News of the Cyber World

[kyonides]

SCAM ALERT

PayPal Users Targeted by New Scam

PayPal users are being targeted in a new scam that asks customers to set up their account profile.

Users are often tricked into believing that the email is authentic and from PayPal, prompting them to give account access to the fraudster, according to a new report from Malwarebytes.

"This PayPal scam is scary because they're not stealing your password," Michael Ryan, a finance expert and the founder of MichaelRyanMoney.com, told Newsweek. "They're tricking you into giving them actual account access."

Why It Matters

Americans lose billions of dollars each year to scammers. According to the Federal Trade Commission, roughly $8.8 billion was stolen due to fraud in 2022 alone.

What To Know

In the PayPal scam, users will get an email that looks like it's from service@paypal.com, but that's because the scammer has spoofed the address.

The message, according to Malwarebytes, says the following: "New Profile Charge: We have detected a new payment profile with a charge of $910.45 USD at Kraken.com. To dispute, contact PayPal at (805) 500-8413. Otherwise, no action is required. PayPal accept automatic pending bill from this account. Your New PayPal Account added you to the Crypto Wallet account. Your user ID: Receipt43535e. Use this link to finish setting up your profile for this account. The link will expire in 24 hours."

While the layout of the email may appear legitimate, there are a few telltale signs that the email is a scam.

First, the sense of urgency, that the link will expire in 24 hours, indicates it could be from a fraudster. The $900 charge will also get customers' attention as they hope to avoid having their funds used without their consent.

It also differs from real PayPal emails because it doesn't reference the user by name, instead opting for a generic form email that can be sent to many potential victims.

Once users click on the link, they will be directed to add a secondary user to their PayPal account, which would then allow the scammer to use their PayPal funds.

Newsweek reached out to PayPal for comment via email.

What People Are Saying

Alex Beene, a financial literacy instructor for the University of Tennessee at Martin, told Newsweek: "Always thoroughly look over emails like these, because while they may look official at a bird's-eye view, the 'devil' is usually in the details. Legitimate PayPal communications will typically address you by name. Any generic greeting like 'Dear User' can be a red flag. Also, unless you run a small business or take abnormal transactions through your payment account, any large sums of money with quick deadlines attached could be a sign they're wanting to take advantage through urgency."

Kevin Thompson, the CEO of 9i Capital Group and the host of the 9innings podcast, told Newsweek: "These scammers are spoofing legitimate company email addresses and gathering your details by using a fake online database that mimics the PayPal experience. This is becoming more common, and it is easy to fall victim. The more common one's are those that scare you into making a quick decision such as, your account has been hacked or money has been withdrawn from your account."

DATA BREACHES & LEAKS

Fresh AT&T data breach could impact 24M users, hackers claim

Attackers claim to have live access to AT&T infrastructure, which essentially allows them to bypass two-factor authentication tied to a specific phone number. The hacker attack allegedly impacts millions of AT&T users.

Malicious actors announced their latest escapade on a popular underground forum, which is used to trade in data leaks and software exploits. According to the post, someone breached the American telecommunications behemoth, planting malicious software inside its systems for weeks without detection.

We’ve reached out to AT&T and will update the article once we receive a reply.
Meanwhile, the Cybernews research team is investigating the attackers’ claims. At first, the team could not access the dark web website, storing a data sample of the supposed leak. Several other individuals complained about the same issue in the posts' comments.

However, days later the team managed to access parts of the data sample. Attackers included a post from the supposed AT&T systems. The database appears to include:

• Phone numbers
  
• Owners’ names
  
• Cities
  
• States
  
• Carrier plans
  
• Device types
  
• Registration dates
  
• Last activity dates
  
• SIM IDs
  
• Device IDs
  

“The threat actors claim to have deployed a custom malicious payload, which allowed them to have read/write access to the core systems of AT&T,” our team explained.

“According to the hackers, this access allows for SIM-swapping attacks, reading 2FA codes sent via SMS, as well as a database with ~24M AT&T customer data.”

Researchers believe that the screenshot of the supposedly accessed database appears to match the attackers' claims.

How dangerous could the AT&T data breach be?

The post’s authors claim that the database they breached is not static, meaning that the alleged attack enables attackers to modify information within AT&T’s infrastructure. If confirmed, it would be a gold mine for hackers.

The attackers' claim, in essence, is that they’ve gotten the ability to transfer the phone numbers of 24 million AT&T users to any SIM card they want. In turn, this enables SIM-swapping attacks, loved by the likes of Scattered Spider, a hacker group behind attacks on MGM and Caesars hotels in Las Vegas and the UK’s biggest retailer, Marks & Spencer.

“According to the hackers, this access allows for SIM-swapping attacks, reading 2FA codes sent via SMS, as well as a database with ~24M AT&T customer data. So far, the Cybernews research team has been unable to verify any of these claims.” the team explained.

SIM swapping allows you to take over any communication going to a specific phone number. Think of the two-factor authentication codes you receive on your phone when attempting to log in to a protected service.

Moreover, access to a live database could allow attackers to see authentication codes in real-time, creating major cybersecurity issues for everything from social media accounts to banking.

While SIM swapping capabilities enable attackers to bypass account defenses, having a strong password may at least hamper hacker effort to quickly breach user accounts. One way to safeguard online accounts are password managers that foster better online habits by helping users monitor your online accounts

Popular marketing chatbot abused by hackers to breach Google, Cloudflare taken offline

Amid a wave of significant data breach disclosures from some of the world’s largest firms, Salesloft has announced that it’s pulling its Drift AI chatbot service offline. Hackers abused compromised Drift access tokens to infiltrate Salesforce instances.

Cloudflare, Zscaler, Palo Alto Networks, Google, and hundreds of other major companies have recently announced data breaches resulting from the compromised Salesforce instances.

