Data Breach Roundup (Mar 20 - 26, 2026)
This week saw breaches from anime streaming service Crunchyroll, carmaker Mazda, cybersecurity company HackerOne, and a new hacker group called "Internet Yiff Machine." No, really.
Latest in News Briefs
Android 17 is Getting a Post Quantum Cryptography Upgrade
Following their shortening of the deadline to implement post-quantum encryption to 2029, Google today announced the “first phase” of its post-quantum transition.
French Aircraft Carrier Located in Real Time Via Fitness App
French newspaper Le Monde was able to locate a French aircraft carrier in real time using publicly available profile information of a French Navy officer on the fitness app Strava.
GrapheneOS Won’t Implement Age Verification
The security and privacy-focused GrapheneOS stated in an X post that they will “remain usable by anyone around the world without requiring personal information, identification or an account.”
Severe Meta Cybersecurity Incident Caused by AI Agent
The Information reports that a cybersecurity incident classified as the second-highest severity level Sev 1 occurred due to an AI agent similar to OpenClaw.
Big Tech Creates “Accord Against Online Scams & Fraud”
Eleven companies have signed an accord to address the growing issue of “online scams and fraud,” with the notable exclusion of Apple.
FBI Seeks Info from Gamers Who Installed Malware from Steam
Steam was used to spread malware via several games, and the FBI Seattle division has announced that they’re seeking information from those affected.
Data Breach Roundup (Mar 13-19, 2026)
Once more from the "irony" department: an "identity protection" company falling for a phishing attack.
KadNap Botnet Hijacks Asus Routers
The Black Lotus Team at Lumen has discovered a new malware strain called KadNap that has been creating a botnet of Asus routers since at least August 2025.
Data Breach Roundup (Mar 6 - Mar 12, 2026)
This was a busy week for data breaches featuring Starbucks, Loblaw, DOGE, and many more.
Pokémon Go Players’ Data Used to Train “Visual Positioning” AI
Niantic spinoff, Niantic Spatial, used over 30 billion images taken by users of Pokemon Go to train its “visual positioning” system to help robots navigate the world.
Intel’s Fully Homomorphic Encryption Chip Could Revolutionize Privacy
Intel’s hardware-accelerated Fully-Homomorphic Encryption chip, Heracles, could bring fully E2EE server-side processing into viability.
UK Corporate Registry Exposes Personal Information of Employees
The UK’s Companies House alerted the public of a security issue that allowed other users to access “dates of birth, residential addresses and company email addresses.”
Instagram Ending E2EE Support
Instagram has notified its users that it will no longer support E2EE after May 8, 2026, according to the support page for the feature.
AI Agents Beginning to Help Attackers Accelerate Stealing Your Data
While generation of malicious code, media, and phishing material are already making heavy use of AI, threat actors are “experimenting” with AI agents to automate decision making.
Data Breach Roundup (Feb 27 – Mar 5, 2026)
A lighter than normal week, but still we saw LexisNexis, a global paint maker, and more get hit, plus an update to the UH Cancer Center's breach.
Coruna Malware Targeting iOS Spotted by Google Threat Intelligence
Google Threat Intelligence Group has identified a “powerful exploit kit” targeting iPhones running iOS 13.0 to 17.2.1 used by a surveillance company and crypto-stealing sites.
New JVG Quantum Decryption Algorithm Could Pose Risk to Classical Encryption
A new quantum decryption algorithm called JVG could significantly reduce the amount of resources needed to decrypt classical RSA encryption that we’ve been relying on for decades.
TikTok Won’t Add E2EE for User Safety
TikTok told the BBC that it will not be rolling out end-to-end encrypted DMs, citing user safety as a concern.
Meta Smart Glasses Sending Sensitive Recordings to Workers to Annotate
According to a report by SVD, Meta’s Ray-Ban AI Smart Glasses have been sending sensitive recordings of people, including “bank details, sex and naked people,” to outsourced companies to review and annotate.
“ClawJacked” Vulnerability Allows Malicious Websites to Take Control of OpenClaw
Oasis Security discovered a vulnerability in the popular OpenClaw agentic AI software that allows websites to silently bruteforce access to a locally running instance and take it over.