CYBERSECURITY

CISA + FBI Issue Joint Advisory on Threat Actors Chaining Ivanti Vulnerabilities

On January 22, 2025, the Federal Bureau of Investigation (FBI) and the Cybersecurity & Infrastructure Security Agency (CISA) issued a joint advisory related to previous vulnerabilities in the Ivanti Cloud Service Appliance, including an administrative bypass, a SQL injection, and remote code execution vulnerabilities. Read More

DATA SECURITY

Ethical Hacker Uncovers Vulnerability in Subaru Starlink Service

Ethical hackers identified an arbitrary account takeover flaw in the administrator portal for Subaru’s Starlink service, which could allow a threat actor to hijack a vehicle through a Subaru employee account. This vulnerability could allow a threat actor to remotely track, unlock, and start connected vehicles. The ethical hacker reported to Subaru that they could bypass multi-factor authentication (MFA) by removing the client-side overlay from the user interface. Through various endpoints, the ethical hacker could use a vehicle search to query a consumer’s last name, zip code, telephone number, email address, or VIN number and gain access to the vehicle. Read More

ENFORCEMENT + LITIGATION

MGM Inks $45M Class Action Settlement for 2019 and 2023 Data Breaches

MGM Resorts agreed to pay $45 million to settle over a dozen class action lawsuits concerning 2019 and 2023 data breaches. A federal court in Nevada preliminarily approved the settlement, which, according to lawyers, covers over 37 million MGM customers. Read More

DATA PRIVACY

Oregon DOJ Issues Children’s Privacy Toolkit under State Consumer Privacy Rights Law

The Oregon Department of Justice (DOJ) released a new toolkit sharing with Oregonians how to protect their online information to celebrate Data Privacy Day. The toolkit includes information on how consumers can exercise their rights under the Oregon Consumer Privacy Act (OCPA) and encourages them to take control of their personal information. Read More

ARTIFICIAL INTELLIGENCE

Illinois Supreme Court Announces Policy on Artificial Intelligence

Last year, the Illinois Judicial Conference Task Force on Artificial Intelligence (IJC) was created to develop recommendations for how the Illinois Judicial Branch should regulate and use artificial intelligence (AI) in the court system. The IJC made recommendations to the Illinois Supreme Court, which adopted a policy on AI effective January 1, 2025. Read More

PRIVACY TIP #429

Threat Actors Continue to Use QR Codes For Fraudulent Purposes

We have repeatedly warned our readers about malicious QR codes and their use by threat actors.

Threat actors are now using these codes to disguise packages as gifts. Could you be fooled by this scam if you saw it? Find out more in this week's Privacy Tip. Read More

RECENT EVENTS AND NEWS

Linn Freedman Presents Rhode Island College Panel on Cyberlaw and Information Sharing After Cyber-Attacks

Data Privacy + Cybersecurity practice chair Linn Freedman joined a panel presenting “Can We Talk About It? Information Sharing & Cyberattacks,” hosted by the Institute for Cybersecurity & Emerging Technologies at Rhode Island College on January 28, 2025. The program featured an introduction by Congressman Jim Langevin and panel discussions concerning the complexities surrounding cyberlaw and the critical challenges organizations face when sharing information after a cyber-attack.

David Carney and Kathryn Rattigan Co-Author ACC Docket Article Discussing the Promise and Peril of AI

Internal Investigations + Corporate Compliance Team partner David Carney and Artificial Intelligence Team partner Kathryn Rattigan recently co-authored an article titled “The Promise and the Peril: AI and Disruptive Technologies in Operations and Compliance” published in ACC Docket, the official member publication of the Association of Corporate Counsel. The article covers the Department of Justice’s (DOJ) September 2024 revisions to the Evaluation of Corporate Compliance Programs (ECCP) that incorporate artificial intelligence (AI) management and the benefits and concerns of this technology.

“The 2024 ECCP update is a lighthouse for companies navigating the uncertain waters of the rapidly evolving world of AI and disruptive technologies,” they wrote. “It warns of the perils—the rocks of malign use—and the DOJ’s focus on those perils. [I]t guides to relative safety—a harbor calmed by the breakwater of risk awareness and mitigation.” David and Kathryn emphasize that “[c]ompanies with exposure to AI and disruptive technologies” should understand the ECCP update and the implications arising from it. Read the article here.