Online fashion retailer Revolve has told regulators that the September cyberattack affected more than 1.5 million individuals.

The post Revolve Puts Data Breach Victim Count at 1.5 Million appeared first on SecurityWeek.

Hackers compromised an external cloud service used by the shopping platform and may have stolen personal information from it.

The post Iris Plaza Breach May Have Exposed Data of 7.7 Million Customers appeared first on SecurityWeek.

Hackers stole personal, health, and insurance information, including Social Security numbers, from the company’s internal systems.

The post Amplifon Americas Data Breach Impacts 1.3 Million appeared first on SecurityWeek.

Frontline Education told Indiana regulators that its August data breach affected over 3 million school district staff and students.

The post Over 3 Million People Hit by Frontline Education Data Breach appeared first on SecurityWeek.

Olivia DeRicco reports: Woodley, et al. v. Google LLC, et al. Filed: October 9, 2026 ◆ § 5:26-cv-11715 Read Complaint A class action lawsuit alleges Google and UPS wrongfully disclose users’ private data to third parties by way of the Google Search tracking widget. A proposed class action lawsuit alleges that the Google Search-based “Track...

Hackers created an account on an internal system and accessed names, email addresses, phone numbers, and business addresses.

The post DigiCert Data Breach Impacts Business Customer Information appeared first on SecurityWeek.

ABC News reports: NT Health has issued a ban on smart glasses at all of its clinical sites, as part of an internal department review into its privacy policies prompted by a breach at Royal Darwin Hospital earlier this month. The breach involved a medical observer, Dr Neda Mogharehabed, who was visiting Royal Darwin Hospital...

Bruce Armon, Evan Foster, and Jazmine B. King of Saul Ewing LLP write: On September 2, 2026, HB 381 was signed into law and amends Delaware’s data breach notification statute effective immediately. The new Delaware breach law includes a 60-day notice provision to the Delaware Attorney General, narrows the safe harbor for institutions covered by...

Using compromised credentials, the attackers accessed OpsShield’s update servers and poisoned multiple cPGuard versions.

The post Malicious cPGuard Updates Served in OpsShield Supply Chain Attack appeared first on SecurityWeek.

Hackers exploited a flaw in third-party software and stole the personal information of school district staff and students.

The post Frontline Education Data Breach Impacts Over 1.3 Million appeared first on SecurityWeek.

California Attorney General Rob Bonta today announced a settlement with Lyft, resolving allegations that the company violated the California Consumer Privacy Act (CCPA) and California’s Unfair Competition Law by failing to offer consumers the ability to opt out of the sale of their personal information within Lyft’s mobile app. The settlement includes $1.8 million in...

Oregon will receive more than $10.4 million, and GM must now get drivers’ clear permission before collecting or sharing their driving and location data Attorney General Dan Rayfield today announced that General Motors will pay $220 million to settle allegations that it sold drivers’ private driving behavior and location data to data brokers, who then...

From the Information Commissioner’s Office: We have reprimanded Staffordshire Police after the force unlawfully disclosed a domestic abuse victim’s home address to their alleged abuser. The incident occurred in March 2024 when Staffordshire Police issued a Domestic Violence Protection Notice (DVPN), an emergency measure intended to protect a victim from violence or threats of violence....

Mario Trujillo writes: In a victory for data privacy, a federal court in New York definitively ruled that the Office of Personnel Management (OPM) violated the law when it disclosed millions of federal employee records to DOGE agents. In a summary judgment ruling issued on October 20, 2026, the court found that OPM violated two...

The Florida Department of Education says SSNs and other personal data may have been exposed in a breach of its financial aid website.

The post Florida Student Aid Website Hack Puts Data of 4.9 Million People at Risk appeared first on SecurityWeek.

Hackers accessed its online shopping platform and stole customers’ personal and payment card information.

The post Revolve Data Breach Impacts at Least 200,000 People appeared first on SecurityWeek.

The attackers used offensive agentic techniques to access the company’s systems and internal tools.

The post Chainalysis Discloses Data Breach Following AI-Driven Cyberattack appeared first on SecurityWeek.

DebugBear says its DNS records were compromised via its domain registrar, and early findings show a single customer was targeted.

The post Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack appeared first on SecurityWeek.

California Attorney General Rob Bonta today announced a settlement with Lyft, resolving allegations that the company violated the California Consumer Privacy Act (CCPA) and California’s Unfair Competition Law by failing to offer consumers the ability to opt out of the sale of their personal information within Lyft’s mobile app. The settlement includes $1.8 million in...

Oregon will receive more than $10.4 million, and GM must now get drivers’ clear permission before collecting or sharing their driving and location data Attorney General Dan Rayfield today announced that General Motors will pay $220 million to settle allegations that it sold drivers’ private driving behavior and location data to data brokers, who then...