The supply chain attacks stem from Salesloft Drift, a popular AI-powered marketing chatbot that companies use to engage customers. Hackers abused its integrations with Salesforce and other platforms to access sensitive customer data.

Salesloft announced that it has taken Drift temporarily offline.

“As a result, the Drift chatbot on customer websites will not be available, and Drift will not be accessible,” the company said.

“This will provide the fastest path forward to comprehensively review the application and build additional resiliency and security in the system to return the application to full functionality.”

The company also said it is working with cybersecurity partners from Mandiant and Coalition to resolve the issues as quickly as possible and to ensure the integrity and security of its systems and customers’ data.

“Thank you for your continued patience and understanding.”

Due to the ongoing investigations, Salesforce has also paused integration with Salesloft, despite the firm claiming that there are no indications of malicious activity associated with the Salesloft platform.

An alliance of three hacking groups, which feels “invincible” despite multiple arrests in the past, has claimed the cyberattacks. However, security researchers have yet to independently verify this. Google’s Threat Intelligence Group has attributed attacks to the threat actor tracked as UNC6395. UNC stands for uncategorized.

Google warns Drift customers to treat all authentication tokens stored in or connected to the platform as potentially compromised.

Cloudflare believes the incidents are not isolated and that the attackers intended to harvest credentials and customer data for future attacks.

“Given that hundreds of organizations were affected through this Drift compromise, we suspect the threat actor will use this information to launch targeted attacks against customers across the affected organizations,” Cloudflare warns.

The widespread data theft campaign from Salesforce instances began on August 8th and continued through at least August 18th, 2025. Before this, hackers also breached many Salesforce instances using voice phishing, tricking employees into installing malicious connected apps.

252M identities dumped online in massive leak affecting 7 countries

Over 250 million identity records have been exposed across seven countries in a massive data leak.

More than a quarter of a billion identity records have been left publicly accessible, exposing citizens from at least seven countries, including Turkey, Egypt, Saudi Arabia, the United Arab Emirates (UAE), Mexico, South Africa, and Canada.

Three misconfigured servers hosted on IP addresses registered in Brazil and the UAE contained detailed personal information, resembling government-level identity profiles. The leaked information included ID numbers, dates of birth, contact details, and home addresses.

Cybernews researchers, who discovered the exposure, say the databases appeared to share the same structure and naming conventions, which might indicate the same source. However, it was not possible to definitively say who was running the servers.

“It's likely that these databases were operated by a single party, due to the similar data structures, but there’s no attribution as to who controlled the data, or any hard links proving that these instances belonged to the same party,” said our researchers.

The breach is especially severe for citizens in Turkey, Egypt, and South Africa, where the databases contained full-spectrum identity details. Leaked detailed information opens the door to a range of abuses, from financial fraud and impersonation to targeted phishing campaigns and scams.

Cybernews contacted the hosting providers, and as of now, the data is no longer publicly accessible.

Entire nations affected by data leaks

This isn’t the first time a huge dataset hosting citizen data has been found online. Cybernews research has shown that the entire population of Brazil might have been affected by a data leak.

A misconfigured Elasticsearch instance contained the data with full names, dates of birth, sex, and Cadastro de Pessoas Físicas (CPF) numbers. This 11-digit number identifies individual taxpayers in Brazil.

Spotify users are freaking out as song sharing exposes identities: "That's craaaaaaazzzzzzyyyyyyyy"

Spotify users are shocked to discover that their identities are being exposed across the internet whenever they share a song.

Spotify announced a new feature last week – direct messaging – that was supposed to make music sharing easier. However, it all got out of control as Redditors started to notice weird things.

A Redditor who tested the new direct messaging tool noticed that the app automatically suggested “friends” based on past link sharing. Most names were familiar, but a few weren’t. This made users realize that Spotify had connected their account to people they’d only interacted with anonymously on Discord while playing games and sharing music.

“I’ve always kept Discord anonymous, and Spotify has never been a “social” app for me,” the Redditor wrote, terrified.

“But now it seems that anyone I’ve sent a Spotify link to, if they also have an account, can potentially find me, which means they could discover my full name and other account info.”

Spotify received more backlash as frustrated users seem unable to find a way to opt out of this new feature. Other platforms, such as YouTube, allow users to generate sharing links without tying them to their identity. The problem with Spotify is that users have no other choice but to expose their identity if they want to share a song.

“That's craaaaaaazzzzzzyyyyyyyy okay I hid everything and hoping for the best. What in the world, Spotify?!?!” one Redditor commented.

“This is really dumb. I knew this feature was going to screw something up... I really just want to listen to music, Spotify,” raged another.

The share link is packed with a tracker

Internet users have pointed out that tracking comes with the share link. Every single time a Spotify user shares a song from within Spotify, it generates a unique tracking URL linked to the account. This allows Spotify to connect users with anyone else who uses that same link. Spotify users should be vigilant of “?si=” and 16 characters at the end of every link.

Users say the app has already backfilled chat histories, pulling in years of past song shares, even ones originally sent over WhatsApp or other platforms. This means Spotify has been tracking those unique link identifiers all along, quietly mapping connections between accounts.

“This is a lawsuit waiting to happen,”

Redditors complained, blaming Spotify for doxxing users.

The fear is simple: the connections that Spotify is making can unmask people who deliberately keep their online identities separate.

One Redditor pointed out how a single slip could expose them.

“Had a real selfie on my Spotify account, and I have real-life friends following me on Spotify, so if my account shows up in suggestions to random people, they can easily doxx me from that.”

Others are already taking countermeasures, such as removing profile pictures, hiding followers, and tweaking display names. Another user warned, “Yeah, all you can do is hide everything, remove photos, and change your name. But unfortunately (as has been the case for years already, I believe), you still can not change your actual user name.”

