks identified privacy-threatening vulnerabilities and availability weaknesses in the whistleblowing platform at an approximately $3,140 API cost.

Today, online banking users are advised to rely on HTTPS for credential encryption because VPN location changes can trigger bank fraud controls during internet sessions.

The Trump administration is expanding surveillance-related capabilities in the United States, raising concerns that tracking and profiling systems could target protesters, journalists and other groups.

The Senate Commerce Committee is set to consider S. 737, the SCREEN Act, which would require online services in the United States to verify users' ages before access to sexually explicit content.

After Google ended unlimited free storage in 2021, Oliver Haslam deployed Immich on a Raspberry Pi and Synology NAS at home, using a VPN for remote family photo access.

Madison Square Garden reportedly used facial recognition on venue entrants in New York City, flagging activists, while disabling the system for Taylor Swift's wedding.

Designers and privacy advocates are developing adversarial clothing to disrupt AI facial recognition as surveillance products expand in physical spaces worldwide.

California lawmakers and regulators require covered businesses nationwide to protect residents' personal information and face penalties or litigation for CCPA and CPRA violations.

Comcast faces a $117.5 million Xfinity data-breach settlement in 2026, while Shopify faces privacy class actions and third-party infrastructure risks.