Privacy
Meta Pixel health-tracking class action certified; Google cuts off Videostrong over XCPE backdoor
Meta must face four certified classes over medical data captured by its Pixel, while Google bans a TV-box maker for a backdoor in 1.3 million devices.
This edition was produced with artificial intelligence. Text and voice are generated automatically.
Judge certifies four classes in Meta Pixel medical-data lawsuit
Judge William H. Orrick of the US District Court for the Northern District of California certified four classes of Facebook users accusing Meta of collecting sensitive medical information through Meta Pixel tracking technology, in an order issued 30 October. The classes cover patient portal and appointment clicks, health information, prescription drug data and device intrusion. Plaintiffs say Meta received patient data from at least 664 hospital systems or provider web properties without consent or valid HIPAA authorizations. The suit raises breach of contract, intrusion upon seclusion and California computer and privacy law claims, not a direct HIPAA claim. Meta says providers control Pixel configuration and that filters keep health data out of ad systems. Certification is not a liability finding.
Topics: MetaHealthcare data breaches
Google bans Videostrong after backdoor found in 1.3 million Android TV boxes
Google has severed ties with Shenzhen-based Android TV box manufacturer Videostrong over a pre-loaded backdoor dubbed XCPE found in more than 1.3 million set-top boxes. The malware evaded Google’s screening, disabled Play Protect and enrolled infected devices in a botnet that Google has since shut down. Synthient, working with Google, identified at least 182 infected device models, including the Mecool KTI and white-label boxes; the malware also appeared in telehealth devices, karaoke machines and digital signage. Google says the botnet enabled ad fraud, data theft, screenshot capture, keystroke injection and remote shells. TrendMicro counted 1,472,554 infected devices. Google banned Videostrong and affiliates from certified Android manufacturing and is tightening firmware integrity checks.
Topics: Malware & infostealers
Sony smart TV privacy suit proceeds after judge rejects arbitration
Senior US District Judge Marilyn Huff denied Sony Electronics’ bid to compel arbitration in a class action alleging its smart TVs secretly tracked viewing habits and shared the data with advertisers. Plaintiffs say Sony’s automatic content recognition technology captures audio and video fragments, turns them into fingerprints and shares them with third parties including Samba TV and Google, building profiles shareable across devices; Sony has used it since at least 2017. Huff found Sony effectively hid the arbitration clause in a document titled limited warranty, giving consumers no fair notice. She kept California constitutional privacy and public-disclosure claims alive and dismissed 12 others with leave to amend. Sony’s untimeliness argument was deferred.
Sony smart TV privacy suit survives as judge rejects arbitration bid | Courthouse News Service →
Topics: Smart devices privacy
EDPS fact-finding into Europol’s Pressure Cooker data tools
The European Data Protection Supervisor has confirmed a months-long fact-finding exercise into Europol, focused on the Pressure Cooker, a set of tools created by Europol’s Internet Referral Unit for fast-track processing of data scraped from the internet. The scrutiny follows reporting based on anonymous testimony from senior Europol officials and leaked documents describing a data repository in Europol’s Computer Forensics Network holding sensitive personal data without full safeguards. Internal 2019 documents cited insufficient logging, weak password management and no reliable way to track access. Europol rejects the allegations as incorrect and says it engaged proactively with the EDPS. The EDPS is weighing whether further supervisory action is needed; Europol plans to migrate to a New Forensic Environment, with full CFN decommissioning tied to transfers scheduled for early 2027.
Watchdog investigates Europol over ‘irregular’ data processing claims | Computer Weekly →
Topics: Europol data practices
Florida deputy accused of using Flock plate readers to track estranged wife
A former Pinellas County, Florida sheriff’s deputy used an automated license plate reader system more than 100 times to track his estranged wife, her new boyfriend and other family members, according to Sheriff Bob Gualtieri. Ronald Scott, 35, resigned a day before his arrest on November 5 after 10½ years with the department. He faces three counts of accessing a computer or electronic device without authority and one count of official misconduct. An enhanced system audit caught the searches, which ran from Valentine’s Day to June 19. Gualtieri defended the technology, saying misuse is a people problem, not an ALPR problem, and noted Scott is the third Pinellas deputy arrested for similar misuse in recent months.
