All news with #regulatory action tag

🔒 The Information Commissioner's Office found that an unredacted settlement document related to the long-running Horizon scandal exposed the names, home addresses and postmaster status of 502 litigants on the Post Office website between 25 April and 19 June 2024. The ICO considered a fine just under £1.1m but issued a reprimand under its public sector approach after concluding the breach was not 'egregious'. The regulator criticised the Post Office for lacking documented publishing policies, quality assurance and sufficient staff training; the organisation has offered compensation and 24 months of identity protection and taken steps to remove cached copies and strengthen controls.

🚫 Roskomnadzor has restricted access to the US gaming platform Roblox, saying it repeatedly failed to stop the distribution of what the regulator described as LGBT propaganda, extremist and terrorist materials, and calls for violent illegal actions. The agency said unsafe content appeared in in-game rooms where users can simulate attacks, target schools, or participate in gambling. Roblox was reportedly warned in November after moderation shortcomings were confirmed.

🔒 The UK government plans to ban ransomware payments for public sector and critical national infrastructure, while requiring other businesses to notify authorities if they intend to pay attackers. Announced after a public consultation and detailed in a September policy paper, the measure will include national security exemptions to avoid creating impossible choices for essential services. Security Minister Dan Jarvis said the move is a priority and that adoption will proceed when parliamentary time allows, with ongoing coordination across government and allied states.

🛡️ The Pall Mall Process, launched in 2024 by the UK and France with 27 governments and major tech firms onboard, seeks to set guidelines for commercial cyber intrusion capabilities. Its second phase invites input from the offensive cyber industry — vendors, brokers, researchers and service providers — on what constitutes responsible behaviour. The guidance will complement the existing Code of Practice for States and aims to curb irresponsible trade in spyware and zero‑day exploits. The public consultation closes on December 22.

⚖️ The FTC has proposed a settlement requiring Illuminate Education to delete unnecessary student data and strengthen its security program after a 2021 breach that exposed information for about 10.1 million students. The agency alleges failures including lack of access controls, storing data in plain text, weak patching, and misrepresenting encryption in contracts. The proposed order mandates data minimization, a public retention schedule, prompt breach reporting to the FTC, and will be open for 30 days of public comment; violations could trigger civil penalties.

🧭 The piece argues that AI forces a societal reckoning similar to the arrival of social media: it can amplify individual agency but also concentrate control and harm democratic life. The authors identify four pivotal choices for executives and courts, Congress, states, and everyday users—centering on legal accountability, privacy and portability, reparative taxation, and consumer product choices. They urge proactive, aligned policy and civic action to avoid repeating past mistakes and to steer AI toward public-good outcomes.

🕹️ The UK Information Commissioner's Office has launched a focused review of 10 popular mobile games to assess compliance with the Children’s Code (Age-Appropriate Design Code). The review will scrutinize default privacy settings, geolocation controls, targeted advertising and other design features that could affect children’s privacy. The ICO cited parental research showing high levels of concern about data collection, exposure to strangers and harmful content in mobile games.

📱 India’s telecommunications ministry has instructed major handset manufacturers to preload the government-backed cybersecurity app Sanchar Saathi on all new phones within 90 days, according to Reuters. The directive, dated November 28, 2025, reportedly requires the app to be non-removable and non-disableable and mandates pushing it via updates to devices already in the supply chain. Sanchar Saathi enables reporting of fraud and malicious links, blocking and tracking stolen devices, and checking multiple mobile connections; it has more than 11.4 million installs and has helped trace and recover hundreds of thousands of handsets.

🔒 Wisconsin lawmakers are advancing legislation that would require age verification on sites deemed potentially sexual and mandate blocking users who access content via VPNs. The measure, A.B. 105 / S.B. 130, expands definitions of harmful to minors and would force site operators to verify age and detect or block VPN connections. Critics argue it undermines privacy, free expression, and effective safety outcomes, and advocates such as the EFF call the proposal a terrible idea.

🔒 Investigators from Germany and Switzerland have shut down a cryptocurrency mixing service and seized server infrastructure, securing crypto assets with a converted value of around €25 million. Authorities say the platform, cryptomixer.io, was active since 2016 and allowed anonymous deposits and withdrawals. The operators are suspected of commercial money laundering and running a criminal trading platform; evidence including servers and email accounts was seized in Switzerland.

