Judge orders Meta to pay $25B over Facebook privacy deception

New Mexico judge orders Meta to pay $25 billion in Facebook privacy case

A New Mexico state District Court judge, Francis J. Mathew, ordered Meta to pay $25 billion in civil penalties for deceiving Facebook users about privacy, the largest penalty against the company to date. The ruling came in the state’s Cambridge Analytica case under the Unfair Practices Act, following a September trial in which jurors found Meta liable for over 43 million violations. The court said Facebook falsely promised users they controlled their data. State Attorney General Raúl Torrez called the judgment a signal to Silicon Valley. Meta’s chief legal officer C.J. Mahoney said the ruling makes doing business in New Mexico all but impossible and vowed to win on appeal. The FTC previously fined Meta $5 billion in 2019 over the scandal.

Meta Ordered To Pay New Mexico $25 Billion For Deceiving Facebook Users About Privacy →

Topics: MetaData breach fines and settlements

Federal judge rules OPM illegally shared worker records with DOGE

Judge Denise Cote of the U.S. District Court for the Southern District of New York ruled that the Office of Personnel Management violated federal privacy law and flouted cybersecurity practices by giving Department of Government Efficiency agents access to records for tens of millions of past, current and aspiring federal workers. Cote found no credible reason for the access and said the government offered no support that modernization required personally identifiable information. The case was filed in February 2025 by federal workers and unions including the American Federation of Government Employees; a preliminary injunction followed in June. Cote has yet to decide remedies, and the workers have asked the court to mandate deletion of extracted data. OPM, the White House and the Justice Department did not respond to requests for comment.

OPM illegally shared millions of employee records with DOGE, federal judge rules →

Critical PHP2shell flaw, found with AI help, raises Australian breach risk

Australians should expect more data breaches after critical vulnerabilities were found in PHP, the back-end web architecture used by an estimated seven in 10 websites and applications, including WordPress and Wikipedia. The flaws, dubbed PHP2shell, existed for over a decade and would let attackers run code on affected servers without logging in. The PHP Foundation released a fix and urged immediate updates. Security expert Troy Hunt warned operators to patch fast or go offline. Amazon Web Services saw exploitation attempts as early as October 17. The Australian Signals Directorate issued a rare critical alert, and GovCMS, Moodle and VentraIP took protective steps. U.S. firm Calif identified the flaw using OpenAI models, which warned the same capabilities could help attackers.

Australians face spike in data breaches after AI helps uncover ‘critical’ website flaw →

Topics: Zero-day vulnerabilitiesAI-discovered vulnerabilities and AI bug-report slop

Chicago lawsuits accuse delivery robots of collecting biometric data

Two Chicago residents filed class-action lawsuits against Coco Robotics and Serve Robotics, alleging the delivery robot companies collected biometric data without permission. The robots arrived via DoorDash and Uber Eats even though robot delivery had not been requested in the apps. The suits claim that when the men unlocked the cargo bays, their hands and faces were scanned via camera and LiDAR without explicit prior consent, breaching the Illinois Biometric Information Privacy Act. They also claim video and sensor data is retained and shared with AI companies for training. The plaintiffs seek $1,000 per negligent violation or $5,000 per intentional or reckless violation. Both companies deny the allegations; Coco called the suit frivolous and said it has not collected biometric data in Chicago.

‘Sidewalk surveillance’: Illinois residents accuse delivery robots of capturing biometric data without permission →

Topics: Biometrics