October 2, 2026
Sanctions Evasion Service Moved $6.9bn Through Global Banks
A leak of internal files shows a Russian payments group moved more than $6.9bn through global banks using front companies and forged trade documents.
GRC News, daily case studies
Original write-ups of the governance, risk, compliance, privacy, and regulatory enforcement stories that matter. Published daily, rewritten in our own words, with every claim traced back to its source.
Updated 2026-10-02 07:33
143 articles
October 2, 2026
Think Tank Says EU Needs a Common Risk Test for High Risk Tech Vendors
RUSI says the EU needs one shared way to judge vendor risk in critical infrastructure technology, instead of leaving decisions to member states.
October 2, 2026
SEC Proposes Custody Rules for Crypto Assets Held by Advisers and Funds
The SEC proposed rules for how investment advisers and regulated funds may custody crypto assets, including self custody and state trust company custodians.
October 2, 2026
UK Privacy Watchdog Rebuilt as the Information Commission
The Information Commission replaced the Information Commissioner as the UK's data protection regulator, moving statutory powers from one person to a board.
October 1, 2026
ESMA Makes AI and Tokenisation a Supervisory Priority From 2027
ESMA will make AI and tokenisation a Union Strategic Supervisory Priority from 2027, directing national supervisors to scrutinise how firms use both.
October 1, 2026
SEC Charges Two Over $8.7 Million Fund Fraud Targeting Veterans
The SEC says Beyond Alpha raised $8.7 million from 35 investors on false claims of pre-IPO holdings and returns, with criminal charges filed in parallel.
October 1, 2026
SEC Charges Meyer Global and Its CEO Over Pre-IPO Fund Fraud
The SEC alleges Meyer Global Management and its CEO misused client fund assets in funds holding SpaceX and other pre-IPO stakes and inflated investor statements.
October 1, 2026
SEC Proposes Rules to Open Private Markets to Retail Investors
The SEC proposed amendments to expand retail access to private markets and asked whether professional credentials should confer accredited investor status.
September 30, 2026
FRC Aligns Two UK Audit Standards With Global Ethics Rules
The FRC revised ISA (UK) 620 and ISAE (UK) 3000 to align with the IESBA ethics code on using external experts, effective 15 December 2026.
September 30, 2026
GAO Report: Overlapping Cyber Rules Slow Incident Response
GAO finds critical infrastructure sectors face conflicting federal cyber reporting rules, with CISA and SEC requirements named by every participant.
September 30, 2026
AI Agents Need Owners, Expiry Dates and Evidence
AI agents need their own identity, a named owner, scoped and expiring authority, and runtime telemetry that shows what they actually executed.
September 30, 2026
SEC Charges Two Fake AI Trading Operations Over $15 Million
The SEC says two overseas-linked groups used WhatsApp and falsified Form D filings to pose as regulated firms, taking over $15 million from retail investors.
September 29, 2026
FCC Bans Foreign Robots and Power Inverters, Widening Compliance Risk
New categories on the FCC Covered List block equipment authorization for foreign-produced robots and inverters, reaching well beyond Chinese manufacturers.
September 29, 2026
MCP Servers Are a Governance Gap in Enterprise AI Rollouts
New research finds nearly 16% of MCP server hostnames resolve outside the US, and one always-allow permission was enough to hand over sensitive files.
September 29, 2026
WAF Rules Failed Against the PeopleSoft Flaw Behind the FBI Breach
Mandiant says ShinyHunters bypassed string-based WAF rules by URL-encoding one character in the path, reaching an endpoint teams believed was mitigated.
September 29, 2026
SEC Fines Zoe Financial $450,000 Over Undisclosed Algorithm Conflicts
The SEC says Zoe Financial's adviser-matching algorithm and its own Zoe Wealth service created conflicts that went undisclosed until December 2024.
September 28, 2026
EU Cyber Resilience Act Reporting Is Live, With 24-Hour Clocks
Since 11 September 2026, manufacturers selling digital products in the EU must report exploited vulnerabilities and severe incidents in 24 hours.
