Privacy
Meta hack hits 1,500 people as 15 NHS staff fired over record snooping
Meta confirms stolen GitHub credentials exposed data on 1,500 people, while an NHS trust sacks 15 staff for accessing Nottingham attack victims' records.
This edition was produced with artificial intelligence. Text and voice are generated automatically.
Meta says hackers stole code and data on 1,500 people via stolen GitHub credentials
Hackers accessed some of Meta’s GitHub repositories using an employee’s stolen credentials and took personal data on about 1,500 people, most of them US-based Meta employees. Meta told SecurityWeek it detected the intrusion a few weeks ago, cut off access and brought in GitHub and law enforcement; notifications began going out on Tuesday, 13 October. Business data, mainly software code, made up about 99% of what was taken. The personal data should not have been in the repositories at all, having been added by mistake in violation of company policy. Meta says no Meta product vulnerability was involved and internal systems were not breached, and it has rotated secrets and added controls to keep user data off GitHub.
Meta says hackers stole code and data on 1,500 people, SecurityWeek reports →
Topics: MetaThird-party and vendor breaches
Hackers steal personal data of millions of California students from testing contractor ETS
Hackers stole personal data of millions of current and former California public school students from the Educational Testing Service, which handles the state’s mandated Smarter Balanced tests. The California Department of Education said an unauthorized party used a compromised login credential to access the site and copy files at various times between 22 May and 18 September 2026; ETS discovered the hack on 25 September and districts were told on 2 October. Exposed data includes names, addresses, disability records, dates of birth, student ID numbers, race, language and English learner status. Social Security numbers, financial data and parent information were not taken. Affected former students can get 24 months of free identity-protection services.
Hackers steal personal data of millions of California students in massive breach →
Topics: Third-party and vendor breaches
NHS trust fires 15 staff over accessing Nottingham attack victims’ records
Nottingham University Hospitals NHS Trust confirmed it sacked a total of 15 members of staff over inappropriate access to the medical records of the victims of the 2023 Nottingham attacks. The trust said those actioned included doctors, nurses, registered healthcare professionals and other staff, and that it had informed the Nursing and Midwifery Council, the General Medical Council, the Information Commissioner’s Office and Nottinghamshire Police. Health Secretary Yvette Cooper called the breaches a disgrace and said she expected action against staff who violate NHS data and privacy standards. Barnaby Webber, Grace O’Malley-Kumar and Ian Coates were stabbed to death on 13 June 2023 by Valdo Calocane. Grace’s father, Dr Sanjoy Kumar, said he was appalled and called for action.
NHS data breaches a disgrace, says health secretary →
Topics: Police misuse of surveillance databases
Sainsbury’s restarts live facial recognition at East Dulwich with no opt-out
Live facial recognition has resumed at Sainsbury’s East Dulwich store after a pause, Facewatch confirmed. The system was halted after shopper Matt Arnold was wrongly flagged as a shoplifter and escorted out this summer. The technology scans faces on entry, maps biometric measurements and checks them against a watchlist; non-match biometric data is deleted in milliseconds, though photo crops of detected faces are held up to seven days. Retailers rely on legitimate interest to bypass consent, with in-store notices pointing to Facewatch’s privacy policy. Sainsbury’s began trialling the tech in September 2025 and plans to expand it to 200 stores in 2026. Big Brother Watch called the system indiscriminate by design, and a petition to halt facial recognition has passed 41,000 signatures.
Topics: Facial recognition
New Jersey remote worker sues Sutherland over AI webcam monitoring and firing
A New Jersey remote worker has sued Sutherland Healthcare Solutions under state discrimination law, alleging the company required webcam photos every three minutes inside her home, ran facial recognition on each image and fired her after she sought a medical accommodation to reduce the monitoring’s frequency. The lawsuit says Sentinel AI, which Sutherland built and patented itself, captured her image roughly 160 times a day before her 8 September firing. She had worked at the company more than a decade, remotely since 2018, with strong performance reviews. Her doctor sought fewer photos because stress worsened a medical condition. The suit says the accommodation process never took place and her choices were the camera, a six-hour daily commute or losing her job.
New Jersey worker says employer's AI photographed her at home every 3 minutes, then fired her →
Topics: Workplace surveillance and employee monitoringBiometrics
Supreme Court leans toward privacy win in Salazar v. Paramount video-tracking case
The Supreme Court appeared likely to side with a customer suing Paramount Global under the Video Privacy Protection Act during oral arguments in Salazar v. Paramount Global, though several justices signaled they might constrain such suits later. Michael Salazar viewed college football videos on a Paramount-operated site that installed a tracking pixel logging his personally identifiable information and sharing it with Facebook. The VPPA, enacted after a reporter obtained Robert Bork’s video-rental history in 1987 and updated in 2013 for streaming, lets consumers sue video tape service providers for disclosing such data without consent, with up to $2,500 in damages. Lower courts dismissed the case; a decision is expected by the end of June.
The Supreme Court Is Leaning Toward a Digital Privacy Victory →
Topics: Online tracking
Harrigan bill would curb license plate reader searches and 24-hour data retention
Rep. Pat Harrigan, R-N.C., introduced a bill Thursday tightening restrictions on automated license plate readers including Flock cameras. It would bar agencies from categorizing vehicles by expressive attributes such as political or religious bumper stickers, flags or decals, and block searches targeting political or religious activity, civil immigration violations, parking or non-moving violations, debts and civil penalties. Most searches would need a probable cause warrant, with exceptions for immediate threats to life or safety. Records would be deleted within 24 hours except for warrants, emergencies and court orders, searches would be logged and audited, and vendors could not sell ALPR data or use it to train AI. States without qualifying protections could lose 10% of certain federal criminal justice funding.
