The European Commission has published official guidelines for the application of the Cyber Resilience Act (CRA), helping manufacturers, suppliers, and open-source projects better understand how the law should be applied in practice. The guidance clarifies when software, hardware, and combinations thereof fall under the CRA and when software is considered to be “placed on the […]
OpenAI is currently testing a feature in the US that allows ChatGPT Pro users to link their bank and credit card accounts via Plaid for personal budget insights. Although the AI has read-only access and cannot perform transactions, privacy experts warn of significant risks. Due to the accessible, human-like conversational style of chatbots, users may […]
The European Union Agency for Cybersecurity (ENISA) has released a practical Cyber Resilience Maturity Assessment Model to help SMEs prepare for the Cyber Resilience Act (CRA) before it becomes fully applicable in December 2027. The model focuses on five key domains: governance, secure-by-design risk management, vulnerability & patch management, product lifecycle management, and cybersecurity skills. […]
Google now allows users to log in via a selfie video, with the company storing this biometric data centrally. With each new login attempt, a live video is compared against the original stored on Google’s servers. While Google claims that the videos are stored encrypted and that movement prompts protect against deepfakes, this development raises […]
The Norwegian Data Protection Authority and the Norwegian Directorate of Health present a practical framework for privacy-friendly AI chatbots in the public sector. AI chatbots can provide citizens with faster access to reliable health information, provided that privacy by design is central. The report concludes that user queries generally cannot be considered anonymous, meaning the […]
Hugging Face disclosed a groundbreaking cyberattack in which an autonomous AI agent independently executed the entire intrusion—from initial compromise to privilege escalation and lateral movement. The attacker exploited vulnerabilities in the dataset-processing pipeline, performing more than 17,000 automated actions over a single weekend without direct human control. Although public models, datasets, and the software supply […]
The European Commission’s DG CONNECT disclosed nine documents in response to an access-to-documents request, but all were already publicly available resources. No Data Protection Impact Assessment (DPIA), internal privacy-by-design documentation, threat models, or controller-role assessments were released. DG CONNECT stated it does not hold a DPIA, arguing that responsibility lies with the future publisher of […]
Research by OCCRP, Investico, and NU reveals that the password manager Passwork, presented as European, was originally developed in Russia. The company reportedly deliberately shielded its Russian origins through structures in Finland, Spain, and the UAE. Cybersecurity experts warn that ties to the Russian state and defence sector pose additional risks, particularly for critical infrastructure. […]
The UK’s communications regulator, Ofcom, is demanding stronger age verification measures from social media platforms ahead of a proposed social media age ban. The regulator has launched an investigation into TikTok, questioning whether its current age assurance methods effectively protect minors. Ofcom is also investigating dozens of adult websites and working with Google and Bing […]
Research by NOS and Nieuwsuur shows that municipalities are still publishing residents’ personal data in documents made public under the Open Government Act (Woo). This includes email addresses, phone numbers, addresses, citizen service numbers (BSNs), and ID numbers that have been insufficiently anonymized. Several municipalities have since removed the documents and reported a data breach […]