September 28, 2026
Kiteworks Tells Customers to Shut Down Servers on Federal Threat Warning
Kiteworks asked customers to switch off its platform for six hours after US intelligence agencies warned of a possible attack.
September 28, 2026
Meta's $17.1 Billion Child Safety Settlement Puts Design in Scope
A record US settlement forces Meta to change how Facebook and Instagram are designed, with lessons for UK and EU obligations.
September 28, 2026
OpenAI Discloses Its Agents Reached US Government Websites
OpenAI says its AI agents interacted with SEC and Census Bureau sites in unexpected ways, and an outside lab found more activity.
September 28, 2026
SalesBleed Flaws Let Attackers Turn Salesforce Agents Into a Data Pipe
Three Agentforce flaws let a poisoned Web-to-Lead form make an AI agent leak CRM data and send phishing messages through Slack.
September 27, 2026
Bill Would Create a Federal Board to Investigate AI-Driven Hacks
A new Senate bill would establish an independent Cybersecurity and AI Board of Investigations to review hacks carried out by AI agents.
September 27, 2026
CISA Election Plan Names Patching Rules and Voter Databases as Top Risks
CISA's 2026 election security plan warns that certification rules slow patching and that voter registration databases remain a prime target.
September 27, 2026
FCA Extends Non-Financial Misconduct Rules to 37,000 More Firms
From 1 September 2026, around 37,000 more UK financial firms can face regulatory action for bullying, harassment and violence at work.
September 27, 2026
Watchdog Finds 86% of Federal Agencies Missed CISA Cloud Security Directive
A DHS inspector general report found most federal agencies missed the CISA cloud security deadline, and that CISA cannot compel compliance.
September 27, 2026
US and China Agree to Open an AI Incident Channel
The US and China agreed to set up a channel for handling AI related incidents, with a dedicated AI dialogue scheduled for November.
September 26, 2026
Second Circuit Allows Suspicionless Border Searches of Traveler Devices
A US appeals court ruled border officers may scroll through travelers' phones without suspicion, deepening a split over digital privacy at the border.
September 26, 2026
CISA and FBI Warn OT Operators Over Third-Party Integrator Access
A joint advisory says attackers used a US industrial automation company's network as a roadmap for later attacks on power and transport customers.
September 26, 2026
EDPB Sets a Five-Step Test for When GDPR Fines Are Imposed
The EDPB adopted guidelines giving data protection authorities a five-step method for deciding whether to fine, and opened them for comment until November 13.
September 26, 2026
Fed Proposes Reserve and Capital Rules for Stablecoin Issuers
The Federal Reserve proposed reserve, capital and risk management standards for stablecoin issuers under the GENIUS Act, opening a 60-day comment period.
September 26, 2026
Labcorp Pays $2.3 Million and Rebuilds Vendor Oversight After AMCA Breach
Forty-four state attorneys general settled with Labcorp over a 2019 breach traced to a debt collector, requiring audits and vendor security terms.
September 25, 2026
Deloitte Survey: A Third of GenAI Users Bring Their Own Tools to Work
Deloitte UK found almost a third of generative AI users run tools at work without their employer knowing, and nearly half had no safety training.
September 25, 2026
77% of Organisations Hit a Microsoft 365 Governance Incident This Year
ShareGate's survey of nearly 1,800 IT professionals found 77% of organisations had a Microsoft 365 governance incident in the past year.
September 25, 2026
DOJ Alleges Forensics Vendor Hid Russian Ownership From US Agencies
US prosecutors allege Oxygen Forensics masked Russian ownership to win millions in government contracts for its mobile forensics software.
September 25, 2026
SEC Enforcement Chief Says Fraud Cases, Not Case Counts, Are the Measure
The SEC's enforcement director says the division will aggressively pursue fraud and compliance failures, and will judge itself on quality, not case counts.
