55
57
42
60
30
60
You don’t have to join the hack-back program to inherit its risk
A new US presidential memorandum creates a vetted private hack-back program, leaving participating vendors and their customers with untested legal liability and collateral risks.
The August 12 National Security Presidential Memorandum directs the National Coordination Center, run jointly by DOJ and DHS, to approve covert surveillance and disruptive Cyber Effects Operations by vetted private companies, with a forfeitable bond of at least $1 million required as a contract condition. The analysis argues the criminal shield rests on an untested reading of the CFAA exemption at 18 U.S.C. 1030(f), with no civil safe harbor, no state-law preemption and no foreign-law protection. Non-participating organizations can still inherit risk through shared infrastructure collateral damage, lack of customer disclosure, Lloyd's bulletin Y5381 state-backed attack exclusions, and threat-intelligence pipelines feeding offensive proposals.
52
60
42
60
42
57
55
60
57
30
30
57
55
55
57
30
30
42
60
60
57
60
Grindr Settles UK Data Privacy Claims for £26m
Grindr will pay £26m ($35.2m) to settle UK group claims alleging unlawful sharing of sensitive data, including HIV status, before 2020, without admitting liability.
The settlement, reached on September 2 and disclosed to the US SEC, covers roughly 12,000 claimants represented by Austen Hays over the free app's 2016–2020 data practices when Grindr was owned by Chinese conglomerate Kunlun. Grindr will pay £13m by December 31, 2026 and £13m by March 31, 2027, and continues to dispute the allegations; the agreement contains no admission of liability. The claims concerned sharing HIV status, PrEP use, ethnicity, and sexual orientation data with analytics providers Apptimize and Localytics without adequate consent. Norway's data protection authority fined Grindr €6.5m in 2021, and the UK ICO reprimanded the company in July 2022.
30
When AI quietly breaks things, who pays?
Reed Smith partner David Halbreich explains how AI companies can avoid D&O/E&O coverage gaps around mergers, governance warranties, and claims timing.
In an interview, insurance recovery partner David Halbreich of Reed Smith outlines insurance pitfalls for AI companies under claims-made D&O and E&O policies. He highlights 'straddle' claims after mergers that fall between tail coverage and go-forward policies, potentially leaving policyholders with no coverage. He also warns that governance artifacts submitted in insurance applications, such as bias testing records and model cards, can become warranties carriers use to deny claims, and discusses who should answer AI-use questions and how business interruption coverage applies to cloud and compute vendor outages.
15
‘Show How 3M Is 0% at Fault:’ Expert Witness Used ChatGPT to Write Report Defending Company in Deadly Explosion Lawsuit
An expert witness hired by 3M used ChatGPT to write portions of his report in a fatal Houston explosion lawsuit, with prompts discoverable.
An expert witness retained by 3M in litigation over the 2020 Watson Grinding explosion in Houston, which killed three people and destroyed roughly 200 homes, used ChatGPT to draft significant portions of his expert report. Discovery records revealed prompts asking ChatGPT to 'show how 3M is 0% at fault' and to defend 3M's standard of care. The case demonstrates that AI prompts used to produce expert testimony can be discoverable during litigation, with hundreds of millions of dollars in liability at stake in the ongoing lawsuits.
30
Pornhub's Parent Company to Pay $120 Million to Settle Child Sexual Abuse Lawsuits
Pornhub parent Aylo will pay $120 million settling child sexual abuse class actions, without admitting liability, and adopt stricter content moderation commitments.
Aylo, Pornhub's parent company (formerly Mindgeek, acquired by Ethical Capital Partners in 2023), will pay $120 million to settle two 2021 class actions in California and Alabama alleging its platforms hosted child sexual abuse material in violation of federal trafficking and child imagery laws. The settlement fund begins with $25 million in 2026 followed by six annual installments. The class covers anyone under 18 appearing in content on Mindgeek-operated sites between February 12, 2011 and December 6, 2024. The deal, subject to court approval, adds commitments to age-verify models, conduct human and automated content review, and report suspected abuse material to authorities.
20
Srsly Risky Biz: Data Theft Extortion Is Booming! Hooray!
Google's Threat Intelligence Group reports data theft extortion is surging, with Silent Ransom extracting $10M and $18M from two law firms and BlackFile taking $10M.
Risky Business News, citing Google Threat Intelligence Group (GTIG), reports that cybercriminals are shifting from encrypting ransomware to data theft extortion. Law firms Goodwin Procter and WilmerHale paid Silent Ransom (Luna Moth) ransoms of $10 million and $18 million respectively; GTIG says the group often completes contact-to-extortion in a single day, now sometimes compromising systems in person posing as IT staff. BlackFile, now calling itself Redact, used high-volume vishing to steal credentials and pivot through OneDrive, SharePoint and other SaaS apps, collecting more than $10 million between February and mid-May with an average ransom of $750,000, including attempted attacks on Wall Street hedge funds and private equity firms. The piece argues governments should keep pressure on encrypting ransomware gangs while lower-impact extortion absorbs criminal energy.
75
55
60
60
60
60
55
30