Digital Privacy & Data Rights — 2026-10-21
Digital Privacy & Data Rights|4 min read8.8AI quality score — automatically evaluated based on accuracy, depth, and source quality
This week's biggest privacy stories include a massive ETS data breach affecting millions of students in California and a $6 million settlement for a 23andMe data breach. The FTC's recent enforcement actions against older adults and the EDPB's coordinated enforcement framework on transparency highlight the growing regulatory pressure on data protection.
Digital Privacy & Data Rights — 2026-10-21
This Week's Top Story
ETS Breach Exposes Millions of California Students
- What happened: Hackers stole personal data of millions of California students through a massive breach involving Educational Testing Service (ETS), a major provider of educational testing services. The breach exposed sensitive personal information, raising significant concerns about data security in the education sector.
- Who's affected: Millions of California students and potentially other users of ETS services.
- Why it matters: This breach highlights the vulnerability of educational institutions and service providers to cyberattacks, emphasizing the need for stronger data protection measures in the education sector.
Data Breaches & Incidents
State Bank of India — Data Leak
- Scope: 3,897 customer records containing personal data were found on the dark web, part of a larger leak involving about 375,000 records.
- Root cause: The source of the leak remains unknown, but it involves personal data such as names, gender, registered mobile numbers, dates of birth, emails, and residential addresses.
- User action: Account holders should monitor their accounts for suspicious activity and consider changing passwords and enabling two-factor authentication.
Nikkei Inc. — Cloud Data Breach
- Scope: Approximately 1.83 million records were exposed due to unauthorized access to cloud data.
- Root cause: Credential compromise led to the breach, marking Nikkei Inc.'s third data breach within a month.
- User action: Affected users should review their accounts for any unauthorized activity and consider changing passwords.
Oracle Health — Data Breach
- Scope: Personal and medical data of nearly 20 million people were exposed.
- Root cause: The breach reportedly involved unauthorized access to Oracle Health's systems.
- User action: Affected users should consider freezing their credit through Equifax, Experian, and TransUnion to prevent identity theft.
Regulatory & Enforcement Actions
California vs. 23andMe
- Ruling: California will receive a $6 million settlement after a 23andMe data breach exposed genetic and personal information of millions of customers, including more than 855,000 Californians.
- Penalty: $6 million settlement.
- Precedent: This case underscores the importance of robust data protection measures and the potential financial consequences of data breaches.
FTC vs. Illuminate Education, Inc.
- Ruling: The FTC issued an enforcement action against Illuminate Education, Inc. on June 5, 2026, for privacy violations.
- Penalty: Specific penalty details not provided, but enforcement actions typically involve fines and remediation orders.
- Precedent: This action highlights the FTC's ongoing efforts to enforce consumer privacy laws and protect user data.
Legislation & Policy Moves
- United States — SECURE Data Act: A new federal privacy bill introduced by U.S. House Republicans, marking the first major federal consumer privacy bill in years. Status: Introduced.
- European Union — EDPB Coordinated Enforcement Framework: The EDPB selected transparency and information obligations under the GDPR as the topic for its fifth coordinated enforcement action. Status: Ongoing.
Advocacy & Civil Society
- EFF: The EFF's Deeplinks blog continues to cover surveillance, encryption, and privacy law, providing critical insights into ongoing digital rights issues.
Industry & Tech Response
- TechCrunch Privacy News: TechCrunch's privacy section provides consistent fresh coverage on tech industry privacy news, highlighting recent developments and company responses.
Reader Action Items
- Check if you're affected: Monitor your accounts for any suspicious activity, especially if you use services from ETS, State Bank of India, Nikkei Inc., or Oracle Health.
- Settings to review: Enable two-factor authentication and consider freezing your credit through Equifax, Experian, and TransUnion if you were affected by the Oracle Health breach.
- Rights you can exercise: File a GDPR/CCPA request if you believe your data has been mishandled.
What to Watch Next Week
- Upcoming ruling: Keep an eye on any further developments in the ETS breach and the FTC's enforcement actions.
- Ongoing investigation: Track the progress of the EDPB's coordinated enforcement action on transparency and information obligations.
- Trend to track: The introduction of the SECURE Data Act and its potential impact on federal privacy regulations.
Crew Digital Privacy & Data Rights — curated weekly from EFF, regulators (EDPB/FTC/ICO), IAPP, and tech media.
This content was collected, curated, and summarized entirely by AI — including how and what to gather. It may contain inaccuracies. Crew does not guarantee the accuracy of any information presented here. Always verify facts on your own before acting on them. Crew assumes no legal liability for any consequences arising from reliance on this content.
Explore related topics
Powered by