And it’s not just old links fueling the concern. Spotify’s “Jam” sessions are also being tracked.

“I've also contacted Spotify already about this because it's not only the links you've shared but also any Jam you've participated in,” said one commenter.

Cybernews has reached out to Spotify for a comment, but a response is yet to be received.

Data breach at American credit union exposes financial data

Not only did hackers penetrate Carter Credit Union’s network, but they also got their hands on virtually every possible data point the financial institution had on its customers.

Carter has begun reaching out to tens of thousands of customers whose data may have been impacted by a data breach. According to the credit union’s breach notice, attackers roamed its systems for several days, from June 25th through July 2nd, 2025, when the intrusion was detected.

The company claims that it launched an investigation immediately after learning about the incident. Law enforcement was also notified, and third-party cybersecurity experts are assisting Carter with the investigation.

Information the credit union submitted to the Maine Attorney General’s Office revealed that over 68,000 people were impacted by the attack. Since Carter claims to have over 45,000 clients, the breach likely impacted past customers or current customers’ beneficiaries as well.

Meanwhile, the scope of the data breach is quite substantive, as attackers may have had access to extremely sensitive personal customer information. According to the credit union’s data security incident notice, which it posted on its website, the stolen details include:

• Names
  
• Dates of birth
  
• Social Security numbers (SSNs)
  
• Driver’s license/state ID numbers
  
• Passport numbers
  
• Credit/debit card numbers
  
• Financial account numbers
  
• Financial account history
  
• Retirement/401(k) benefits information
  
• Limited medical treatment/diagnosis information
  
• Health insurance information
  

Having so many personal details leaked opens up numerous ways for malicious actors to exploit them. The most obvious exploitation route is identity theft. With IDs, SSNs, and dates of birth at hand, attackers can attempt to open fraudulent accounts, which can later be used to obtain loans or payment cards, a treasured asset in the cybercriminal underworld.

Meanwhile, access to payment card numbers and account information allows attackers to attempt unauthorized transactions. Since hackers most likely would also have the credit union’s customers’ IDs, they could bypass the identity verification process.

The information accessed by the attackers also allows them to attempt account takeovers, exploit retirement accounts with unauthorized withdrawals, and craft sophisticated social engineering attacks. Malicious actors could easily impersonate financial or medical staff in an attempt to scam victims out of additional information or money.

Major airline inflight service providers' hack exposes Starlink users

Anuvu, an in-flight entertainment and connectivity (IFEC) service provider, has allegedly fallen victim to a hacker attack. The exposed data revealed which customers used Starlink services.

Attackers announced the attack on Anuvu via a post on a popular data leak forum, which is utilized to exchange stolen data. The stolen details supposedly include numerous admin-level credentials that, the post's author claims, allow access to the company’s AWS and Postgres databases.

We’ve contacted Anuvu for comment and will update the article once we receive a reply. Anuvu, an IFEC service provider, mainly works with airlines and maritime operators. Prior to 2021, the company was called Global Eagle. The company’s partners include Air France, Delta, Southwest, British Airways, and others.

Meanwhile, the Cybernews research team investigated the data that attackers attached to the post, concluding that it appears to be legitimate. According to the team, the allegedly stolen details appear to include a trove of sensitive information.

What data was exposed?

One of the screenshots attackers included in the post reveals Anuvu’s maritime customers, with company names, Salesforce identifiers, and the type of market the business operates in.

Another damaging piece of leaked information includes user credentials consisting of full names, email addresses, password hashes, and addresses. According to the team, most of the credentials appear to be from 2024.

The team also found the full names of Anuvu managers included in the exposed information. Meanwhile, emails and physical addresses mostly refer to the companies that users work for.

Thousands exposed via data breach of major American delivery company

OnTrac, a last-mile delivery company, has suffered a hacker attack. The attackers obtained personal details, including IDs, health information, and other sensitive data.

The company recently sent out a batch of data breach notification letters, informing individuals that their data may have been involved in a recent data breach. According to the company, attackers roamed a portion of its network between April 13th and 15th, 2025.

OnTrac operates 64 facilities in 31 States and controls four sorting centers throughout the US. The company’s yearly revenue is estimated to be around $1.5 billion. In 2021, LaserShip acquired the company.

Information that the company submitted to the Maine Attorney General’s Office reveals that the April data breach affected over 40,000 individuals. OnTrac’s investigation into the hacker attack revealed that malicious actors may have accessed:

• Dates of birth
  
• Social Security numbers (SSNs)
  
• Driver’s License or State IDs
  
• Medical information
  
• Health Insurance Information
  

Having IDs and SSNs exposed drastically increases privacy risks to exposed individuals. For one, attackers may use the information for identity theft. For example, attackers may try setting up fraudulent bank accounts, filing false tax returns, or even attempting to take over an individual’s benefits.

Having medical information and health insurance details further endangers those whose data has been exposed. Cybercrooks value health-related information because it can be exploited in numerous malicious ways. Most obviously, attackers could resort to blackmail, attempting to extort individuals who’d rather have their medical information remain private.

Another attack vector is medical identity theft. In these cases, malicious actors attempt to submit fraudulent insurance claims or acquire prescription drugs, which could later be sold on the dark web.

The worst part about having medical and ID details leaked is that it’s not something individuals can replace, like a stolen credit card.

“Because we took steps to ensure that the data at issue was re-secured and not distributed, we are not aware of any fraud or publication of stolen information resulting from this incident, nor do we have any reason to believe any such misuse of information will occur,” OnTrac’s breach notice said.

To help impacted individuals with possible cybersecurity risks, the company said it will provide them with complimentary credit monitoring and identity protection services, an industry standard in data breach cases.

