Blog

Key quote: “General Motors sold the data of California drivers without their knowledge or consent and despite numerous statements reassuring drivers that it would not do so. This trove of information included precise and personal location data that could identify the everyday habits and movements of Californians… companies can’t just hold on to data and…

Key quote: Based on the review to date, the information involved varies by individual, the affected information may include one or more of the following, though not every data element was involved for every affected individual: … Biometric information (including fingerprints and palm prints); … precise geolocation data, credit or debit card numbers, financial account…

Key quote: 1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub’s internal repositories. Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately. Why it matters: One developer at…

Key quote: The use of an automated employment-related decision technology, as defined in section 7 of this act, shall not be a defense against a complaint alleging a discriminatory practice in violation of this subdivision. Why it matters: Connecticut’s SB 5, currently awaiting the governor’s signature, fundamentally breaks the “black box” defense for employers. While…

Key quote: Among the customer information the Bank has determined was disclosed are customer names, social security numbers and dates of birth. Why it matters: This probably isn’t just another boring data leak; it’s looks like this is the first time an employee YOLOed non-public banking data into a public LLM and forced their CEO…

Key quote: “There are — I mean, literally, at this point — hundreds and hundreds of studies involving thousands and thousands of people to show that when it comes to emotion, variation is the norm. The idea that emotions can be objectively measured or analyzed at all, in other words, is fantasy.” Why it matters:…

It was a pleasure joining Aashis Luitel and Tristan Ingold on Sprinto’s webinar today. We covered a lot of ground in an hour, but here’s what I keep coming back to: the worst thing leaders can do right now is wait. The timing of the webinar was comedy gold. Days before we chatted about AI…

I loved being a guest on today’s Cyber Risk Alliance webinar with Adrian and wanted to share some of my additional notes and thoughts in case you missed the live show (or prefer reading my weekly newsletter). The Mythos and Daybreak hype cycle’s missing the whole point. Niels Provos proved it with his IronCurtain framework: swap…

Key quote: The bill establishes consumer notice requirements, mandating that deployers provide clear and conspicuous notice to consumers at the point of interaction with a covered ADMT. A deployer is required to provide a consumer with a plain language description of a covered ADMT’s role within 30 days after the covered ADMT makes a consequential…

Key quote: Today’s agreement on the AI act significantly supports our companies by reducing recurring administrative costs. It ensures legal certainty and a smoother and more harmonised implementation of the rules across the Union, strengthening EU’s digital sovereignty and overall competitiveness. At the same time, we are stepping up the protection of children targeting risks…

Key quote: “Update – Canvas is now available for most users. Canvas Beta and Canvas Test remain in maintenance.” Why it matters: The May 2026 disruption of Canvas isn’t unique. It’s the predictable result of the underlying economics of an education sector that’s prioritized convenience over risk management. By consolidating the operations of thousands of institutions…

Key quote: All of Marquis Software Solutions, Inc.’s deadlines in the above-captioned action are stayed pending the parties’ mediation efforts. Why it matters: The litigation surrounding the Marquis Software Solutions breach is currently taking a break for mediation, as seen in the April 6, 2026, Order in In Re Marquis Software Solutions, Inc. Data Breach Litigation (Case…