Your bumper sticker could help Flock cameras track where you go — new bill aims to stop it →
Topics: License plate readers (ALPR)Flock Safety
Eiliko robot toy exposed 13 million conversations on unprotected Chinese servers
Security researcher Sammy Azdoufal found that Energize Lab’s Eiliko robot toy stores user conversations and profiles on unprotected Chinese servers. He could read 13 million conversations from tens of thousands of people and access the entire active worldwide fleet of 68,000 toys; the largest market is the United States, with over 31,000 profiles belonging to children. The service builds profiles covering name, age, profession, family, pets and personality assessments, stored alongside email and IP addresses. Energize Lab also stores unencrypted photos of children and audio recordings at public web addresses, despite a privacy policy stating recordings are encrypted and deleted after processing. Many admin passwords were common ones. Azdoufal remotely hijacked one toy’s language model.
Topics: Smart devices privacyExposed databases and cloud misconfigurations
Study finds 73.7% of Indian company websites lack consent banners before DPDP rules
A scan of 1,680 company websites found 73.7% had no consent banner detected, meaning non-essential tracking runs without the free, specific and informed consent the Digital Personal Data Protection Act, 2023 requires. The white paper, The State of DPDP Readiness in India, was produced by Bengaluru-based ComplyDP and checked public websites against disclosure requirements from the Act and the DPDP Rules, 2025. Other gaps: 63.3% showed no parental consent mechanism, against children’s data obligations carrying a maximum penalty of Rs 200 crore; 19.8% had no privacy notice link at all. Retail (92.3%) and food and beverages (87.3%) were furthest behind. The DPDP Rules were notified on 13 November 2025, with core obligations applying from 13 May 2027.
Topics: Cookies and consent
MEP Lena Schilling among 50 lawmakers targeted by nude deepfakes
Austrian Green MEP Lena Schilling learned last month that nude deepfakes of herself were circulating online, digitally altered from one of her first press conferences. She is one of 50 MEPs, 46 of them women, targeted by sexualised deepfakes, according to a report by Berlin-based thinktank Agora Digitale Transformation. An earlier ADT report found 138 female parliamentarians from 22 EU countries had been affected, and that women were 33 times more likely than male colleagues to be depicted in deepfake pornography. A letter initiated by Schilling and German Green MEP Terry Reintke, signed by 119 MEPs, called on EU officials to pair a forthcoming ban on AI undressing apps, due to take effect on 2 December, with enforcement mechanisms.
Topics: Deepfakes
UK legal services firm Co-op uses OpenAI models to score every employee call
The Co-op, a UK legal services company, is using OpenAI models to constantly record and monitor employee calls and evaluate interactions with customers, according to The Guardian. A whistleblower described the system as oppressive and dystopian, saying the AI is trained to assess more than 50 aspects of each phone call and assign pass and fail scores. Depending on call volume, workers are sometimes monitored by AI for up to several hours each day. The Co-op downplayed the characterizations and called AI a key aspect of its quality assurance processes, used only as a support tool rather than a decision maker. The Communication Workers Union said unaccountable computer systems should not be people’s managers. A survey estimates 61% of US workplaces already use AI analytics software to gauge productivity.
Bosses Deploying AI-Powered Spyware That Watches Workers Constantly →
Topics: Workplace surveillance and employee monitoring
Smart TVs use automatic content recognition to track viewing, often hard to disable
Smart TVs use Automatic Content Recognition to capture screenshots every few seconds, or multiple times per second, identifying what is watched across built-in apps, streaming services, consoles and streaming boxes. TVs also capture IP address, Wi-Fi details, app usage patterns and, through voice remotes or assistants, short audio snippets. Data is fingerprinted and uploaded to manufacturers, and processed data may be sold to data brokers who combine it with other information to build profiles. Vizio’s Platform+, which includes FAST TV, ads and sponsorships, made $598 million in 2023, and analysts predict the ACR market will reach $23.37 billion by 2034. Disabling ACR varies by manufacturer and may affect other features, and TVs may re-enable it after software updates.
Your Smart TV Has One Big Problem: It’s Tracking What You Watch →
Topics: Smart devices privacyOnline tracking
Experts warn parents over uploading children’s photos to AI tools
Experts are urging parents to think carefully before uploading photographs of their children to artificial intelligence tools, amid concerns over how images could be stored, reused or shared. The warning comes as some parents have used AI to remove watermarks from school photos to avoid paying for them. George Martin of South West Grid for Learning said the issue is understanding what happens to images once uploaded, and that most platforms let users change settings to stop content being used for training. Dr Simon Thorne of Cardiff School of Technologies said people should never upload personally identifiable photos. Martin noted each photograph carries metadata, particularly school photos, including where it was taken and possibly the school, which can help others find information about the child.
Is it safe to upload photos of your child to AI? →
Topics: Children's online safety
Local-storage video doorbells cut cloud fees and keep footage in your hands
Video doorbells from brands including Arlo, Ring and Nest require a paid subscription for cloud storage of recordings and other features, while local-storage models avoid recurring fees. A microSD card is a one-time cost, and some models such as the Eufy E340 include built-in storage, though the E340 offers as little as 8GB. Some doorbells store recordings on a companion hub, which over time costs significantly more than a microSD card. Local storage still allows remote access to live feeds and recordings, but a corrupted card risks losing everything. It also gives the owner sole access to footage and removes the risk of a cloud provider being hacked or leaking video, though data cannot be recovered if the doorbell is stolen.
3 Reasons To Buy A Local Video Doorbell Instead Of Another Cloud Subscription →
Topics: Smart devices privacy