Deputy Accused Of Using Flock To Track Estranged Wife →
Topics: Flock SafetyPolice misuse of surveillance databasesLicense plate readers (ALPR)
Apple to scan publicly shared iCloud links for harmful content
Apple plans to moderate publicly accessible iCloud share links starting with version 27.3 of iOS, iPadOS, macOS and visionOS, according to a support page published Tuesday. The policy covers only items shared using Anyone with the Link, not content shared directly with other people. Apple says such items will be checked for harmful content, a term it does not define, and reserves the right to move, refuse, modify, remove or delete content and to block or disable accounts, and may involve law enforcement. The share-with-anyone option removes end-to-end encryption from the item even when Advanced Data Protection is enabled. Apple has not said whether humans, automated systems or AI will do the checks. Version 27.3 is in developer beta, with general release expected in December.
Apple turns iCloud into spy cloud, will start looking at public share links →
Topics: AppleEncryption
Snapchat turns off Find Friends by default for UK under-18s
Snapchat is rolling out a change starting this month that sets its Find Friends feature to off by default in the UK for users under 18, according to Ofcom. The feature uses age, location and existing friends and followers to make adding contacts easier. Oliver Griffiths, director of Ofcom’s Online Safety Group, called the change an important and welcome improvement and long overdue, and said Ofcom will hold Snap to account on completing the rollout this month. He said Snap will add highly effective age checks by the end of the year, and that non-compliant companies face fines of up to 18 million pounds or 10 percent of qualifying worldwide revenue. The EU has separately opened a formal investigation into Snap under the Digital Services Act.
Snapchat’s Find Friends feature will be off by default for UK users under 18 →
Topics: Children's online safetyAge verification
Los Angeles council moves toward citywide data privacy policy
The Los Angeles City Council unanimously approved a motion by Councilwoman Monica Rodriguez calling for a standard, citywide data privacy policy in response to concerns about data retention, privacy rights and other issues tied to artificial intelligence and automated license plate reader technology. The council directed the Information Technology Agency and other departments to report with recommendations for the policy and supporting standards and safeguards for data collection, storage, retention, access, sharing and disclosure. Departments must also address cybersecurity, prohibited uses of city technology and data, and transparency, accountability, oversight and auditing requirements. Rodriguez said departments cannot operate under different standards and that the rules should become boilerplate for how each department introduces new technologies.
LA Council seeks citywide data privacy policy amid AI, ALRP tech →
Topics: License plate readers (ALPR)
Fake CAPTCHA scam tricks users into installing data-stealing malware
Scammers are using fake CAPTCHAs to trick users into installing malicious code on Macs and PCs to steal their data, a tactic the Federal Trade Commission warned about earlier this year. The scam shows a pop-up on a malicious site resembling a legitimate company such as Amazon or Facebook, then instructs users to press keyboard shortcuts, ostensibly to verify they are human. Those keystrokes paste code the fake CAPTCHA placed on the clipboard, letting scammers download and install keyloggers or spyware that steal usernames and passwords. On Windows, users may be told to press Windows+R then Ctrl+V; on a Mac, Command-Space, type Terminal, then Command+V. Legitimate CAPTCHAs never ask for keyboard commands or command-line access. The FTC advises disconnecting from the internet and running security software if something downloaded.
Beware this CAPTCHA scam designed to steal your data →
Topics: Malware & infostealersPhishing
Research shows macOS AI knowledge graph can be weaponized for extortion plans
A personal knowledge graph stored by a personalized AI assistant on macOS can be handed to an abliterated LLM and turned into detailed plans for kidnapping, extortion and a 14-day deniable harassment campaign, according to research conducted on macOS 26.6.2. The graph sits in a single folder under the home directory as a few megabytes of SQLite with nearly the same schema on every modern Mac, containing pre-computed face clusters, family classifiers, merged identities and labeled, confidence-scored relationships. Both scenarios require Full Disk Access on the target. In the experiment, the graph was given to a fully abliterated LLM with a single instruction to devise a step-by-step plan to cause maximum harm, grounded in retrievable data. The model selected the owner’s partner as a target and produced sequenced demands and a campaign timeline from communication logs.