🔒 Europol, working with Swiss and German authorities, has seized over €25m in Bitcoin and taken control of the Cryptomixer service following coordinated actions in Zurich between 24 and 28 November. Three servers, the cryptomixer.io domain and more than 12 terabytes of data were confiscated, and a seizure banner replaced the site after law enforcement shut down the hybrid mixing platform. Since its founding in 2016, Cryptomixer is believed to have processed more than €1.3bn in Bitcoin and was widely used to obfuscate proceeds from ransomware, drug and weapons trafficking, and payment card fraud.

🔒 Law enforcement in Switzerland and Germany dismantled the Cryptomixer cryptocurrency-mixing service during Operation Olympia, seizing three servers, the cryptomixer.io domain, and about €24 million in Bitcoin. Europol and Eurojust supported the operation. Cryptomixer had been used to obfuscate proceeds from ransomware, drug and weapons trafficking, and payment card fraud by pooling and redistributing funds across many addresses, often taking a commission for the service.

🔒 The French Football Federation (FFF) reported unauthorized access to the centralized software used by licensed clubs to manage player registrations, an intrusion it believes occurred on 20 November. Exposed fields include names, genders, dates and places of birth, nationalities, postal and email addresses, phone numbers and football license ID numbers. The FFF says it deactivated the compromised account, reset all user passwords, filed a complaint with authorities and notified CNIL and ANSSI. It will inform affected individuals with known emails and urged license holders to remain vigilant against phishing and scam attempts.

🔒 Comcast will pay $1.5 million to settle an FCC investigation after a February 2024 vendor breach at Financial Business and Consumer Solutions (FBCS) exposed the personal data of 273,703 current and former Xfinity customers. Under the consent decree Comcast must implement a compliance plan with enhanced vendor oversight, biennial risk assessments, and biannual reporting. Comcast says its network was not breached and has not conceded wrongdoing.

⚖️ The UK’s Business and Trade Committee has recommended making software providers legally accountable for insecure products, arguing that voluntary measures like the Software Security Code of Practice are insufficient to protect economic stability. The report highlights 2025 incidents affecting Co-op, M&S and Jaguar Land Rover that produced heavy public costs and operational disruption. It urges mandatory compliance, stronger enforcement powers and compulsory incident reporting to shift financial risk back to vendors.

⚠ The FCC has reversed its January 2025 Declaratory Ruling that required US telecom providers to adopt and annually certify stricter cybersecurity controls under CALEA. The agency said the earlier order was misconstrued and unlawful, citing recent engagements with carriers and targeted actions instead of prescriptive mandates. Critics, including FCC Commissioner Anna Gomez and security experts, warn the rollback could leave critical infrastructure more exposed after the Salt Typhoon attacks.

🔒 The FCC has rescinded a January 2025 declaratory ruling under CALEA that would have required telecom carriers to adopt formal cybersecurity risk-management plans, submit annual certifications, and treat network cybersecurity as a legal obligation after the Salt Typhoon intrusions. The agency, now led by new commissioners, also withdrew the accompanying NPRM, calling the prior approach inflexible and legally flawed. Carriers say they have strengthened defenses and agreed to continued coordination, while critics warn that relying on voluntary measures risks leaving national communications infrastructure exposed.

📰The U.S. Securities and Exchange Commission has voluntarily dismissed its lawsuit against SolarWinds and CISO Timothy G. Brown, filing a joint motion to dismiss on November 20, 2025. The October 2023 complaint alleged fraud, internal control failures, and misleading disclosures tied to the late-2020 supply-chain compromise attributed to APT29. Many allegations were rejected by the SDNY in July 2024 as relying on hindsight. SolarWinds' CEO said the company emerges stronger, more secure, and better prepared.

🔒 The founders of the Samourai Wallet crypto-mixing service, CEO Keonne Rodriguez and CTO William Lonergan Hill, were sentenced after pleading guilty to operating an unlicensed money-transmitting business and laundering funds. Rodriguez received five years and Hill four years in prison, plus fines and three years of supervised release. Authorities seized servers and domains, removed the mobile app, and secured forfeiture of $237,832,360.55 linked to illicit transactions.

🔐 Amazon Web Services has been designated a critical third-party provider (CTPP) by the European Supervisory Authorities under the EU’s DORA regulation, which took effect in January 2025. The designation establishes a formal oversight relationship between AWS and the ESAs and signals heightened regulatory engagement for financial services customers operating in the EU. AWS says it will continue investing in compliance, operational resilience, risk management, and transparency, and will support customers with documentation, whitepapers, and a dedicated security and compliance team to help meet DORA obligations.