CYBERSECURITY

ShinyHunters Target Medical Device Company Medtronic

Global medical device company Medtronic recently confirmed that it had been attacked by the threat actor group. ShinyHunters According to Bleeping Computer, Medtronic is “the largest medical device maker in the world by revenue ($33.5 billion) and also develops healthcare technologies and therapies.”

ShinyHunters alleges that it has stolen over nine million Medtronic records containing personal information, and “terabytes of internal corporate data”. Read more

CISA Warning: Firestarter Malware Persists in Cisco Devices

The Cybersecurity and Infrastructure Security Agency (CISA) and the UK National Cyber Security Centre (NCSC) have confirmed that threat actors are using FIRESTARTER malware to maintain persistence on Cisco network devices, allowing the threat actors to maintain access even after patching and reboots. 

FIRESTARTER malware targets Cisco Firepower and Secure Firewall devices running Adaptive Security Appliance (ASA) or Firepower Threat Defense (FTD) software, which were previously compromised prior to September 2025. Read more

ENFORCEMENT + LITIGATION

No Standing in the Parking Lot: Court Dismisses DPPA Suit

The Driver’s Privacy Protection Act (DPPA) may not draw as much regular attention as statutes like the VPPA, CCPA, or TCPA, but it remains a source of privacy litigation risk where motor vehicle record information is involved. The DPPA is a federal law that limits how personal information from state motor vehicle records may be obtained, disclosed, or used, and it allows individuals to sue over alleged misuse of that information.

In Cicale v. Professional Parking Management Corporation, No. 24-61146-CIV-SINGHAL (S.D. Fla. May 1, 2026), the plaintiff alleged in 2024 that a parking management company used license plate reader technology in private lots, matched plate numbers to Department of Motor Vehicles (DMV) records and then mailed parking charge notices to vehicle owners without first obtaining written consent. Read more

DATA PRIVACY

From Future Requirement to Present Risk: California Privacy Audit Readiness

California companies may have less time than they think to prepare for privacy audits. The California Privacy Protection Agency’s (CPPA) new Audits Division, created in February 2026, is expected to begin assessing companies’ compliance with the California Consumer Privacy Act (CCPA) this year, according to Executive Director Tom Kemp. This is a notable remark because—while the formal deadline to submit cybersecurity audit certifications does not begin until 2028 for some businesses—the CPPA expects companies to already be building and maintaining real audit-ready compliance programs. Read more

Privacy Trends Fashion, Beauty, and Wearable Tech Brands Need to Watch

Fashion, beauty, and wearable technology brands are heading into 2026 with a lot more to think about concerning data privacy. What used to feel like a back-end legal issue is now shaping how companies design products, personalize experiences, and build trust with customers. With new state privacy laws taking effect in Indiana, Kentucky, and Rhode Island, updates to California’s rules, and more changes expected across the country, brands can no longer afford to treat privacy as a simple compliance exercise. For companies, being open and thoughtful about data practices can actually become a real point of differentiation. Read more

Privacy Tip #490

Dating App Hijacks + Repurposes College Student’s TikTok Video

In the category of how technology can be fun, yet dangerous, a 19 year old college student alleges that the dating app Meete took a video she innocently posted on TikTok of her high school graduation, then “overlayed it with graphics advertising the app, and added a voiceover to make it appear she was saying ‘Are you looking for a friend with benefits? This app shows you women around you who are looking for some fun. You can video chat with them.’”

Unfortunately, the student had no idea this was happening until another student who had met her showed her the video. The other student took screen shots of the content and provided it to her. She hired a lawyer who hired an investigator to obtain additional information.

Learn how seemingly harmless online posts can be misappropriated by deceitful individuals or malicious apps. Read more

RECENT EVENTS + NEWS

Linn Freedman to Discuss the Legalities and Challenges of AI in Top of Mind Webinar

Artificial Intelligence team chair Linn Freedman will co-present a webinar titled “A CISOs guide to the legalities of AI” hosted by Top of MIND, on May 14, 2026. The webinar will discuss the implications of AI in cybersecurity, the pressures security leaders face when implementing AI tools, legal regulations associated with AI including the evolving regulatory landscape, and the importance of governance and trust in AI implementation strategies.