In-depth articles on GDPR compliance, DSARs, data governance, and privacy operations.
Security & Breach NotificationWhen Fishbrain discovered unauthorized access to its user environment on August 19, the breach had been ongoing for about three weeks. This detection gap turned a manageable incident into a full passw
Security & Breach NotificationThe recent IDScan breach has left many legal and compliance teams wondering, What if this happened to us? IDScan, an identity verification company, is under scrutiny after hackers allegedly exposed ov
Security & Breach NotificationYour team has invested in encryption, access controls, and cloud security posture management. But what about the filing cabinets in the basement and the boxes in off-site storage? The Data Protection
Security & Breach NotificationThe €500,000 fine against HÔPITAL PRIVÉ DE LA LOIRE after attackers accessed data on 524,867 patients highlights how persistent security myths put healthcare organizations at regulatory and operationa
Get weekly security insights and compliance updates delivered to your inbox.
Security & Breach NotificationIntroduction When 8.7 million customer records are exposed online, as happened with Manchester Airports Group , the damage extends beyond the breach itself. Criminals can exploit names, email addresse
Security & Breach NotificationThe Problem: Why This Matters Now The CNIL s €500,000 fine against Hôpital privé de la Loire highlights the consequences of inadequate healthcare access controls. An attacker breached a single doctor
Security & Breach NotificationThe conventional wisdom says GDPR compliance is a technology problem. You need encryption, access controls, cloud security frameworks, and incident response playbooks built for ransomware and phishing
Security & Breach NotificationAn unauthorized party accessed around 5,000 Dropbox accounts by exploiting a flaw in Lenovo s email verification system. The attack succeeded because Dropbox accepted Lenovo IDs as part of its authent
Security & Breach NotificationThe McKesson breach, where ShinyHunters claimed responsibility for stealing data from third-party applications, highlights a critical issue many data governance teams face: you re responsible for pers
Security & Breach NotificationWhen unauthorized access affects millions of patient records and the forensic investigation takes months, your notification script can t be a placeholder. It needs to be a comprehensive communication
Security & Breach NotificationYour incident response team just declared the breach over. Systems are back online, customers can log in, and your board s been briefed. But here s what nobody s asking: did you actually remove the at
Security & Breach NotificationQuestions started landing in my inbox after a Canadian supervisory authority announced its investigation into Human Resources and Skills Development Canada following a breach affecting student loan re
Security & Breach NotificationYour security team discovers unauthorized access to customer records at 9pm on a Friday. The clock starts. Under Article 33 , you have 72 hours to notify your supervisory authority. What you do in tho
Security & Breach NotificationWhen a national security agency admits to unlawfully processing personal data for three years, the issue wasn t complex technology or legal nuances. MI5 s failures between 2016 and 2019 were due to no
Security & Breach NotificationWhen Oracle warned Nissan of a zero-day exploit in PeopleSoft, the carmaker was already compromised. Between May 27 and June 9, attackers linked to the ShinyHunters group accessed sensitive employee d
Security & Breach NotificationThe question at hand When a vulnerability in SafePal s order-tracking plugin exposed the personal data of 39,798 customers, it sparked a debate among privacy officers: how deep should your technical d
Security & Breach NotificationThe Conventional Wisdom When ransomware operators demand payment, the standard advice is clear: don t pay. The FBI , CISA warns against it, and your cyber insurance policy likely advises refusal. The
Security & Breach NotificationWhen Manchester Airports Group discovered unauthorized access to customer data from three UK airports, they followed the standard protocol: contain the risk, notify authorities, and contact affected c
Security & Breach NotificationThe Problem: Why This Matters Now Your incident response plan might be tucked away in a SharePoint folder, labeled something like IR_Plan_v3_FINAL_updated.docx . When Manchester Airports Group faced a
Security & Breach NotificationWhen ShinyHunters dumped what it claimed was 50GB of Carhartt customer data in August, the headline number looked catastrophic: twenty-five million email addresses. Except it wasn t true. Troy Hunt s