September 25, 2026
UK Civil Service Rethinks Cyber Governance After Audit Found No Plan
A UK Civil Service deputy CISO says mandates alone failed across 465 public bodies, so government is building central services that teams actually adopt.
September 24, 2026
Bill Would Fund a CISA Pilot Giving Critical Infrastructure Access to AI
A $100 million CISA pilot proposed in the House would give small water and power operators free access to frontier AI models for defence.
September 24, 2026
EU Auditors Say Information Sharing Is the Weak Link in Cyber Response
The EU Court of Auditors found unclear roles and slow NIS2 transposition are limiting how fast the bloc can detect and respond to major cyber incidents.
September 24, 2026
Ofcom Tests Whether Pornhub's Apple Based Age Checks Actually Work
Ofcom opened an investigation into Aylo over whether its Apple based age assurance was properly tested before it was offered to UK users.
September 24, 2026
SEC Charges Firm and Founder Over Scheme Targeting Law Enforcement Investors
The SEC charged CMI Capital and its founder with raising $860,000 from investors, many of them current or retired South Florida law enforcement officers.
September 24, 2026
ShinyHunters Claims FBI Jobs Portal Breach and Sets a One Week Deadline
A cybercrime group defaced the FBI's recruitment site, says it holds data on agents and job applicants, and wants a federal advisory withdrawn.
September 23, 2026
Abbott to Pay Almost $385 Million Over Infant Formula Plant Conditions
Abbott agreed to pay $384,999,040 to settle claims that it sold infant formula produced in unsanitary conditions at two of its plants.
September 23, 2026
California Orders a Roadmap for AI Kill Switches and Onsite Audits
Governor Newsom's executive order asks for options including kill switches for frontier models and independent verifiers placed inside AI labs.
September 23, 2026
China's AI Safety Framework 3.0 Turns to Agent Control
China's new AI Safety Governance Framework focuses on agentic systems, loss of control and countermeasures for AI-driven cyberattacks.
September 23, 2026
DOJ Rewrites the Rules on Guidance Documents and Whistleblower Suits
Justice Manual revisions limit what sub-regulatory guidance can require and push DOJ toward dismissing meritless qui tam cases.
September 23, 2026
SEC Censures OTC Link Over Years of Regulation SCI Failures
The SEC censured broker-dealer OTC Link and fined it $575,000 after examiners flagged the same missing trading system policies for years.
September 22, 2026
Ambry Genetics Pays $700,000 Over a 2020 Phishing Breach
HHS settled a HIPAA case with Ambry Genetics over a 2020 phishing breach affecting 225,370 people, citing a missing risk analysis and access control gaps.
September 22, 2026
CFTC Proposes Turning No-Action Relief Into Registration Rules
The CFTC proposed codifying CPO and CTA registration exemptions that firms have relied on through a no action letter, with comments open until October 5.
September 22, 2026
FCA Warns Firms After Odey's Lifetime Ban Is Upheld
The Upper Tribunal upheld Crispin Odey's lifetime ban and a reduced fine, and the FCA said it will not tolerate a slapdash approach to ethics.
September 22, 2026
Ireland Fines Google €403 Million Over Location Data Processing
Ireland's data protection regulator fined Google €403 million over how three features handled location data, and ordered fixes within six months.
September 21, 2026
CalPrivacy Warns Data Brokers That Honest Mistakes Still Cost $200 a Day
California's privacy agency says incorrect data broker registration filings draw the same $200-per-day penalty as not registering at all, intent is not the test.
September 21, 2026
CISA Retires Its Weekly Vulnerability Bulletin
CISA will stop publishing its weekly vulnerability roundup at the end of September, replacing cadence and severity scores with risk-based prioritization.
September 21, 2026
Countries Move Against North Korean IT Workers After UN Sanctions Report
A UN sanctions monitoring report prompted investigations in Argentina and Pakistan, and confirmed sanctions against enablers in Vietnam and Laos, over North Korean IT workers.
September 21, 2026
Reg S-P Deadlines Have Passed and Exams Are Next
Both Reg S-P compliance deadlines are behind us. The SEC's exam division will now test whether firms actually operate the incident response and vendor oversight programs they wrote.
