|
|
|
Here's everything important that happened in the cybers this week.
|
|
|
|
Aflac Data Breach Lawsuit Survives Motion to Dismiss, Heads to Discovery
|
|
|
On August 12, 2026, Judge Clay D. Land of the U.S. District Court for the Middle District of Georgia handed down an order Aflac had been fighting to avoid. The court largely denied Aflac's motion to dismiss the consolidated class action stemming from the June 2025 data breach. Core claims survive, and the case heads to discovery. What Happened in …
|
|
|
|
|
|
Your Local AI Model Might Be the Next Attacker
|
|
|
While the security press spent July transfixed by frontier lab agents escaping their sandboxes, somebody built a working offensive AI system from parts anyone can download and pointed it at a nation-state. Teardown of the Taiwan Attack In early July 2026, suspected Chinese cyber operatives used the open-source agent frameworks Hermes and OpenClaw to run a near-autonomous, four-day campaign against …
|
|
|
|
|
|
Local AI Solves a Privacy Problem, Not a Discovery Problem
|
|
|
Open-weight models have gotten good. Really good. Meta's Muse Glimmer, Nvidia's Nemotron 3.5 Lightning, and releases from Chinese AI labs like Moonshot AI and DeepSeek have narrowed the gap with frontier cloud models to the point where running capable AI on your own hardware isn't just a hobbyist project anymore. It's an infrastructure decision with real cost implications, and for …
|
|
|
|
|
|
Order Express Paid $250K Because Nobody Owned the Risk
|
|
|
If "cyber risk" is a myth, why did Order Express, Inc. just pay $250,000 to settle with the New York State Department of Financial Services (NYDFS) over cybersecurity violations On August 3, 2026, the NYDFS issued a Consent Order against Order Express, a Chicago-based money transmitter licensed to operate in New York. The company discovered a ransomware attack on September …
|
|
|
|
|
|
Halfway Through 2026, AI Regulation Is No Longer Theoretical
|
|
|
The second half of 2026 brings hard deadlines, so if you're still treating AI laws as a planning exercise, it's time to start operationalizing them. On both sides of the Atlantic, rules are landing, though they arrive in different shapes. The US is building a patchwork of federal directives and state laws. The EU is phasing its AI Act in …
|
|
|
|
In-person workshops
Instead of just doing PowerPoints based on my forthcoming book, Cyber Risk is a Myth, I'm doing in-person workshops instead. These should be fun! Come learn how to turn a vulnerability into a business case OR how to make the case for integrating your risk management. Maybe stop by if you're in the area?
|
And I'm currently working with ISACA, ISC2, and ISSA leaders to schedule more talks in Vancouver BC, Los Angeles, and other cities.
|
Words elsewhere
|
|
Thanks, and have a great weekend! This newsletter is published every Friday I'm in the office.
|
|
|
|
