60
Search: “Personal Information Protection Commission”
228 stories
60
Japan's Digital Agency says VPN flaw exposed 246,000 personnel records
Attackers exploited a VPN device vulnerability to breach Japan's Digital Agency, potentially exposing 246,000 records of government employees and officials.
Japan's Digital Agency disclosed that a third party exploited a medium-severity, non-zero-day vulnerability in a VPN device used by the Government Solution Service (GSS) to gain unauthorized access. Around 246,000 record rows were potentially exposed, including 236,000 names, 231,000 email addresses, 94,000 phone numbers, and 1,000 physical addresses of government employees and associated businesses. No My Number IDs, bank account details, or pension numbers were exposed, and no misuse of the data has been detected so far. The agency suspended the compromised staff account on July 9 and notified Japan's Personal Information Protection Commission on July 15.
70
60
60
60
60
60
60
60
TikTok Settles U.S. Child Privacy Case for $400 Million
TikTok will pay $400 million to settle U.S. DOJ/FTC claims that it violated COPPA by collecting data from children under 13.
The U.S. Department of Justice announced a $400 million settlement with TikTok and ByteDance resolving a 2024 lawsuit over violations of the Children's Online Privacy Protection Act (COPPA). TikTok will pay $300 million immediately and $100 million upon entry of an order vacating a prior consent decree against its predecessor Musical.ly; it is one of the largest recoveries ever obtained in a COPPA case. The DOJ and FTC, filing in California, alleged TikTok knowingly allowed children under 13 to create accounts and illegally collected data via Kids Mode. TikTok was previously fined €345 million by Ireland's Data Protection Commission in 2023 for GDPR breaches involving children's data.
65
60
60
60
60
60
60
CenterPoint Energy confirms customer data stolen in cyberattack
CenterPoint Energy confirms attackers stole customer personal data, with a threat actor leaking 7.49 million records scraped from an unprotected API.
CenterPoint Energy, a utility serving about 7 million metered customers across Indiana, Minnesota, Ohio, and Texas, confirmed in an SEC filing that an unauthorized third party obtained customer personal information via an external-facing system. A threat actor using the alias "4d722e4d656f77" leaked 7.49 million records containing names, phone numbers, service and billing addresses, account numbers, billing amounts, and partial Social Security numbers. The actor claims the data was exfiltrated by iterating through millions of IDs on CenterPoint's public API, which lacked rate limiting and WAF protections. Electric and gas services were not impacted, but multiple federal class-action lawsuits have already been filed.
78
60
FTC: Patch Log4j Now or Risk Major Fines
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60