Who's tracking you, and what you can do about it.
A major cruise industry breach exposed nearly 6 million passengers' data this week, while California sued 23andMe over a 2023 genetic data breach affecting 6.9 million customers. Meanwhile, the FTC issued a landmark COPPA policy statement encouraging age verification technologies to protect children online—a significant regulatory shift that could reshape children's privacy enforcement.
Charter Communications and Carnival Cruise Lines confirmed massive data breaches affecting millions, with ShinyHunters hackers leaking 13M+ and 6M records respectively after the companies refused ransom demands. The FTC continues pushing age-verification technology adoption to protect children online, while Mexico disclosed a government breach exposing 36M citizens' data. These incidents underscore the persistent gap between corporate security practices and escalating extortion threats.
This week's biggest story comes from the healthcare sector: nine HIPAA-regulated entities disclosed fresh breaches affecting patient medical, financial, and biometric data, compounding ongoing fallout from the NYC Health + Hospitals incident affecting 1.8 million people. On the regulatory front, the FTC began enforcing the new TAKE IT DOWN Act — the first federal law requiring platforms to remove non-consensual intimate imagery within 48 hours, setting a significant precedent for victims' digital rights. Together, these developments underscore that sensitive personal data — from fingerprints to medical records to intimate images — remains dangerously exposed across both private industry and government-adjacent systems.
ShinyHunters struck again this week, leaking 9.4 GB of 7-Eleven franchise applicant data including Social Security numbers after the company refused to pay ransom — the same threat actor behind several major April breaches. Meanwhile, nine healthcare entities disclosed HIPAA-regulated breaches, and the FTC began enforcing the newly passed TAKE IT DOWN Act against non-consensual intimate imagery. Everyday users face escalating risks as ransomware groups become bolder and biometric data joins financial and medical records as prime targets.
A public GitHub repository belonging to CISA leaked 844 MB of plain-text passwords, AWS tokens, and SAML certificates — some still valid — and was taken down within 26 hours after GitGuardian's disclosure. Meanwhile, dark web brokers are increasingly recycling old breach data and marketing it as fresh corporate leaks, creating a new threat vector for affected organizations. Both stories highlight how credential exposure and data-broker deception remain the dominant risk vectors for everyday users this week.
New York City's public hospital system suffered one of the year's largest healthcare data breaches, exposing medical records and biometric data — including fingerprints — for at least 1.8 million people. Separately, the Dutch Data Protection Authority is demanding urgent structural fixes after Dutch breach filings surged to 44,000 in a single year. Together, these stories underscore how both public institutions and national regulators are struggling to keep pace with an accelerating breach epidemic.
The week's dominant story continues to unfold around the Instructure Canvas breach, where edtech giant Instructure reportedly reached a ransom agreement with hacker group ShinyHunters to halt the leak of 3.65TB of data affecting an estimated 275 million users — raising serious questions about paying cybercriminals. On the regulatory front, the FTC issued a compliance reminder to tech companies about the newly enacted Take It Down Act, setting a May 19 deadline. Together, these events underscore the escalating costs of data insecurity and the growing federal pressure on platforms to protect users' most sensitive information.
The Instructure Canvas breach continues to dominate privacy headlines, with hacker group ShinyHunters claiming to have stolen data from up to 275 million users across 8,800+ educational institutions — rattling schools and universities during finals season. Meanwhile, South Korea's data watchdog is moving toward a penalty decision in the Coupang e-commerce leak case, and a Zara database intrusion exposed personal data on nearly 200,000 customers. These incidents collectively underscore persistent vulnerabilities in platforms handling sensitive personal data at scale.
ShinyHunters, the prolific hacking group behind a string of 2026 breaches, has claimed responsibility for attacking education tech giant Instructure (Canvas), potentially exposing data from students at MIT, Oxford, and nearly 9,000 schools worldwide — the week's most alarming incident. On the regulatory front, the FTC finalized a ban on location data broker Kochava, and U.S. House Republicans released a draft federal privacy bill, the SECURE Data Act, that could reshape the state-by-state patchwork Americans navigate today. Together, these stories underscore a pivotal moment: data theft is industrializing while the legislative response is still catching up.
The biggest story this week is the confirmed data breach at Instructure, maker of the Canvas learning management platform, with hacking group ShinyHunters claiming theft of data affecting up to 275 million users across roughly 9,000 schools worldwide. On the regulatory front, the FTC moved to ban data broker Kochava from selling sensitive location data, setting an important precedent for location privacy enforcement. These incidents underscore a recurring pattern: educational and commercial platforms handling vast personal datasets remain prime targets, while regulators are increasingly using existing authority to constrain the surveillance data economy.
ShinyHunters, the prolific extortion group, struck again this week — breaching home security giant ADT and exposing personal data on 5.5 million customers, while also leaking records tied to Udemy, Zara, and 7-Eleven in a separate Salesforce-linked incident. On the legislative front, U.S. House Republicans introduced the SECURE Data Act on April 22, a sweeping federal privacy bill aimed at preempting the patchwork of state privacy laws. These developments underscore an accelerating threat environment where both consumer data and legislative momentum are moving at once.
This week's top stories center on a wave of fresh data breaches hitting consumers across multiple sectors — home security giant ADT, Dutch cosmetics brand Rituals, and UK Biobank — while U.S. House Republicans introduced the SECURE Data Act on April 22, a sweeping federal privacy bill that would preempt the patchwork of state laws. Meanwhile, the FTC's enforcement action against Match and OkCupid for sharing user data without consent signals continued regulatory pressure on dating platforms and data brokers.
France's national identity document agency confirmed a major breach this week, with a hacker claiming to have stolen up to 19 million citizen records — one of the largest government data breaches in European history. On the legislative front, U.S. House Republicans introduced the SECURE Data Act, a sweeping federal consumer privacy bill aimed at preempting the growing patchwork of state laws. Both stories underscore the widening gap between the scale of data collection and the protections governments have put in place for everyday users.
France's national identity document agency ANTS suffered a major cyberattack this week, exposing personal data for millions of citizens and triggering urgent phishing warnings. Meanwhile, cloud development platform Vercel confirmed a breach traced to a compromised employee's OAuth token via an AI tool, highlighting a fast-emerging attack vector. For everyday users, these incidents underscore that government-issued identity data and developer platforms alike are now prime targets — and that stolen OAuth credentials are the new front line of credential theft.
The European Data Protection Board (EDPB) made a landmark move on April 20, 2026, approving the global extension of Europrivacy — the EU's data protection certification — which will dramatically reshape how international data transfers are governed. Meanwhile, a detailed comparative analysis of India's Digital Personal Data Protection Act versus GDPR has emerged this week, highlighting key compliance divergences as India's law enters a critical implementation phase. These developments underscore an accelerating global regulatory environment that now spans 144 countries.
Create custom signals on any topic. AI curates and delivers 24/7.
Create SignalPowered by
