CYBERSECURITY

Expel Annual Threat Report Shows Identity Compromise Continues to Be Threat Actors’ Favorite Tool

Cybersecurity firm Expel recently published its 2026 Threat Report, which analyzed over 1,000,000 alerts in its Security Operations Center throughout 2025. The results showed that threat actors continue to use compromised credentials to gain access to company systems. The Report highlights the need for companies to educate their employees on an ongoing basis of how important it is to protect their usernames and passwords and to be highly vigilant when being asked to divulge them.

ENFORCEMENT + LITIGATION

No Good Deed Goes Unpunished: Victim Stryker Sued for Iranian-Backed Cyber Attack

As we reported last week, Stryker was attacked by Iranian-backed hackers in retaliation for Israeli and U.S. strikes against Iran. It was a significant cyberattack, known as a wiper attack. A wiper attack is designed not to extort money from a victim, but instead to send a message and destroy the victim’s data to cripple their operations. Stryker was a victim of a political attack that had a significant negative effect on its business operations. It was merely conducting business and got caught in the crosshairs of an international war.

DATA PRIVACY

Ford Settlement Highlights Simple Practice: Opt-Outs Must be Easy

The California Privacy Protection Agency (CPPA) issued a decision requiring Ford Motor Company to pay a fine of $375,703 and update its privacy practices following a settlement for its alleged violations of the California Consumer Privacy Act (CCPA). Under the CCPA, California residents have the right to direct a business to stop selling or sharing their personal information by opting out. According to the CPPA’s decision, Ford’s opt-out process for personal information collected through its digital properties and connected vehicle services required an identity verification step. Specifically, consumers had to verify their email address as part of the opt-out workflow. The CPPA concluded this added “unnecessary friction” for consumers trying to exercise their rights.

Skullcandy Can’t Transfer its CIPA Case out of California 

A federal court in the Southern District of California declined to dismiss wiretapping and eavesdropping claims tied to Skullcandy Inc.’s alleged use of online trackers on its retail website, allowing the lawsuit to move forward. Plaintiff alleges that Skullcandy used tracking tools from Meta Platforms and Google to collect browser and purchase data.

ARTIFICIAL INTELLIGENCE

Whose Voice Is It Anyway: The Likeness Line in AI Product Design

A recent class action complaint filed in the Southern District of New York, Angwin v. Superhuman Platform, Inc., No. 26 Civ. 02005, 2026 WL 704131 (S.D.N.Y. 3/11/26), highlights an evolving issue in artificial intelligence (AI) product design: what happens when an AI feature uses a real person’s name or identity as part of the user experience and that identity becomes part of what is being sold?

In the Angwin complaint, the plaintiff (a journalist and editor) alleges that Superhuman (the parent company of the writing assistant tool Grammarly) misappropriated the names and identities of hundreds of journalists, authors, writers, and editors to earn profits. The complaint focuses on Grammarly’s now-disabled “Expert Review” feature, which let subscribers pay for comments attributed to famous writers without their consent, including Angwin herself, Stephen King, and Carl Sagan.

Privacy Tip #484

What is Loyalty Fraud + How Do You Prevent It?

While a good friend of mine was recently traveling, his flight was cancelled and he was booked on a new flight the next day. He travels a lot and he decided to use some of his hotel loyalty points to stay over at the hotel adjacent to the airport. Checking in, he discovered that more than a million miles had been stolen from his account. It was obviously very distressing, so he asked me to write about it to warn others of this fraud and how it can be prevented.

Learn ways to protect your loyalty points and other secure accounts in this week’s Privacy Tip.

Recent Events and News

Linn Freedman to Present “Regulatory Roadmap” for AI at RWU Labor & Employment Conference

Data Privacy, Cybersecurity + AI practice chair Linn Freedman will present a session titled “The Regulatory Roadmap for AI in Employment” at Roger Williams University (RWU) School of Law’s 38th Annual Labor & Employment Conference, on March 27, 2026. Linn’s session will discuss the risks and benefits of using AI in the workplace, and the rapidly evolving regulatory landscape of how lawmakers are approaching legislation to address the risks. Linn is a former member of the RWU School of Law’s Board of Directors and Pro Bono Advisory Committee, and is an Adjunct Professor.

Roma Patel Authors Article on Secondary Liability and AI

Data Privacy + Cybersecurity and AI practice team lawyer Roma Patel authored the article “Copy That: Secondary Liability in the Age of AI” featured in Wolters Kluwer’s March 2026 edition of The Licensing Journal. A re-publishing of her Data Privacy + Cybersecurity Insider blog post, the article explains that AI-related intellectual property risk is not limited to end users, but can extend to the companies that develop, market, or deploy AI tools if those tools appear to encourage infringement and how companies can best protect themselves from litigation.

“To maintain the most defensible posture, companies should maintain documented, repeatable governance across the AI lifecycle,” Roma writes. Governance includes “training data traceability, policies for customer fine-tuning on third part content, monitoring for output patterns that suggest replication, and a clear process for handling repeat users who push high-risk requests.”

Read the article, here.

Kathryn Rattigan Quoted in Cybersecurity Law Report on Disney CCPA Opt-Out Settlement

Data Privacy + Cybersecurity team partner Kathryn Rattigan was quoted in an article titled “Disney Settlement Offers a Playbook for CA AG’s Opt-Out Expectations,” published in Cybersecurity Law Report on March 11, 2026. The article highlights the settlement between the California Attorney General and the Walt Disney Company resolving allegations that Disney violated the California Consumer Protection Act by failing to honor consumer requests to opt out of the sale or sharing of their data across all devices and services linked to their Disney accounts and the shift by regulators in placing more accountability on businesses to protect consumer data.

“A key provision of the settlement is the vendor oversight expectation,” said Kathryn, highlighting that main business remains responsible even if a third-party handles the processing of data. “You can outsource processing, but you cannot outsource accountability.”

Kathryn also comments on how regulators are shifting from high-level policy enforcement to deep technical and back-end scrutiny of consumer privacy rights, stating, “The bottom line: businesses should assume enforcement is now going to focus on whether privacy rights are actually executable in-product, end-to-end, across identities, devices and downstream partners.”

To read the article, click here