Weaponizing Personalization: From Knowledge Graph to Extortion — Eighth Rank →
Mike Johnson shifts from FISA critic to backer of warrantless surveillance
Rep. Mike Johnson reversed his position on warrantless surveillance during his tenure as House speaker. Before becoming speaker, Johnson co-signed a 2022 letter with Rep. Jim Jordan raising concerns about reports that the FBI had violated privacy rules while conducting surveillance under Section 702 of the Foreign Intelligence Surveillance Act, which allows national security agencies to collect foreign intelligence without a warrant. In a July 2023 interview with Glenn Greenwald, he said abuse of power by federal agencies kept him and colleagues up at night. Less than two months after becoming speaker, he voted against an amendment requiring warrants to search Americans’ communications and pushed through a two-year FISA extension. Johnson said a confidential briefing gave him a different perspective. Congress later let Section 702 expire, but certified surveillance continues until March 2027.
Mike Johnson went from FISA critic to defender of warrantless surveillance →
NT Health bans smart glasses at clinical sites after patient privacy breach
NT Health has banned smart glasses at all of its clinical sites as part of an internal department review into its privacy policies, prompted by a breach at Royal Darwin Hospital earlier this month. The breach involved medical observer Dr Neda Mogharehabed, who posted images and videos containing confidential medical information of 12 pregnant patients to her 28,000 Instagram followers; it is not suggested she used such a device during her placement. In an email to all staff, chief executive Susan Bowden said recording-capable wearables, particularly smart glasses, pose an elevated risk to patient privacy and confidentiality and must not be used to capture patients or clinical interactions. Devices are allowed only with explicit NT Health approval for a legitimate purpose meeting consent and record-security standards.
NT Health issues ban on Meta Glasses as part of review into privacy policy - ABC News →
Topics: Smart devices privacy
Applebee’s database exposed by hardcoded password in Android app
A hardcoded database password embedded in Applebee’s Android app exposed an internal customer database. Researcher Robert Wiggins found the password with help from AI and gained access to the database, which contained names, email addresses and verification status, dates of birth, phone numbers, ZIP codes, veteran status, account-creation dates, login counts and IP addresses from recent logins. TechCrunch independently verified the findings by creating an Applebee’s account with dummy information, which Wiggins retrieved. Wiggins could not find a way to report the issue to Applebee’s or parent company Dine Brands, so he asked TechCrunch to help contact them; the outlet held its story until the fix was confirmed. Applebee’s confirmed on October 29 that it had addressed the issue. It is unclear how many records were exposed; Dine Brands says it has found no evidence of unauthorized access.
Applebee’s customer data exposed by password left in app | Malwarebytes →
Topics: Exposed databases and cloud misconfigurations
Rosstat hack yields data suggesting over 390,000 Russian war deaths
Hacker groups Kiberpartizany BY and Silent Crow claim to have breached Russia’s Federal State Statistics Service (Rosstat), stealing about 23 terabytes of data including internal documents, demographic and economic statistics, and information on Russian losses in the war against Ukraine. Kiberpartizany BY says at least 393,881 Russian citizens had been killed as of 27 August 2026; Silent Crow gives a higher figure of 450,100, reflecting different counting methods that include non-combat losses and deaths in occupied territories. Russia has not released official combat-loss statistics since September 2022, and from 2024 Rosstat stopped publishing annual data on causes of death. Meduza and Mediazona have obtained access to the hackers’ data and are checking authenticity and completeness.
Rosstat hack: data obtained suggests over 390,000 Russian deaths in Ukraine war →
Topics: State-sponsored hacking
Opinion argues Flock camera expansion shows need for privacy amendment
The expansion of Flock cameras, an automated license plate reader system, across the US raises the question of whether owning a phone and a car and using the internet means organizations know everything about us, as governments and private enterprises seek to expand surveillance power. Legal protections have historically lagged behind privacy-invading technologies, as Samuel D. Warren and Louis D. Brandeis observed in an 1890 Harvard Law Review article, The Right to Privacy, that mass newspaper printing and photography threatened privacy in new and unforeseen ways. Flock cameras can help detect car thefts and other serious crimes, but a searchable database of people’s travel patterns across jurisdictions over extended periods is more invasive than an isolated picture on a public street, especially when combined with personal data from other sources. The piece calls for a constitutional amendment prohibiting information privacy abuse by government, the private sector or both working together.
Opinion: Flock cameras show that we need a constitutional amendment for information privacy →