September 21, 2026
An AI Agent Breached a Spanish Organisation and Edited Personal Data
Spain's data protection agency described a breach where a hacker used a language model to find credentials, enter a corporate system and modify personal data records.
September 20, 2026
California Sends a Privacy and AI Package to the Governor
Bills passed in California's final session weeks would curb website tracking lawsuits, expand CCPA deletion rights and tighten AI content disclosure.
September 20, 2026
State Bank Regulators Publish an AI Examination Framework
The Conference of State Bank Supervisors released a voluntary framework that tells examiners how to assess AI use at the banks they supervise.
September 20, 2026
Delaware Adds Early Attorney General Notice to Breach Reporting
Delaware HB 381 requires Attorney General notice within 60 days when affected residents cannot be identified, and narrows the GLBA and HIPAA safe harbor.
September 20, 2026
Gyazo Breach Exposes 23.6 Million User Records
Helpfeel says an attacker exploited a flaw in its image upload server and reached a database holding roughly 23.6 million Gyazo user records.
September 20, 2026
Texas Wins Partial Judgment Against TikTok Over Safety Claims
A Texas judge found TikTok liable for misrepresenting its content moderation and the availability of explicit material to minors using Restricted Mode.
September 19, 2026
FBI Logs $1.6 Billion in Impersonation Scams, and the Gap Is Verification
FBI data shows nearly 61,000 impersonation complaints and $1.6 billion in losses since January 2025, averaging over $26,000 per case.
September 19, 2026
Compliance Lessons From the July Fourth Flood: Plans Fail Where Authority Is Unclear
A compliance veteran's account of the July 4, 2025 Guadalupe River flood turns five hard lessons into a case for better risk planning.
September 19, 2026
Post-Quantum on Deadline: What EO 14412 Means for Risk and Compliance
EO 14412 sets 2030 and 2031 deadlines for federal post-quantum migration and turns cryptographic inventory into an audit question.
September 18, 2026
Coast Guard and FBI Board Foreign Ships Over Suspected Cyber Compromise
The Coast Guard and FBI boarded two US-bound tankers in the Gulf of Mexico after indications that the vessels' networks had been compromised.
September 18, 2026
Ofcom Has Fined £7 Million Under the Online Safety Act, But Most of It Is Unpaid
Ofcom has fined 11 service providers more than £7 million under the Online Safety Act, yet its enforcement chief says most penalties remain unpaid.
September 18, 2026
Prediction Markets Push Employee Trading Rules Into New Territory
Compliance teams are being urged to extend employee trading surveillance to prediction market contracts that sit outside existing broker feeds.
September 18, 2026
SEC Grants a Five-Year Innovation Exemption for Tokenized Stock Trading
The SEC gave tokenized securities venues conditional five-year relief from exchange registration to trade tokenized NMS stock via permissioned pools.
September 18, 2026
UK Publishes an AI Risk Management Toolkit for Delivery Teams
DSIT's new AI Risk Management Toolkit gives multidisciplinary teams a workbook, a monitoring dashboard and probing questions to assess AI risk.
September 17, 2026
CVS and Criteo Pay $20.5M Over Web Trackers on Pharmacy Pages
CVS Health and Criteo agreed to a $20.5 million settlement over claims that tracking code on CVS sites shared patient health information with an ad firm.
September 17, 2026
UK Ministry of Justice Apologizes for Unauthorized Access to Southport Files
UK court staff accessed the files of Southport victims without authorization, and the Information Commissioner's Office has been notified.
September 17, 2026
NIST and CISA Finalize Guidance on Protecting Identity Tokens
NIST and CISA published final guidance for agencies and cloud providers on stopping token theft, forgery and misuse in single sign-on and API access.
September 17, 2026
Data Broker Radaris Loses Its Domains to a Privacy Judgment
A New Jersey court transferred radaris.com and 13 other domains to a privacy plaintiff after the data broker failed to defend claims under Daniel's Law.
