Data Privacy + Cybersecurity Insider
CYBERSECURITY
Joint Cybersecurity Advisory Released on Ghost (Cring) Ransomware
The Cybersecurity & Infrastructure Security Agency, the Federal Bureau of Investigation, and the Multi-State Information Sharing and Analysis Center released an advisory on February 19, 2025, providing information on Ghost ransomware activity.
According to the advisory, “Ghost actors conduct these widespread attacks targeting and compromising organizations with outdated versions of software and firmware on their internet facing services.” Read More
ENFORCEMENT + LITIGATION
NewsBank Hit with Class Action over Employee Data Breach
Last week, a class action was filed against NewsBank, Inc., a Florida-based news database company, related to a 2024 breach of employee personal information.
NewsBank provides a database of archived news publications utilized by libraries, higher education institutions, and other organizations. NewsBank suffered a security incident affecting its employees’ personal information between June and July 2024. Read More
DATA PRIVACY
Is Your Business Trapped? The Rise of “Trap and Trace” Litigation
Almost every business has a website; every website should have a privacy policy, terms of use, and, in some cases, a consumer privacy rights notice—if certain state consumer privacy rights laws apply to your business, such as the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively CCPA). What about a cookie policy? Or a cookie consent banner? Or a cookie preferences pop-up? If you haven’t looked at what types of ad tech your website uses—i.e., cookies, pixel tags, device IDs, and browser fingerprinting technologies that collect data about user behavior across multiple devices and platforms, which are essential for targeted advertising online—now is the time. Read More
ARTIFICIAL INTELLIGENCE
Texas AG Investigates DeepSeek + List of Banned Countries Expands
Texas Attorney General Ken Paxton announced on February 14, 2024, that his office has opened an investigation into DeepSeek’s privacy practices. DeepSeek, an artificial intelligence company with ties to the People’s Republic of China, has been banned on state owned devices in Texas, New York, and Virginia. The Pentagon, NASA, and the U.S. Navy have also prohibited employees from using DeepSeek. Read More
PRIVACY TIP #432
DOGE Sued for Unauthorized Access to Our Personal Information
The Department of Government Efficiency’s (DOGE) staggering unfettered access to all Americans’ personal information is highly concerning. DOGE employees’ access includes databases at the Office of Personnel Management, the Department of Education, the Department of Health and Human Services, and the U.S. Treasury. Meanwhile, New York and other states have filed suit against DOGE, alleging that the unfettered access to the federal databases is a privacy violation. Find out more in this week's Privacy Tip.
“We will be closely watching the progress of these suits and urge you to stay informed as we offer insight on their impact to the protection of our personal information.” Read More
RECENT EVENTS AND NEWS
Jim Merrifield Co-Authors AI Impact on Information Governance Whitepaper for Iron Mountain
Director of Information Governance + Business Intake Jim Merrifield recently co-authored “AI Considerations for IG Processes,” a whitepaper published by Iron Mountain on February 6, 2025. The report examines the impact of generative artificial intelligence (GenAI) on information governance (IG) within law firms, stressing the importance of data security, ethical practices, and compliance with legal and client requirements. Jim emphasizes the need for human oversight, ongoing legal education, and adaptability among IG professionals and lawyers in response to a rapidly evolving technological landscape.
“A thoughtful approach to GenAI requires transparency with clients, collaboration among key stakeholders, and the development of clear policies to mitigate risks while supporting innovation,” Jim writes. “By staying informed about legal and regulatory changes and continuously adapting governance practices, firms can effectively manage the complexities associated with this technology.” Read the full article.
Kate Dion and Kathryn Rattigan Co-Author Article on Artificial Intelligence Compliance and Governance in Higher Education
Education Industry Team Chair Kate Dion and Data Privacy and Cybersecurity and Artificial Intelligence Teams member Kathryn Rattigan co-authored the article, “AI is transforming higher ed: What you need for compliance and governance,” published in University Business on February 11, 2025. As generative artificial intelligence (AI) is increasingly being integrated into higher education…it raises concerns about its ethical and effective use, including data privacy and security issues around the data input into these AI systems, and the potential for algorithm bias. Co-authors Kate Dion and Kathryn Rattigan suggest that as colleges and universities tackle this new era of generative AI, they may wish to consider implementing an AI governance program.
The authors identify several key aspects that an AI governance program should encompass including data governance and privacy, risk management and continuous monitoring and improvement. “By integrating these components, a university can develop a robust AI governance program that aligns with ethical standards, ensures data protection, and fosters a safe and inclusive educational environment.” Read the full article.