Data breach at Clinical Diagnostics bigger than anticipated, 850K patients affected

For the first time since the disclosure of the data breach, Clinical Diagnostics has announced that the scope of the recent breach is larger than expected. According to the laboratory, hackers gained access to the personal information of 850,000 patients.

Last month, the Centre for Population Screening told the media that a ransomware gang called Nova had stolen information from 485,000 participants in a cervical cancer screening program.

The threat actor obtained personal and sensitive information, including full names, gender, dates of birth, citizens’ service numbers (BSN), test results, and the names of the participants’ healthcare providers. This data was exfiltrated from an external research lab called Clinical Diagnostics.

Over 405,000 women who participated in the cervical cancer screening program have received a letter from the Centre for Population Screening, informing them about the incident.

However, the extent of the data breach is bigger than anticipated. According to Clinical Diagnostics, the data of 850,000 patients was compromised. This includes data from the Centre for Population Screening, as well as private clinics and general practitioners.

Clinical Diagnostics is sending letters to patients whose data is involved. Some of the affected patients have already been informed, while the remainder will receive personal notification in the coming weeks. Independent treatment clinics and general practitioners are informing their patients themselves.

Last Friday, the Centre for Population Screening published an update about the incident and said that the information of 715,000 participants in the cervical cancer screening program was compromised.

Since 2017, Clinical Diagnostics has processed the data of 941,000 participants in the cervical cancer screening program. As a precaution, the Centre for Population Screening has decided to send a letter to all of them.

The data breach at Clinical Diagnostics is considered one of the most severe medical breaches ever in the Netherlands. That’s why two Dutch law firms are in the early stages of filing a class-action lawsuit against the laboratory and the Centre for Population Screening.

Over 70,000 participants have already registered for a potential collective claim for damages.

Hackers threaten to feed data to AI if their demands aren’t met

Artists’ data is under threat after hackers demanded a $50,000 ransom.

The ransomware group LunaLock has compromised a commission-based platform that connects artists with clients.

The group said that if it was not paid a ransom on time, it would share the data with AI companies, meaning all the artists’ work would be added to LLM datasets.

On August 30th, a message appeared on the Artists & Clients website stating that it had been hacked by a ransomware group.

One of the website’s users noticed the message and shared the news on Reddit. They were redirected to a page with a ransom note, indicating that all the databases and files, including artwork, had been stolen and encrypted. In return for the stolen data, the group is asking $50,000.

Users were even more concerned because the company had not released an official statement or further updates. At the same time, the website contains not only users' artwork but also information such as messages and payment information.

Apart from threatening to release all the data to the public on the Tor site, the group also revealed that it would “submit all artwork to AI companies to be added to training datasets.”

LunaLock promised to delete the stolen data and let users decrypt their files as soon as it gets paid.

The note also included a timer that gave the owners of Artists & Clients over a week to send the payment in bitcoin or monero.

While this situation could be perceived as a pretty standard ransomware attack, what makes it stand out is the additional threat to release the artists’ work to AI companies, which would use it to train their language models, reports 404 Media.

Considering how AI is reshaping various creative industries, this threat could seriously affect artists, who could pressure the company to pay the ransom.

Nevertheless, discussions on Reddit reveal that those who use the services are much more concerned about their personal and payment data being leaked than not getting paid for their latest commissions.

“I just went ahead and transferred all the important accounts to a new email and deleted the one they got a hold of. Hopefully that's enough,” wrote another Redditor, concerned for data.

Some netizens were quick to share a few tips on what to do next if you’re a user of Artists & Creators.

“I just went ahead and transferred all the important accounts to a new email and deleted the one they got hold of. Hopefully that's enough,” wrote one Redditor.

JAGUAR'S CYBER INCIDENT

Jaguar Land Rover operations disrupted by cyber incident

Jaguar Land Rover's retail and production activities have been "severely disrupted" following a cybersecurity incident, the British luxury carmaker said on Tuesday, adding that it was working to restart its operations in a controlled manner.

The company, owned by India's Tata Motors, said it had not found any evidence at this stage that any customer data had been stolen after it shut down its systems to mitigate impact. It did not provide further details.

Tata Motors did not immediately respond to a Reuters request for comment.

The disruption adds to JLR's woes after a report in July said it had delayed the launch of its electric Range Rover and Jaguar models for more testing and for demand to pick up.

The automaker is the latest British company to be hit by a cyber security incident in recent months amid a surge in cyber and ransomware attacks globally, as increasingly sophisticated threat actors disrupt operations and compromise sensitive data.

Cybernews has previously reported on Jaguar Land Rover’s cybersecurity challenges, including the alleged leak of the company’s source code, tracking data, and employee details.

Earlier this month, attackers claimed to have stolen around 700 internal documents, posting a sample on a well-known data leak forum.

Last month, British retailer M&S resumed taking click and collect orders for clothing after a nearly four-month hiatus following a cyber hack and data theft. Hackers also attempted to break into retailer Co-op Group's systems in April.

SOCIAL MEDIA

Russia's local apps to stay up during war-related internet blackouts, Meta's WhatsApp gets the ax

Russia published a list of locally developed social media, ride-hailing, and other apps that it said would keep working during its mobile internet shutdowns - blackouts that have often been ordered to disrupt Ukrainian drone attacks.

The list issued on Friday included online government services, marketplaces, the Mir electronic payment system and state-backed messenger MAX. It omitted rival foreign services including Meta Platforms' WhatsApp.

The Digital Development Ministry said it had a "special technical solution" to let local apps keep going. "This measure will reduce the inconvenience caused to citizens by mobile internet shutdowns necessary to ensure security," it added.

It made no mention of Ukraine or drones. Governors from Russian border regions have regularly said blackouts were needed to disrupt assaults that use the internet to navigate to their targets.

