Digital Privacy & Data Rights — 2026-09-21

This Week's Top Story

1 sources

techcrunch.com

techcrunch.com

Gyazo Breach Exposes 23.6 Million User Records and 490 Million Image Metadata Records

• What happened: The popular screenshot-sharing service Gyazo confirmed a security breach that occurred on September 11, 2026. The incident exposed approximately 23.62 million user records and a staggering 490 million image metadata entries, including IDs used to construct image links.
• Who's affected: Users of the Gyazo platform globally, particularly those who have used the service for work or personal documentation where screenshots were shared via link.
• Why it matters: This breach underscores the vulnerability of metadata associated with shared media. While the images themselves may not have been directly accessed in this specific report, the exposure of IDs and user data can facilitate targeted phishing attacks and unauthorized access to private content if links are guessed or harvested.

1 sources

tech-insider.org

tech-insider.org

Data Breaches & Incidents

Gyazo — Cloud Service Breach

• Scope: 23.62 million user records (emails, usernames) and 490 million image metadata records (IDs, timestamps).
• Root cause: Unauthorized access to backend systems; specific attack vector details are still emerging but involve compromised credentials or API vulnerabilities.
• User action: Change passwords immediately if you use Gyazo. Be wary of phishing emails referencing your screenshot history. Consider deleting old, sensitive screenshots from the platform.

Revolut — Social Engineering/Fake Government Requests

• Scope: Customer data exposed through a scheme involving fake government requests.
• Root cause: Social engineering attacks targeting customer support channels to bypass verification protocols.
• User action: Monitor bank statements closely. Enable two-factor authentication (2FA) and be skeptical of unsolicited communications claiming to be from Revolut or government agencies.

Dark Web Marketplace — Driver's Licenses & IDs

• Scope: Over 153 million driver's licenses and millions of other identity documents listed for sale.
• Root cause: Aggregation of data from previous breaches and potentially ongoing scraping of unsecured databases.
• User action: Check if your data is involved using reputable breach-checking services (like Have I Been Pwned). Consider freezing your credit with major bureaus to prevent identity theft.

Regulatory & Enforcement Actions

FTC vs. Non-Compliant Platforms (TAKE IT DOWN Act Enforcement)

• Ruling: The FTC has begun enforcing the TAKE IT DOWN Act, sending warning letters to companies about compliance with requirements to remove nonconsensual intimate imagery.
• Penalty: While initial steps are warning letters, non-compliance can lead to civil penalties and enforcement actions.
• Precedent: Establishes clear federal expectations for platforms regarding the rapid removal of nonconsensual sexual content, shifting liability towards platform compliance mechanisms.

EDPB Coordinated Enforcement Framework (CEF) 2026

• Ruling: The European Data Protection Board selected transparency and information obligations under GDPR as the topic for its fifth coordinated enforcement action in 2026.
• Penalty: National DPAs will coordinate investigations into how companies provide privacy notices, leading to potential fines for unclear or hidden data practices.
• Precedent: Signals a unified EU-wide push against "dark patterns" and opaque privacy policies, requiring clearer, more accessible information for users.

Legislation & Policy Moves

• US — SECURE Data Act: A new federal privacy bill introduced by House Republicans aiming to create a uniform federal standard that would preempt the current patchwork of state privacy laws. — Status: Introduced/Draft Analysis — Effective Date: TBD
• US States — New Privacy Laws: Several US states have implemented new privacy requirements effective January 1, 2026, increasing enforcement activity across jurisdictions like Texas and Oregon. — Status: In Effect — Effective Date: Jan 1, 2026

Advocacy & Civil Society

No recent specific advocacy campaigns from EFF or NOYB published within the last 24 hours were found in the provided search results. However, general guidance on data exposure remains active.

Industry & Tech Response

• Age Verification Technologies: The FTC issued a policy statement incentivizing the use of age verification technologies by stating it will not bring COPPA enforcement actions against operators collecting data solely for age determination. This encourages platforms to adopt robust age-gating tools.

Reader Action Items

• Check if you're affected: Use a service like "Have I Been Pwned" to check if your email address was involved in the Gyazo breach. If so, change your password and enable 2FA.
• Settings to review: Review your privacy settings on any cloud storage or screenshot sharing apps. Disable public link sharing if not needed. On mobile devices, review app permissions for "Photos" and "Storage."
• Rights you can exercise: Under GDPR (EU) or CCPA/CPRA (California), you can request a copy of your personal data held by companies like Gyazo or Revolut to see what has been collected and stored.

What to Watch Next Week

• SECURE Data Act Progress: Track the movement of the federal privacy bill in Congress, particularly regarding preemption clauses that could override stronger state laws.
• EDPB Transparency Investigations: Look for early signs of coordinated audits by national data protection authorities focusing on privacy notice clarity.
• AI Training Data Lawsuits: Monitor ongoing litigation regarding the use of copyrighted data for training AI models, which intersects heavily with data rights and consent.

Crew Digital Privacy & Data Rights — curated weekly from EFF, regulators (EDPB/FTC/ICO), IAPP, and tech media.