Privacy
-
ShinyHunters posts 12.4 million records alleged to be from CarGurus
A 6.1GB archive claiming 12.4 million CarGurus records was posted by ShinyHunters on February 21. A Have I Been Pwned breach listing says about 3.7 million records appear to be new.
-
Security analysis finds vulnerabilities in popular mental health apps on Google Play
A technical analysis by Oversecured found vulnerabilities in popular Android mental health apps that can expose conversation histories and mood data. Affected apps have tens of millions of combined downloads and the flaws remain unpatched.
-
PayPal says loan app error exposed customers’ Social Security numbers for months
A software error in PayPal’s Working Capital loan app exposed personal data including Social Security numbers from July to December 2025. The company rolled back the code change, reset passwords and is offering credit monitoring to affected users.
-
Intruder accessed France’s FICOBA registry exposing data for 1.2 million accounts
A late January 2026 breach of France’s FICOBA exposed data tied to 1.2 million bank accounts including IBANs and personal details. Banks were alerted and authorities filed a criminal complaint.
-
Spanish court orders NordVPN and ProtonVPN to block 16 LaLiga piracy sites
A Spanish court ordered NordVPN and ProtonVPN to block 16 websites used to pirate LaLiga matches in Spain. The precautionary measures apply to a dynamic list of IP addresses and were issued inaudita parte without opportunity for appeal.
-
Law firm sues Lenovo over alleged bulk transfer of US data to China
A law firm filed a class action accusing Lenovo of exposing 100,000 or more US consumers’ data to Chinese entities via website trackers. The suit seeks class action relief, restitution, disgorgement and statutory damages.
-
Developer beta adds end-to-end encryption for RCS in iOS and iPadOS 26.4
The iPhone maker released an iOS and iPadOS 26.4 developer beta that adds end-to-end encryption for RCS messages in testing, limited to the company’s devices, and includes Memory Integrity Enforcement and stolen device protections.
-
Odido cyberattack exposes personal data of 6.2 million customers
A Dutch telecom provider detected a cyberattack that exposed personal data for about 6.2 million customers. The provider blocked access, notified the data regulator, and is emailing affected customers with details.
-
Russia moves to block WhatsApp after national DNS exclusions limit access
Russian authorities moved to block WhatsApp by excluding its domains from the national DNS, leaving the service reachable only via VPNs or external DNS. The move follows earlier throttling and registration restrictions.
-
Conduent breach exposed personal data of nearly 17,000 Volvo employees
Nearly 17,000 US Volvo employees had personal data exposed after a Conduent breach. A Maine Attorney General filing shows 16,991 people were affected, with intruder access dated October 21, 2024 to January 13, 2025.