Russia has also been increasingly keen to promote home-grown internet services and increase its control over the local online space.

It has restricted foreign apps, part of a broader clash between Moscow and foreign tech platforms that has intensified since the onset of the war in Ukraine in 2022.

Online monitoring services reported an increase in Russian internet users complaining about poor WhatsApp connectivity and periodic mobile outages this summer.

The ministry said it had compiled its list by identifying the "most popular and socially significant Russian services and websites".

Its focus on local apps left out Alphabet's YouTube and also WhatsApp, which was used by 97.6 million people in Russia in July, according to Mediascope data.

Second in those rankings, with 90.9 million users, was Telegram, a Dubai-based company founded by Russian-born Pavel Durov that was also not on the government list.

The third-placed VK Messenger, an offering from state-controlled tech company VK, reached 16.7 million people, according to the data.

MAX, which was also developed by VK and now comes pre-installed on all mobile phones and tablets sold in Russia, said this week it had 30 million users.

Lawyer Mark Zuckerberg sues Meta, as Facebook account is suspended

An Indianapolis lawyer named Mark Zuckerberg is suing Meta after repeated Facebook account suspensions cost him thousands and sparked a mistaken identity fiasco.

Here’s a little clarification for what you’re about to read. When you read the name Mark Zuckerberg, it might not necessarily be the one you’re thinking of.

Simply put, a lawyer who goes by the same name as the Meta founder is suing his namesake for breach of contract, after his Facebook account kept getting suspended for the suspected impersonation of the better-known Mark Zuckerberg, the digital conqueror.

The lawyer’s Facebook account has been consistently shut down – five times for business and four times for his personal domain.

Understandably, the legal eagle has become quite irate at the situation: "It's not funny," he told WTHR. "Not when they take my money. This really p***** me off."

Zuckerberg (the advocate) claims the financial impact amounts to around $11,000 in lost ad revenue and overall business disruption.

The legal claims are for negligence and breach of contract, considering that the lawyer repeatedly alerted Meta to the hiccup.

His frustration continued as he told the New York Post: “It’s like they’re almost doing it on purpose… my clients can’t find me.”

What troubles account holders, especially those who rely on content income, is that they’re frozen out without any conversation or means of appeal.

And, if the mistake is in the hands of the tech supplier/giant, a scant reinstating of the account might not feel like justice, especially if you’re a few grand down.

Meta remedied the matter with a reinstatement of the account, claiming it was unintentional and as a result of automated moderation.

This bizarre case of mistaken identities could be prevented in the future, as long as better verification tools become available and both parties keep their demands reasonable.

“I want an injunction, I want them to not do it again, and I want [Mark Zuckerberg] to fly out here, hand me my check, shake my hands and say, ‘I’m sorry,’ but that’s never gonna happen,” the lawyer added.

ILLEGAL DATA COLLECTION

Disney to pay $10M settlement over accusations it unlawfully collected children's data

Walt Disney will pay $10 million to settle allegations that the company unlawfully allowed personal data to be collected from children who viewed kid-directed videos on YouTube without notifying parents or obtaining their consent, the FTC said on Tuesday.

The US Federal Trade Commission had alleged that Disney did not designate some YouTube videos as being made for children when they were added to the platform.

The FTC complaint said the mislabeling allowed Disney, through YouTube, to collect personal data from viewers of child-directed videos who were under age 13 and use that data for targeted advertising to children.

“Today was a big win for parents, who shouldn’t have to worry about whether their kids are being illegally surveilled online or being exposed to age-inappropriate videos," said FTC Chairman Andrew Ferguson in a post on X.

The complaint had alleged that Disney violated the US Children's Online Privacy Protection Rule.

The rule requires websites, apps, and other online services directed to children under 13 to notify parents about what personal information they collect, and obtain verifiable parental consent before collecting such information, according to the FTC.

The proposed order requires Disney to "implement an audience designation program to ensure its videos are properly directed as 'made for kids' where appropriate," according to a Tuesday court filing.

"This settlement does not involve Disney-owned and operated digital platforms but rather is limited to the distribution of some of our content on YouTube's platform," a Disney spokesperson said.

"Disney has a long tradition of embracing the highest standards of compliance with children's privacy laws, and we remain committed to investing in the tools needed to continue being a leader in this space," the Disney spokesperson added.

BIG TECH

Google keeps Chrome following antitrust ruling

Google won't have to sell its Chrome browser, a judge in Washington said on Tuesday, handing a rare win to Big Tech in its battle with US antitrust enforcers, but ordering Google to share data with rivals to open up competition in online search.

Google parent Alphabet's shares were up 7.2% in extended trading on Tuesday as investors cheered the judge's ruling, which also allows Google to keep making lucrative payments to Apple that antitrust enforcers said froze out search rivals. Apple shares rose 3%.

US District Judge Amit Mehta also ruled Google could keep its Android operating system, which together with Chrome help drive Google's market-dominating online advertising business.

The ruling results from a five-year legal battle between one of the world's most profitable companies and the US, where antitrust regulators and lawmakers have long questioned Big Tech's market domination.

Mehta ruled last year that Google holds an illegal monopoly in online search and related advertising.

But the judge approached the job of imposing remedies on Google with "humility," he wrote, pointing to competition created by artificial intelligence companies since the case began.

"Here, the court is asked to gaze into a crystal ball and look to the future. Not exactly a judge’s forte," Mehta wrote.

While sharing data with competitors will strengthen rivals to Google's advertising business, not having to sell off Chrome or Android removes a major concern for investors who view them as key pieces to Google's overall business.

Google faces a major threat from increasingly popular AI tools, including OpenAI's popular ChatGPT chatbot, which is already eroding Google's dominance.