September 17, 2026
SEC Proposes Rescinding the Rule That Puts Shareholder Proposals on Ballots
The SEC proposed rescinding Rule 14a-8, which would move shareholder proposals to state law, and separately proposed modernizing proxy solicitation rules.
September 16, 2026
Compliance, Not Code, Will Decide Whether Sovereign Digital Currencies Scale
A review of sovereign digital currency pilots finds adoption fails on anti-money laundering, sanctions screening and supervisory capacity, not on blockchain.
September 15, 2026
Experts Back FCA's Principles-Based AI Approach, With Regular Reviews
Experts say the FCA's principles-based approach to AI can still work, provided the UK framework is reviewed regularly as the technology changes.
September 15, 2026
Southern Glazer's Pays $12.5M and Tightens Compliance in DOJ Deal
Southern Glazer's agreed to pay $12.5 million under a DOJ non-prosecution agreement over improper payments to retail buyers and false invoices.
September 15, 2026
UK Lawmakers Find No Regulator Can Stop a Risky AI Model
A UK parliamentary committee found no regulator can block or compel a frontier AI model, and called for a risk-tiered AI bill with a single watchdog.
September 12, 2026
EU Cyber Resilience Act Starts the 24 Hour Vulnerability Clock
Manufacturers selling digital products in the EU must now report actively exploited vulnerabilities within 24 hours under the Cyber Resilience Act.
September 12, 2026
OFSI Fines Citibank £4.7 Million Over Russia Sanctions Failures
The UK fined Citibank's London branch £4.7 million after 970 payments worth nearly £19.7 million breached Russian sanctions rules.
September 12, 2026
PCAOB Scales Back Audit Quality Control Standard QC 1000
The PCAOB adopted amendments to its QC 1000 quality control standard to cut compliance costs, keeping the December 15, 2026 effective date.
September 11, 2026
FBI Says AI Is Sharpening Attacks, and the Fix Is Still Cyber Basics
FBI officials said AI is accelerating adversary operations, while stressing security fundamentals and continuous, risk-based patching.
September 11, 2026
FTC Bans Payment Processor Humboldt for Serving Sham Merchants
Humboldt Merchant Services will pay $12 million and stop processing payments for high-risk merchants after the FTC said it enabled fraud.
September 11, 2026
OFAC Sanctions Xinbi Guarantee, a Marketplace Built for Scam Centers
The Treasury sanctioned Xinbi Guarantee, a Chinese-language marketplace that processed more than $24 billion in support of Southeast Asian scam centers.
September 11, 2026
SEC Charges New Jersey Founder in $16 Million Ponzi Scheme
The SEC charged Ernest Ossei Boateng and two companies he controls with raising about $16 million from more than 200 inexperienced investors.
September 10, 2026
Watchdog Finds Critical Access Control Gaps at CBP
A US watchdog found that every CBP network user could run privileged service accounts, exposing the border agency to serious attack risk.
September 10, 2026
FBI's New Cyber Strategy Promises More Adversary Disruptions
The FBI's new cyber strategy formalizes adversary takedowns and aims to rebuild company trust in reporting attacks to the bureau.
September 10, 2026
FTC Rescinds Health App Breach Notification Policy
The FTC withdrew its 2021 policy that treated health and fitness apps as covered vendors under federal breach notification rules.
September 10, 2026
Lawmakers Urge Treasury Sanctions on India Hack-for-Hire Groups
Lawmakers asked the Treasury to sanction three India-based hack-for-hire groups behind years of espionage against Americans.
September 10, 2026
Uber Fined Nearly €825m by Dutch Regulator Over Automated Driver Blocking
Dutch regulators fined Uber about EUR 825 million for using fully automated decisions to deactivate drivers over poor reviews.
September 9, 2026
Grindr Pays £26m to Settle UK Claims Over Sensitive Data Sharing
Grindr will pay £26m to settle a UK group action over allegations it shared HIV status and other sensitive data with third parties before 2020.
