CYBERSECURITY

ShinyHunters Bypassing Multifactor Authentication

Security professionals rely on the implementation of multifactor authentication (MFA) to defend against phishing attacks and intrusions. Unfortunately, we can’t completely rely on MFA to protect us as threat actors (more specifically, ShinyHunters) are now targeting companies in technology, financial services, real estate, energy, healthcare, logistics, and retail with synchronized vishing-phishing attacks.

The newest attacks involve the threat actors pretending to be IT staff who called employees to tell them that the company was updating MFA settings. Read more

DATA PRIVACY

New Investigative Sweep Under the CCPA: Individualized Pricing as a Privacy Problem 

States are weighing in on whether grocery stores, hotel chains, and retailers should be using personal consumer information such as “browsing history” and “location data” to decide what price you see, when someone else might see something different. Pioneering this inquiry is California, approaching this individualized pricing as a potential privacy problem. At the end of last month, California Attorney General Rob Bonta announced an “investigative sweep” into businesses’ use of personal data to set individualized prices, warning that “surveillance pricing” may violate the California Consumer Privacy Act (CCPA). The inquiry is aimed at companies in the retail, grocery, and hotel sectors, focusing on how they use data like “shopping and internet browsing history, location, demographics, and other data” to price goods and services. Read more

New Trend under Florida’s Wiretap Statute: Websites with Tracking Technology Beware

Florida website tracking litigation is gaining momentum this year, with plaintiffs increasingly invoking the Florida Security of Communications Act (FSCA) to challenge common website analytics and advertising tools, especially where those tools allegedly capture and share sensitive user communications. The FSCA is an old state wiretap statute now aimed at modern website tracking. The FSCA provides for liquidated damages of up to $1,000 per violation. Read more

ARTIFICAL INTELLIGENCE

Judge Issues Public Admonition + $12,000 Sanctions for Hallucinations

In a strongly worded order, Judge Julie A. Robinson of the U.S. District Court for the District of Kansas publicly admonished and sanctioned four lawyers representing a plaintiff company in a patent infringement case for using ChatGPT to find caselaw to support a response to a motion to exclude an expert witness, and a response to the defendant’s motion for summary judgment.

In the 36-page order, the court made it clear that not only the lawyer who used AI to generate the hallucinated citations, but also his partners and local counsel bore responsibility for the filing of the motion. This is a clear reminder of the non-delegable duty of lawyers under Rule 11 of the Federal Rules of Civil Procedure. Read more

FTC Signals Pause on AI Regulation

On January 27, 2026, the Federal Trade Commission (FTC) signaled the agency’s reduced appetite for regulating artificial intelligence. At the Privacy State of the Union Conference in Washington, DC, FTC Bureau of Consumer Protection Director Chris Mufarrige stated there is “no appetite for anything AI-related” in the FTC’s rulemaking pipeline, while adding that the agency has other rule ideas in development. Mufarrige’s statement follows the FTC’s December 2025 decision to reopen and set aside a 2024 consent order involving AI writing assistant Rytr that had barred the company from providing AI-enabled services that was alleged to help users write false or misleading product reviews. Read more

Privacy Tip #478

Intrigued With Using AI to Help with Your Tax Return? Please Think Again.

It’s that time of the year when W2s and 1099s pile up in preparation for that dreaded tax return filing deadline. Now that everyone is using AI tools to assist with complicated tasks, as they seem to make any task, even the most dreaded, more efficient, it is tempting to use one to assist with your tax return. Sounds good, but experts are warning against it.

In particular, “experts have raised concerns about potential inaccuracies and privacy issues associated with using AI for tax returns.” Tax returns are complicated, and AI tools have not developed sufficiently to be able to navigate those complexities. Because tax returns are complex, users may not be able to determine that its output is inaccurate. The inaccuracy could have a significant impact on the tax filer potentially leading to fines and penalties. Experts warn that you cannot rely on the tool’s calculation of what is owed or refunded.

Learn why AI tools may not be your best tax return resources in this week's privacy tip. Read more

RECENT EVENTS AND NEWS

Linn Freedman Quoted in Cybersecurity Law Report on FTC Settlement

Data Privacy + Cybersecurity team chair Linn Freedman was quoted in an article titled “Illusory Systems Settlement Shows FTC Active and Focused on Crypto,” published in Cybersecurity Law Report on February 4, 2026. The article highlights the Trump administration’s Federal Trade Commission’s (FTC) active enforcement in the data security area—especially when it is concerning cryptocurrency—with its proposed consent order to Illusory Systems for its alleged failure to implement adequate security measures, which allowed hackers to breach its systems and steal $186 million from consumers.

“Companies should be transparent with consumers about how they use security measures that are reasonable for their size, scope, and complexity,” said Linn. “They should also ensure that there is good communication and collaboration between the technical/security people and the sales/marketing staff, to discourage the latter from ‘puffing what the data security measures are.’”

Linn also comments on Illusory Systems’ alleged misrepresentations of security and the FTC’s comments on their lax approach to data security, stating that the FTC alleged that “[T]he company knew of the issues with its security, but it did not resolve those issues and ‘just ignored’ them.” In response, the FTC ordered it to implement a comprehensive information security program, return $37.5 million in assets recovered after the breach to consumers, and fall under a 10-year monitoring term to ensure its data practices meet compliance standards.

To read the article, click here.