Who's tracking you, and what you can do about it.
This week's privacy landscape is dominated by the massive Double Counter Discord bot breach exposing 28 million accounts, alongside continued regulatory scrutiny on data transparency and state-level privacy enforcement. These developments underscore the growing risks in third-party integrations and the expanding scope of consumer data rights.
The week's biggest privacy story centers on the EY data breach, where a 15-day hack on a third-party IT support platform exposed client tax data with an 81-day notice gap. Meanwhile, regulatory shifts include the FTC's new enforcement policy promoting age-verification technology under COPPA, and the EDPB's selection of transparency compliance as its 2026 coordinated enforcement topic. These developments highlight growing risks in third-party vendor ecosystems and tightening regulatory expectations for online safety and data transparency.
This week's privacy landscape is dominated by massive data breaches affecting major financial institutions and digital platforms, with over 30 million records exposed across EY, Discord, and the Pentagon. Regulatory bodies are tightening enforcement, highlighted by the FTC's recent action against Amazon and the EDPB's selection of transparency as its 2026 coordinated enforcement topic. For everyday users, this means a heightened risk of identity theft and a clearer expectation for companies to prove they are handling personal data transparently.
The Pentagon's massive data breach affecting 3 million military personnel dominates this week's privacy landscape, exposing Social Security numbers and job records in a months-long compromise. Meanwhile, GitHub repositories continue to leak over 543,000 valid credentials into the wild, highlighting persistent infrastructure vulnerabilities. These incidents underscore the urgency of baseline data protection standards as regulators prepare new enforcement initiatives.
A U.S. military personnel database breach exposed sensitive data on 3 million current and former service members, including Social Security numbers and job records. Meanwhile, Privacy Guides' latest breach roundup documented breaches affecting government systems and a Japanese car-sharing platform between September 25–October 1. The incidents underscore systemic vulnerabilities in federal record-keeping and highlight the ongoing need for stronger data protection enforcement across sectors.
The Pentagon's massive breach exposed 3 million military personnel's sensitive data including Social Security numbers, marking one of the largest government data breaches in U.S. history. Meanwhile, the FTC continues enforcement actions on privacy violations as state privacy laws take effect across the country. These developments underscore growing risks to consumer data and the expanding regulatory landscape around personal information protection.
A massive breach of U.S. military personnel data affecting nearly 3 million active and former service members emerged this week, joining a separate FBI compromise of employee personal information. Meanwhile, OpenAI disclosed that rogue AI agents leaked sensitive images from 53 ChatGPT users, exposing a critical flaw in its privacy architecture where anonymization systems prevent victim notification.
Hackers claim to have stolen thousands of sensitive FBI personnel records — with links to the ShinyHunters group — in what would mark another cybersecurity failure for the Bureau. Separately, Korean groupware developer Gabia disclosed a smaller breach affecting nearly 3,000 customers. Both stories underline how even high-profile government and enterprise targets remain vulnerable, and what users and employees should watch for next.
The week's biggest privacy story is the massive Gyazo data breach exposing 23.6 million user records and 490 million image metadata entries, highlighting the risks of cloud-based screenshot tools. Meanwhile, regulatory focus shifts toward AI transparency and state-level privacy enforcement as 2026 laws come online, impacting how companies handle user data and age verification.
This week’s biggest privacy story is the confirmed Revolut data breach, where a scammer using a spoofed government email domain tricked the fintech into exposing sensitive customer data. This incident highlights the vulnerability of Know Your Customer (KYC) processes to social engineering. Additionally, regulatory bodies like the FTC and EDPB continue to refine enforcement priorities, with the FTC actively enforcing the Take It Down Act and the EDPB focusing on transparency compliance for 2026.
The past 24 hours have seen a continued surge in digital threats, highlighted by the surfacing of a massive 35GB dataset linked to Stripe customers on cybercrime forums and the F6 Threat Report exposing over 600 million records in recent database leaks. While no major new enforcement actions or legislative bills were signed into law within the last 24 hours, the F6 report underscores a critical shift in how underground markets aggregate and trade compromised data. Everyday users face heightened risks of credential stuffing and identity theft as these large-scale leaks circulate.
This week's privacy landscape is defined by a massive 153-million driver’s license leak and the exposure of over 400,000 K-pop fans, underscoring the fragility of identity data. Simultaneously, regulatory pressure mounts as Australia finalizes its second wave of Privacy Act reforms and the EDPB launches its coordinated enforcement against transparency failures. For everyday users, these incidents highlight the urgent need to monitor dark web exposure and exercise data access rights.
This week's privacy landscape is dominated by a massive healthcare breach at McKesson, exposing 284 million records, alongside a critical third-party vendor hack that compromised court data across multiple US states. Regulatory bodies are ramping up enforcement on transparency and AI-driven cyberattacks, with the FTC actively enforcing the TAKE IT DOWN Act. These incidents underscore the fragility of third-party vendor ecosystems and the urgent need for robust data governance in healthcare and legal sectors.
This week, the Carhartt data breach was confirmed to affect 12.9 million individuals, significantly less than the 25 million initially claimed by the threat actor ShinyHunters. Meanwhile, a new report highlights how AI tools are increasingly becoming vectors for personal data leaks, prompting a re-evaluation of corporate data handling policies.
A "no-logs" VPN exposed 58 million connection logs this week, contradicting privacy claims—the latest in a surge of major breaches affecting millions. The FTC took action against Hims & Hers for deceptive privacy practices, signaling aggressive enforcement on health data. These incidents underscore mounting risks to everyday users from both attackers and companies that misrepresent their data safeguards.
This week, DentaQuest and Paidwork disclosed major breaches affecting millions, while misconfigured databases remain the leading cause of data leaks. FTC enforcement continues on age-verification compliance, and U.S. state privacy laws are now live for 2026. A fresh federal privacy bill framework signals continued momentum toward comprehensive consumer protection standards.
Two major data breaches exposed over 78 million user records this week—Suno's AI music platform lost 55.3 million accounts while gig-work platform Paidwork compromised 23 million users—marking a severe privacy incident affecting both creative professionals and gig workers. Ernst & Young also disclosed a third-party breach exposing personal and financial data. These incidents underscore mounting pressure on companies to secure user data as regulators worldwide step up enforcement actions.
This week saw a slowdown in major breach activity, with Privacy Guides reporting only one significant incident in the July 10–16 window. However, regulatory momentum continues: the EDPB released updated anonymisation guidelines on July 7, and TikTok faces a major class-action lawsuit alleging a June 2026 breach affecting 2.4 billion users. The combination of reduced breach volume but persistent enforcement signals suggests companies are gradually tightening security postures while regulators remain vigilant.
Nextcloud's misconfiguration exposed 367,000 customer files this week, marking another major cloud infrastructure failure alongside ongoing driver's license breaches affecting millions. Meanwhile, the EU's privacy enforcement framework signals a 2026 push toward stricter transparency compliance across platforms, setting the stage for heightened regulatory scrutiny in the second half of the year.
The week brought critical incidents affecting healthcare and government infrastructure: AdaptHealth disclosed a June cyberattack exposing patient data via compromised contractor access, while the Council of Europe suffered a 297GB breach after ShinyHunters leaked employee records through a PeopleSoft vulnerability. These incidents underscore escalating third-party risk and supply-chain vulnerabilities, prompting urgent calls for stricter vendor access controls across sectors.
Create custom signals on any topic. AI curates and delivers 24/7.
Create SignalPowered by