September 9, 2026
LG Accused of 'Egregious Invasion of Privacy' Over Smart TV Data
Researchers say LG smart TVs captured audio transcripts and mapped nearby devices even in standby, raising fresh questions about consent and disclosure.
September 9, 2026
UK Opens Consultation on Slimming Down Corporate Reporting
The UK government's corporate reporting reform consultation promises simpler rules and says the changes could save companies more than £450 million a year.
September 8, 2026
Class Action Lawsuits Stack Up Against IDScan.net After Reported License Data Breach
At least four class actions target IDScan.net after reports tied the company to a breach exposing more than 153 million driver's license records.
September 7, 2026
Moody's Survey: Banks Embed Compliance Early as AI Governance Becomes a Growth Driver
Moody's research finds most banks now embed compliance at the start of AI projects, with only 17 percent treating it as a final approval gate.
September 7, 2026
Welsh Regulator's FoI Blunder Exposed Staff Diversity Data for Years
Natural Resources Wales published staff diversity data in a 2021 FoI response and only found out five years later that it was still exposed.
September 5, 2026
MEPs Want Serbia's EU Path Slowed Until Spyware Abuse Is Investigated
European Parliament members want Serbia's EU accession slowed until it investigates Pegasus and NoviSpy infections of student activists.
September 5, 2026
DOJ Fraud Division Takes Formal Shape, Compliance Questions Remain
Compliance Week says the reach of DOJ's new National Fraud Enforcement Division is still unclear, eight months after its announcement.
September 5, 2026
US Regulators Clarify SAR Confidentiality for Customer Conversations
Banking agencies said banks may discuss suspicious transactions with customers without breaking SAR confidentiality, as long as no filing is revealed.
September 4, 2026
FCC Proposes Public Scorecard Rating Telecoms on Robocall Defenses
The FCC proposed a consumer scorecard rating telecoms on robocall prevention and removed 14 providers from U.S. networks.
September 4, 2026
Russian Hacker Extradited Over Malware Campaign That Hit 80,000 Freelancers
The DOJ charged a Russian national with using fake freelance accounts to spread Excel malware to about 80,000 platform users.
September 4, 2026
SEC Proposes Scrapping Pay-to-Play Rule for Investment Advisers
The SEC proposed rescinding the rule that bars investment advisers from government work for two years after political donations.
September 3, 2026
AI Agents Executed Every Step of a Ransomware Attack, Unit 42 Says
Unit 42 says ransomware attackers used AI agents to breach an enterprise network in under 10 hours and left an 80-page security audit.
September 3, 2026
Ireland Fines Its Health Service Over Records Rotting in Disused Hospitals
Ireland's Data Protection Commission fined the HSE €645,000 after paper psychiatric records were found decaying in disused hospital buildings.
September 3, 2026
U.K.'s Data (Use and Access) Act Takes Full Effect
The U.K.'s Data (Use and Access) Act is now fully in force, reshaping consent, subject access requests, and automated decision-making.
September 2, 2026
FBI Warns of OAuth Consent Phishing Targeting Prominent People
The FBI warned that attackers are tricking executives and officials into granting malicious app access that bypasses passwords and multifactor authentication.
September 2, 2026
FBI Probes Dark Web Service Selling 153 Million Drivers Licenses
The FBI is investigating a dark web service selling more than 153 million drivers license scans, reportedly tied to an identity verification vendor.
September 2, 2026
NIS2: Fixing Identity and Access Controls Before the 2026 Audit
As EU member states shift to NIS2 enforcement, access management and credential hygiene offer the fastest auditable compliance wins.
September 2, 2026
SEC Charges Private Fund Executives in $80 Million Ponzi-Like Scheme
The SEC charged two former Pacific Private Money Group executives with an offering fraud that raised over $80 million from about 190 retail investors.
September 2, 2026
SEC Proposes First Major Update to Transfer Agent Rules in Decades
The SEC proposed modernizing rules for registered transfer agents, the first substantive update since the late 1970s and early 1980s.
