A family’s ordinary afternoon was shattered when an unknown number added multiple relatives, including a teenager, to a group chat and shared what appeared to be AI-generated explicit images of a family member, the Wall Street Journal (WSJ) reported. The goal was simple: to extort money by threatening to release the images more widely.
cybersecurity
Cybersecurity Coalition Calls for Collective Action as AI Changes the Threat Landscape
By Joseph J. Lazzarotti & Damon W. Silver on
Posted in Artificial Intelligence, Cybersecurity
A broad coalition of artificial intelligence developers, cybersecurity companies, financial institutions, technology providers, and other organizations has issued an open letter calling for a coordinated effort to strengthen cyber defenses.
“We have a limited window to strengthen cyber defenses.”
The letter warns that AI-enabled cyberattacks have become more widespread and sophisticated. At the same…
Proposed State Laws For Breach Notification Could Reshape Incident Response Plans
By Joseph J. Lazzarotti on
Posted in Data Breach Notification
State breach-notification laws continue to evolve, and legislatures are using 2026 sessions to tighten consumer protections and shift the civil liability landscape that often follows a cyber event.
For businesses, the practical takeaway is that incident response planning increasingly needs to account not only for “whether notice is required,” but also for hard timelines, regulator-facing…
Top 10 Privacy, AI & Cybersecurity Issues for 2026
Posted in Consumer Privacy
As Data Privacy Day 2026 approaches, organizations face an inflection point in privacy, artificial intelligence, and cybersecurity compliance. The pace of technological adoption, in particular AI tools, continues to outstrip legal, governance, and risk frameworks. At the same time, regulators, plaintiffs, and businesses are increasingly focused on how data is collected, used, monitored, and safeguarded.…
The Hidden Legal Minefield: Compliance Concerns with AI Smart Glasses, Part 4: Data Security, Breach Notification, and Third-Party AI Processing Risks
Different Country, Same Challenges: Lessons from a Breach That Could Have Been Prevented
By Joseph J. Lazzarotti on
Posted in Data Security, Information Risk
A recent breach involving Indian fintech company Kirana Pro serves as a reminder to organizations worldwide: even the most sophisticated cybersecurity technology cannot make up for poor administrative data security hygiene.
According to a June 7 article in India Today, KiranaPro suffered a massive data wipe affecting critical business information and customer data. The…
Industry Groups Urge Rescission of Proposed HIPAA Security Rule Updates
By Joseph J. Lazzarotti & Cecilie E. Read on
Posted in Health Information Technology, HIPAA
In February, a coalition of healthcare organizations sent a letter to President Donald J. Trump and the U.S. Department of Health and Human Services (HHS) (the Letter), urging the immediate rescission of a proposed update to the Security Rule under HIPAA. The update is aimed at strengthening safeguards for securing electronic protected health information.…
FAQs for Schools and Persons Affected By the PowerSchool Data Breach
A massive data breach hit one of the country’s largest education software providers. According to EducationWeek, PowerSchool provides school software products to more than 16,000 customers, largely K-12 schools, that serve 50 million students in the United States. According to reports, PowerSchool informed customers that, on December 28, 2024, PowerSchool became aware of…
Tips for Vacation Rental, Property Mgmt. Businesses Facing Vendor Cybersecurity Risk
No organization can eliminate data breach risks altogether, regardless of industry, size, or even if the organization has taken significant steps to safeguard their systems and train employees to avoid phishing attacks. Perhaps the most significant reason these risks remain: third-party service providers or vendors.
For most businesses, particularly small to medium-sized businesses, service providers…
DOL Expands Fiduciary Obligations for Cybersecurity to Health and Welfare Plans
A little more than three years ago, the U.S. Department of Labor (DOL) posted cybersecurity guidance on its website for ERISA plan fiduciaries. That guidance extended only to ERISA-covered retirement plans, despite health and welfare plans facing similar risks to participant data.
Last Friday, the DOL’s Employee Benefits Security Administration (EBSA) issued Compliance Assistance Release…