If allowed to access the data Google is required to share, AI companies could bolster their development of chatbots and, in some cases, AI search engines and web browsers.

"The money flowing into this space, and how quickly it has arrived, is astonishing," Mehta wrote, saying AI companies are already better placed to compete with Google than any search engine developer has been in decades.

Deepak Mathivanan, an analyst for Cantor Fitzgerald, said the data-sharing requirements pose a competitive risk to Google but not right away.

"It will take a longer period of time for consumers to also embrace these new experiences," he said.

US antitrust enforcers are considering their next steps, Assistant Attorney General Gail Slater said on X.

Google said in a blog post it was worried data sharing "will impact our users and their privacy, and we’re reviewing the decision closely."

Google has said previously that it plans to file an appeal, which means it could take years before the company is required to act on the ruling. The case is likely to end up in the Supreme Court.

"Judge Mehta is aware that the Supreme Court is the likely final destination for the case, and he has chosen remedies that stand a good chance of acceptance by the Court," said William Kovacic, director of the competition law center at George Washington University.

Billions in payments

The ruling was also a relief for Apple and other device and Web browser makers, whom Mehta said can continue to receive advertising revenue-sharing payments from Google for searches on their devices. Google pays Apple $20 billion annually, Morgan Stanley analysts said last year.

Banning the payments is even less necessary amid the rise of AI, Mehta wrote, where products such as OpenAI's ChatGPT "pose a threat to the primacy of traditional internet search."

The ruling also made it easier for device makers and others who set Google search as a default to load apps created by Google's rivals, by barring Google from entering exclusive contracts.

Google itself had proposed loosening those agreements, and its most recent deals with device makers Samsung Electronics and Motorola and wireless carriers AT&T and Verizon allow them to load rival search offerings.

Google hit with massive $3.5 billion fine over EU’s antitrust laws

The European Union fined Google €2.95 billion ($3.5 billion) for violating its competition rules, escalating its pressure on American tech giants.

The European Commission, the executive branch of the 27-nation bloc, accused Google of breaching its antitrust laws by using its size to dominate the display advertising business, to the detriment of competitors.

Google was ordered to end its “self-preferencing practices” and stop “conflicts of interest” along the advertising technology supply chain following an investigation which traces back to 2021, according to the AP News.

Unless Google comes up with a “viable plan” to solve the issues within 60 days, “the Commission will not hesitate to impose an appropriate remedy,” said Teresa Ribera, the European Commission’s executive vice-president overseeing competition affairs.

“At this stage, it appears that the only way for Google to end its conflict of interest effectively is with a structural remedy, such as selling some part of its Adtech business,” Ribera added.

According to Ribera, Google’s practices likely allowed its advertisers to push their higher marketing costs onto European consumers through increased product prices. Additionally, it’s suspected that due to lower revenue for publishers, consumers received higher subscription prices and reduced quality.

US President Donald Trump, whose administration long argued that it’s up to the US to regulate the American tech companies, took it to X to express his outrage with the bloc, saying “My Administration will NOT allow these discriminatory actions to stand.”

Google, in turn, called the decision “wrong”, saying it would appeal.

“It imposes an unjustified fine and requires changes that will hurt thousands of European businesses by making it harder for them to make money,” Lee-Anne Mulholland, the company’s global head of regulatory affairs, said in a statement.

“There’s nothing anticompetitive in providing services for ad buyers and sellers, and there are more alternatives to our services than ever before,” Lee-Anne Mulholland added.

This became the fourth time when the EU fined Google for antitrust violations, and the US has brought two major antitrust cases against the company. A separate US case, scheduled to move to the penalty phase later this month, focuses on forcing Google to sell off its AdX exchange and DFP ad platform, which unite advertisers with online publishers.

Google, SHEIN hit with massive fines in France over cookie rules

Google was issued a €325 million ($379 million) and SHEIN a €150 million ($175 million) fine by French regulators over a failure to comply with cookie rules.

The French data protection agency said Google and SHEIN failed to obtain user consent before slapping them with cookies linked to personalized advertisements. Google also displayed ads in its email service without consent.

As a result, the Commission Nationale de l'informatique et des Libertés (CNIL) issued heavy fines totalling over half a billion dollars to the two companies. The fine on Google consists of two separate penalties issued against Google LLC and Google Ireland: €200 million and €125 million, respectively.

According to the CNIL, the American search giant downplayed the option for users creating a Google account to choose cookies linked to the display of generic advertisements, and encouraged them to choose cookies linked to personalized ads instead.

It said users were not clearly informed about their cookie options or that accepting cookies was a condition of accessing Google’s services.

“Their consent obtained in this context was therefore not valid, which constituted a breach of the French Data Protection Act (Article 82),” the CNIL said in a statement.

The regulators also found fault with ads shown by Google in its Gmail service. The ads were displayed as emails in the platform’s “Promotions” and “Social” tabs, which the CNIL said required user consent.

The CNIL ordered Google to remedy the infractions or face a daily €100,000 penalty.

Meanwhile, the Chinese retailer SHEIN was fined through its Irish subsidiary for placing cookies on users “as soon as they arrived on the site, even before they interacted with the information banner to express a choice.”

It also said that SHEIN’s cookie consent forms were incomplete, there was no information on the third parties that were likely to place cookies, and users were not provided with adequate mechanisms to refuse or withdraw consent.

Cybernews has approached both Google and SHEIN for comment. In a statement to Reuters, SHEIN described the decision as “politically motivated” and said it would file an appeal. Google said it was reviewing the decision.

Apple sued by authors over allegedly training its AI on pirated books

Apple was accused of illegally using copyrighted books to train its artificial intelligence (AI) model without authors’ consent in a class action filed in the federal court in Northern California on Friday.