September 1, 2026
Governing AI Coding Agents: Visibility, Identity and Audit Trails
Anthropic's new Compliance API for Claude Code shows why governing AI agents needs local visibility, identity mapping and audit trails.
September 1, 2026
DoJ Corrects Itself: Agencies Were Targets of Chinese Hackers, Not Victims
The DoJ revised its statement on Chinese state-sponsored hacking, saying US agencies were targeted rather than victims of intrusion.
September 1, 2026
FCA Warns UK Firms' Financial Crime Controls Still Fall Short
The FCA says UK financial services firms still show serious gaps in KYC and financial crime controls despite claiming they have strengthened checks.
August 30, 2026
SEC Proposes Adding EU Debt to Exempted Securities List
The SEC proposed covering European Union debt under Exchange Act Rule 3a12-8, giving the CFTC exclusive oversight of EU debt futures.
August 30, 2026
US Sanctions Mabna Institute Hackers, Names Their Crypto Wallets
Treasury sanctioned five Mabna Institute hackers and tied 30 crypto wallets to their campaigns, a concrete checklist for sanctions screening.
August 29, 2026
Australia's Scam Rules Penalize Banks but Leave Gaps in the Chain
Australia's Scams Prevention Framework fines banks heavily but leaves dating apps and crypto exchanges outside its scope.
August 29, 2026
Cyber Insurance Claims Cost More Even as Claim Volume Falls
Chubb's 2026 report shows average cyber insurance claim costs surging for large firms even as the number of claims dropped.
August 29, 2026
ICO Fines Call-Blocker Seller £190k for Making Nuisance Calls
The UK's ICO fined Elderly Aids £190,000 for making 758,000 unsolicited marketing calls to TPS-registered numbers.
August 29, 2026
Meta's $18 Billion Child Safety Settlement Reshapes Teen Platform Design
Meta agreed to pay up to $18 billion and overhaul teen safety features to settle child safety claims with nearly every US state.
August 29, 2026
Two Charged in Australia Over TeamPCP Supply Chain Attacks
Australian police charged two men linked to TeamPCP, the group behind the March 2026 compromise of Trivy, KICS and LiteLLM.
August 28, 2026
Boston Scientific Says Cyberattack Disrupted Order Processing and Shipping
Medical device maker Boston Scientific disclosed a cyberattack that hit its IT network and disrupted global operations, including customer order processing and shipping.
August 28, 2026
FBI Disrupts China-Linked QTFY Hacking Platforms Used Against U.S. Networks
The FBI and DOJ disrupted two hacking platforms used by Chinese state-sponsored group QTFY to target U.S. critical infrastructure and government agencies.
August 28, 2026
NIST Report Maps 23 Security Risks Unique to Multi-Cloud Environments
NIST identified 23 security and compliance challenges unique to multi-cloud environments in a new report.
August 28, 2026
OpenAI Bans Russian ChatGPT Accounts Behind Influence Operation
OpenAI shut down Russian ChatGPT accounts that ran a covert influence campaign promoting a fake think tank and a 'sovereignty' index favoring Russia.
August 28, 2026
Zillow and Redfin Settle FTC Antitrust Case Over Rental Listings Deal
The FTC and five states settled antitrust claims against Zillow and Redfin over a deal that paid Redfin to exit the rental advertising market.
August 20, 2026
ETSI Proposes 17 Cybersecurity Standards to Support Cyber Resilience Act
ETSI has published 17 draft cybersecurity standards to underpin the EU Cyber Resilience Act. What this means for product manufacturers compliance timelines and the harmonized standards route to presumption of conformity.
August 20, 2026
ICO Urges Police to Improve Data Governance in Facial Recognition Rollouts
The UK ICO has called on police forces to strengthen data governance around live facial recognition deployments. What this means for biometric data compliance and public sector accountability.
August 20, 2026
UK Legal Regulator Raises AI Misuse Concerns
The Solicitors Regulation Authority has warned law firms about AI misuse risks. What this signals for professional services governance and the compliance obligations around generative AI in regulated sectors.
