Latest cybersecurity reporting from selected sources.

The Pentagon confirmed adversaries are using commercial location data to track U.S. troops, exposing risks tied to smartphones and ad-tech networks. For years, security researchers, privacy advocates, and intelligence analysts have been warning about the same thing: smartphone location data isn’t just an advertising product. It’s surveillance infrastructure that anyone with enough money can access. […]

Some weeks in cybersecurity feel routine. This one doesn’t

Cisco Research Shows How AI Is Reshaping Data Privacy and GovernanceEnterprise data privacy and governance are undergoing fundamental shifts as the promised speed and efficiency of artificial intelligence come crashing into the realities of data risk and regulatory uncertainty.

Cybersecurity researchers have disclosed details of a security flaw that leverages indirect prompt injection targeting Google Gemini as a way to bypass authorization guardrails and use Google Calendar as a data extraction mechanism

More than 8 million people have installed extensions that eavesdrop on chatbot interactions Ad blockers and VPNs are supposed to protect your privacy, but four popular browser extensions have been doing just the opposite. According to research from Koi Security, these pernicious plug-ins have been harvesting the text of chatbot conversations from more than 8 million people and sending them back to the developers.…

This week’s cyber stories show how fast the online world can turn risky. Hackers are sneaking malware into movie downloads, browser add-ons, and even software updates people trust. Tech giants and governments are racing to plug new holes while arguing over privacy and control. And researchers keep uncovering just how much of our digital life is still wide open

Cybersecurity researchers have disclosed three now-patched security vulnerabilities impacting Google's Gemini artificial intelligence (AI) assistant that, if successfully exploited, could have exposed users to major privacy risks and data theft

23andMe's Ex-CEO Anne Wojcicki Made Privacy Pledge With Successful Bid of $305MA bankruptcy court gave the green light for TTAM Research Institute - a firm launched by 23andMe's co-founder and former CEO Anne Wojcicki - to buy 23andMe for $305 million. TTAM has promised to uphold the consumer genetics testing firm's current privacy policies and implement more data safeguards.

Apple and Google espouse strong values about data privacy, but they allow programs from a Big Brother state to thrive on their app stores, researchers allege.

Fine Imposed for Failing to Protect Genetic Data in the United KingdomThe British data regulator imposed a 2.31 million-pound fine against bankrupt genetics research firm 23andMe for "serious" privacy violations tied to the company's 2023 hack and data leak. The breach impacted 155,592 individuals in the United Kingdom.

Anne Wojcicki's New TTAM Research Institute Wins Bid for Bankrupt Genomics Testing FirmTTAM Research Institute - 23andMe's co-founder and former CEO Anne Wojcicki's new company - is the winner in a final round of bids to purchase the bankrupt consumer genomics testing firm. As part of TTAM's bid, the nonprofit pledged to implement additional data privacy and security protections.

Cybersecurity researchers have flagged several popular Google Chrome extensions that have been found to transmit data in HTTP and hard-code secrets in their code, exposing users to privacy and security risks

Zuckercorp and Yandex used localhost loophole to tie browser data to app users, say boffins Security researchers say Meta and Yandex used native Android apps to listen on localhost ports, allowing them to link web browsing data to user identities and bypass typical privacy protections.…

Web-to-App Pipeline Uses Meta Pixel and Yandex MetricaAmerican social media giant Meta and Russian counterpart Yandex each found methods to break through privacy protections enabled by Android users, say academics in newly disclosed research. A Meta spokesperson in a prepared statement said it stopped the tracking "upon becoming aware of the concerns."

NIH, CMS Project Raises Patient Data Privacy Concerns, Advocates SayThe U.S. Department of Health and Human Services said it will build a data platform "allowing researchers to 'securely'" access data from Medicare and Medicaid claims, patient electronic medical records and consumer wearables to better understand autism spectrum disorder causes and treatments.

Although the National Institutes of Health appears to have scaled back plans to build a national registry to track individuals with autism, the agency's research project still poses critical data privacy concerns, said Ariana Aboulafia and Andrew Crawford of the Center for Democracy and Technology.

Researchers discovered 49,000 misconfigured and exposed Access Management Systems (AMS) across multiple industries and countries, which could compromise privacy and physical security in critical sectors. [...]

Researcher Jason Sinchak on Recent Cyber Warnings About Contec CMS8000 DevicesA hidden reverse backdoor in low-cost patient vital sign monitors used globally is hardcoded with an IP address connecting to a Chinese government-funded education and research network, which poses both privacy and potential safety concerns, said security researcher Jason Sinchak of ELTON.

At the Same Time, the Total Number of Breach Notifications to Consumers IncreasedThe total amount of annual fines imposed by European privacy regulators fell in 2024 for the first time since the EU's pioneering data protection law came into effect, even as the number of data breach notifications continued to increase, report legal privacy researchers.

ISACA research claims privacy budgets are set to decline further in 2025