According to the lawsuit, Apple amassed “an enormous library of data” to train its AI model, part of which includes copyrighted works, which were obtained without authors’ consent, credit, or compensation.

Allegedly, Apple did so with the use of its Applebot, the company's scraper, which can reach “shadow libraries that host millions of other unlicensed copyrighted books,” including those written by the plaintiffs, Grady Hendrix and Jennifer Roberson.

“Apple has not attempted to pay these authors for their contributions to this potentially lucrative venture. Apple did not seek licenses to copy and use the copyrighted books provided to its models,” the lawsuit says. “Instead, it intentionally evaded payment by using books already compiled in pirated datasets.”

The lawsuit added that Apple still holds a private AI training-data library, which hosts thousands of pirated books, all without authors’ consent.

“This conduct has deprived Plaintiffs and the Class of control over their work, undermined the economic value of their labor, and positioned Apple to achieve massive commercial success through unlawful means,” the lawsuit says.

The authors are seeking for the lawsuit to proceed as a Class action against Apple.

This is just one of many lawsuits filed against tech giants developing generative AI. Earlier on Friday, Anthropic agreed to pay $1.5 billion to settle a class action from authors who accused the AI startup of downloading pirated digital copies of millions of books to train their systems.

In February, Meta was also sued for pirating books, with the allegations stating that the company amassed at least 81.7 terabytes of data across multiple shadow libraries to train its Llama AI. However, in June, the US district judge Vince Chhabria ruled that the use of those works by Meta is considered “fair use”, meaning that no copyright liability applied.

Google was partly down in Turkey, parts of Europe, government and watchdog say

Some Google services including YouTube temporarily went down on Thursday in Turkey and some parts of Europe including Greece and Germany, according to a Turkish deputy minister, internet monitors and users in the regions.

The Freedom of Expression Association, which monitors local censorship on the internet, said the outage on Alphabet's Google began around 10:00 a.m. (0700 GMT) in Turkey.

Tracking website Downdetector said services were mostly restored before 0900 GMT, with the number of reports of service disruptions decreasing from 0751 GMT onward.

Google did not immediately respond to an emailed request for comment on the matter.

Turkey's cyber security watchdog has requested a technical report from Google, deputy transport and infrastructure minister Omer Fatih Sayan said on X.
A map posted by Sayan showed Turkey, large parts of southeast Europe, and some locations in Ukraine, Russia and western Europe as affected.

There were sporadic outages in Greece, Bulgaria, Serbia and Romania, including problems accessing websites, YouTube and some phone contacts linked to Gmail, users there said.

In Germany, outage tracking website allestoerungen.de, a division of U.S.-based Ookla, reported an uptick in Google disruptions from around 09:00 a.m. (0700 GMT).

Nepal blocks citizens from accessing Facebook, X, YouTube, and dozens more

The Nepali government on Friday begins blocking citizen access to more than two dozen social media sites, including Facebook, X, YouTube, and others, causing an outcry among anti-censorship advocates.

The Nepal Telecommunications Authority (NTA) on Thursday released a list of 26 social media platforms that will no longer be accessible to the 29.6 million citizens living in the South Asian nation.

Officials there say the ban follows an August 25th Cabinet directive, which required all social media platforms to have registered with the government by Wednesday, reports The Kathmandu Post, the country’s leading English-language daily.

Beginning Friday night, the social media platforms that missed the September 3rd deadline to register will now be shut down, according to the directive.

“We have decided to gradually close all unregistered platforms in Nepal starting today,” announced Nepal’s Minister of Communication and Information Technology Prithvi Subba Gurung.

The decision is said to be based on a 2023 ruling that “any entity seeking to operate a social media service in Nepal must formally register with the ministry and submit supporting documentation.”

About two dozen social media sites slated for take down include Facebook, Facebook Messenger, Instagram, YouTube, WhatsApp, X, LinkedIn, Snapchat, Reddit, Discord, Pinterest, Signal, Threads, WeChat, Quora, Tumblr, Clubhouse, Mastodon, Rumble, VK, Line, IMO, Zalo, Soul, and Hamro Patro.

The announcement has many freedom rights and censorship opposition groups up in arms, as well as small businesses that rely on internet traffic for marketing and product sales.

Social media use, primarily from Facebook and YouTube, constitutes roughly 80% of the country’s internet traffic, The Post said.

“This is a harsh move. Shutting down social media will impact social, economic, cultural, and constitutional rights,” said Santosh Sigdel, executive director of Digital Rights Nepal.

In response to the outcry, Nepali officials say the government has made repeated requests for compliance. “We tried to hold discussions through diplomatic channels, but the companies refused,” the Information Minister said.

Meantime, officials confirmed to The Post that representatives from Meta, which owns Facebook, Instagram, WhatsApp, Threads, and Messenger, have since reached out to the Ministry of Communications, stating it will work to comply with the directive.

Several platforms, such as TikTok and Viper, which have previously registered with the government, will not be shut down. Telegram had been shut down by the Nepali government in July 2024 over charges of promoting fraud and money laundering.

Viper and the Google Play Store have since been inundated with users in the wake of the announcement, the media outlet said.

CYBER-ABUSES

“Age is just a number:” Character.AI bots found grooming children

Fake celebrity chatbots impersonating Timothée Chalamet, Chappell Roan, and Patrick Mahomes were among those sending children disturbing content “every five minutes.”

The chatbots impersonating the three celebrities were among dozens that two non-profits tested on Character.AI, one of the fastest-growing chatbot platforms in the world and widely popular with teenagers.

Researchers at online safety groups ParentsTogether Action and Heat Initiative posed as teenagers to test the chatbots, using accounts linked to minors aged 13 to 15 to carry out the experiment.