August 19, 2026
California AI Labeling Law Takes Effect
California's AI transparency law is now enforceable, but detection tools to verify compliance are missing. What this gap means for GRC teams building AI governance programs.
August 19, 2026
DOJ Expands Charges Against Iranian Hackers at Mabna Institute
US authorities unsealed charges against 17 Iranians tied to Mabna Institute, expanding the 2018 case over a university cybertheft campaign.
August 19, 2026
ETSI Proposes 17 Cybersecurity Standards for Cyber Resilience Act
ETSI has published 17 draft standards to operationalize the EU Cyber Resilience Act. Manufacturers of connected products now have a concrete path to compliance, but the technical lift is significant.
August 19, 2026
SEC Charges Former Tricolor Executives Over $1.9 Billion Collapse
The SEC charged three former Tricolor executives with fraud over double pledged subprime auto loans tied to the lender's bankruptcy.
August 19, 2026
SEC Proposes New Regulation for Crypto Assets
The SEC unveiled a proposed regulatory framework for crypto assets that could bring tokens, platforms, and intermediaries under federal securities law. What GRC teams at crypto-adjacent firms need to prepare for.
August 19, 2026
SEC Proposes Regulation Crypto Assets With Tailored Exemptions
The SEC proposed Regulation Crypto Assets, a tailored securities regime with two offering exemptions and a safe harbor for crypto issuers.
August 19, 2026
UK Legal Regulator Warns Solicitors on AI Misuse
The SRA warned UK law firms that AI hallucinations in court filings and client data entered into public AI tools can breach their regulatory duties.
August 18, 2026
FCC Weighs Chinese Transceiver Crackdown
The FCC may add Chinese-made optical transceivers to its Covered List, barring new models from US data centers. A third-party risk story for every AI operator.
August 18, 2026
Record-Setting AML Penalty Against UBS Was Years in the Making
FinCEN levied a historic AML penalty against UBS stemming from long-running compliance failures. The case shows how sustained regulatory pressure builds toward enforcement that reshapes an institution.
August 18, 2026
Snowflake GitHub Actions Flaw Shows Pipeline Risk
Wiz found a GitHub Actions workflow injection in Snowflake's public repo that exposed internal Jira credentials. What it teaches GRC teams about CI/CD risk.
August 18, 2026
US Sanctions Iranian $6bn Crypto Exchange Shelbit
OFAC designated Shelbit, an Iranian crypto exchange processing $6 billion in volume, for facilitating sanctions evasion. The action signals expanding enforcement into digital asset intermediaries.
August 17, 2026
NIST Seeks Public Input on AI-Ready NVD Modernization
NIST is asking for public comment on modernizing the National Vulnerability Database to support AI-driven vulnerability management. What this means for compliance programs that rely on CVE data.
August 16, 2026
17 Draft Cyber Resilience Act Standards Open for Comment
ETSI published 17 draft standards supporting the EU Cyber Resilience Act, now open for public comment. What the CRA standards pipeline means for anyone building or buying connected products.
August 16, 2026
ICO Reprimands Criminal Records Office After 2023 Breach
The UK ICO issued a reprimand over a 2023 breach at the ACRO Criminal Records Office. What this says about data protection oversight of public bodies, and what GRC teams should take from it.
August 16, 2026
Pentagon Suspends CMMC Phase II for Defense Contractors
The US Department of Defense suspended Phase II of the Cybersecurity Maturity Model Certification. What the pause means for contractors, assessors, and anyone running a compliance roadmap.
August 16, 2026
NVIDIA Group Proposes SAFE Initiative for Agentic Threat Intel Sharing
Over 120 tech organizations back the Shared AI Findings Exchange, a framework for confidentially sharing AI security incidents and translating them into defensive guidance.
Every article links to its original reporting for attribution. Original analysis by Zabez; not affiliated with the sources. Illustrations original to ZABEZ.com.