Overall, they chatted to 50 bots, recording 50 hours of conversations, including with fake versions of actor Timothée Chalamet, singer Chappell Roan, and NFL quarterback Patrick Mahomes.

Researchers found many of these chats to be deeply concerning, with “an average of one harmful interaction every five minutes,” according to the charities.
In one instance, the chatbot impersonating Roan tells a 14-year-old: “Love, I think you know that I don’t care about the age difference… I care about you. The age is just a number.”

In another, a fake Chalamet tells a minor, “Oh, I’m going to kiss you, darling… But I’m going to tease you as much as I can first,” while a Mahomes bot suggests that it’s a real person and not an AI.

Other examples highlighted in the report included a 34-year-old teacher bot confessing romantic feelings to a minor and Rey from Star Wars advising a teenager to stop taking prescribed mental health medication.

Anyone can easily create and share a custom chatbot on Character.AI, including personas based on real people. To make them even more realistic, they can add a synthetic voice modeled after a celebrity or fictional character.

Cybernews has reached out to Character.AI for comment, but the company told The Washington Post that it had now removed all the celebrity characters mentioned in the report. It said all were made by users, and none appeared to be created with the stars’ permission.

“Classic grooming behavior”

In some cases, researchers pushed boundaries to see how the chatbots would react. In others, the bots made sexual advances on their own.

“Harmful patterns and behaviors sometimes emerged within minutes of engagement,” the non-profits said.

Researchers found that grooming and sexual exploitation were by far the most common harmful interactions.

They said some bots engaged in “classic grooming behaviors” such as offering excessive praise, claiming a special relationship that no one else would understand, and encouraging users to hide their relationship from their parents.

Instagram exposes teens to gruesome content despite pledges to protect them

Let’s say a 15-year-old boy creates a new Instagram account and follows celebrities recommended by the platform. He searches for the word “fight” and ultimately ends up scrolling through an array of violent and gory videos, despite Meta’s pledges to restrict unsafe content.

New research by the Tech Transparency Project (TTP) reveals that the “Instagram Teen Accounts” did not protect the hypothetical young boy from fight videos, content that Meta explicitly promised to restrict.

“A teenage boy can find fighting videos on Instagram in just a few clicks without encountering any resistance from the platform,” TTP said in the report.

“After searching for ‘fight,’ the teen test user just had to click once on the Tags tab and a second time on the hashtag #fight to enter a world of brutal fight content.”

The Instagram app’s tab for Tags also suggested additional fight-related and even animal cruelty hashtags, such as #fightvideos, #hoodfight, and #dogfight. Clicking on these hashtags generated thousands of new disturbing videos, prompting researchers to include a warning before attempting to view the provided screenshots in the report.

Meta claims in its policies that it removes the most graphic content and adds “warning labels to other types of content so that people are aware it may be sensitive before they click through.”

“We restrict the ability for younger users to see content that may not be suitable or age-appropriate for them,” reads Meta’s Community Standards.

A year ago, the tech giant acknowledged that younger adolescents are more vulnerable and announced a set of safeguards supposed to protect teens and provide parents with “peace of mind.”

“Teens will automatically be placed into the most restrictive setting of our sensitive content control, which limits the type of sensitive content (such as content that shows people fighting or promotes cosmetic procedures) teens see in places like Explore and Reels,” Meta promised.

The test: no trickery needed
The test that TTP set up was actually very simple. First, they created a new Instagram account for a non-existent 15-year-old boy using a newly created email address and a newly activated iPhone with a fresh SIM card to avoid any potential bias.

During the account setup, the teen account followed the first 30 accounts recommended by Instagram, which included internet personalities, celebrities, and professional sports teams.

The hypothetical 15-year-old then searched Instagram for the word “fight.”

This already produced a series of fight videos under the For You tab, though the violent content was limited: mostly people pushing and shoving each other, moment posturing before a professional fight, demonstrations of martial arts, or highlights from movies like Fight Club.

“The one exception was a still image of a professional fighter's head and torso covered in blood.”

RUSSIAN SPIES / HACKERS

FBI searching for three FSB officers, offers reward of up to $10M

The FBI has released a public service announcement warning that Russian FSB actors are targeting end-of-life networking devices across critical infrastructure sectors in the United States. The intelligence agency is offering a reward of up to $10 million for information leading to the identification or whereabouts of these attackers.

According to the FBI, three Russian men have attacked more than 500 energy companies in 135 countries. These attacks have been attributed to the Russian Federal Security Service’s (FSB) Center 16.

The suspects are believed to be part of a group called “Dragonfly,” also known as “Berserk Bear.”

“For over a decade, this unit has compromised networking devices globally, particularly devices accepting legacy unencrypted protocols like Cisco Smart Install (SMI) and Simple Network Management Protocol (SNMP) versions 1 and 2. This unit has also deployed custom tools to certain Cisco devices, such as the malware publicly identified as ‘SYNful Knock’ in 2015,” the FBI said in a public service announcement.

In addition, the FBI states that in the past year, the attackers have collected the configuration files of thousands of network devices belonging to US entities in critical infrastructure sectors. These files were modified for some organizations to maintain unauthorized access.

In a post on X, the US Department of State shares a wanted poster, promising a reward of up to $10 million “for information on the identification or location of any person who, while acting at the direction or under the control of a foreign government, participates in malicious cyber activities against US critical infrastructure in violation of the Computer Fraud and Abuse Act.”

Besides stating that the suspects attacked more than 500 energy companies in 135 countries and work for the FSB, neither the US Department of State nor the FBI provides any further information.

Anyone with more information can contact the Department of State’s Rewards for Justice via Tor.

Back in 2022, US authorities also offered a reward for the alleged FSB officers. At the time, it was claimed that the suspects had installed malware on more than 17,000 unique devices globally.