Data Privacy + Cybersecurity Insider
CYBERSECURITY
ShinyHunters Hit Instructure + Downs Canvas Learning Management System
Another recent victim of ShinyHunters is Instructure, the supplier of the Canvas learning management system, which disrupted the login portals of 330 colleges and universities during the critical college exam schedule.
According to Dataminr, ShinyHunters “claimed to have stolen 3.654TB of data affecting about 275 million individuals and 9,000 institutions worldwide.” The stolen data included names, email addresses, student ID numbers and messages, but not passwords, government IDs, birth dates, or financial data. Read more
ENFORCEMENT + LITIGATION
FTC’s TAKE IT DOWN Act Stakeholder Letter Signals Heightened Compliance Priority
The spread of AI generated intimate imagery has turned what was already a serious online safety issue into a fast- moving platform governance problem. The Federal Trade Commission’s (FTC) latest stakeholder letter makes clear that covered platforms will be expected to have systems in place before enforcement begins. This week, the FTC sent a stakeholder letter to covered platforms signaling that the agency expects them to be ready by May 19, 2026, when Section 3 of the TAKE IT DOWN Act (TIDA) becomes enforceable. The letter emphasizes that platforms receiving a valid removal request must remove the reported intimate image or video, along with known identical copies, within 48 hours. Read more
DATA PRIVACY
California’s GM Settlement Reveals a New Era for Connected Car Privacy
California regulators have announced a major privacy settlement with General Motors (GM) over allegations that the company unlawfully sold the location and driving data of hundreds of thousands of Californians to two data brokers: Verisk Analytics and LexisNexis Risk Solutions. The settlement, subject to court approval, requires GM to pay $12.75 million in civil penalties and imposes significant restrictions on how the company may use, retain, and share consumer driving data. According to the complaint, GM collected the data through OnStar and allegedly failed to provide adequate notice to consumers, despite statements suggesting that driving and location data would not be sold or would only be disclosed for insurance purposes at the consumer’s direction. Read more
ARTIFICIAL INTELLIGENCE
When an AI Chatbot Calls Itself a Doctor
Pennsylvania’s lawsuit against Character Technologies, Inc., is a notable early test of how professional licensing laws may apply to consumer-facing AI chatbots. The Commonwealth, acting through the Department of State and State Board of Medicine, filed a Petition for Review in the Commonwealth Court of Pennsylvania seeking to restrain what it alleges is the unlawful practice of medicine under the state’s Medical Practice Act. The case centers on Character.AI, a website and mobile application that allows users to interact with customizable AI characters powered by a large language model (LLM).
According to the complaint, Character.AI is widely available, has more than 20 million monthly active users worldwide, and hosts more than 18 million unique chatbot characters created by users. The Commonwealth alleges that some of those characters purport to be health care professionals, including a chatbot named “Emilie,” described on the platform as “Doctor of psychiatry. You are her patient.” As of April 17, 2026, “Emilie” allegedly had approximately 45,500 user interactions on the Character.AI platform. Read more
Privacy Tip #491
According to HaveIBeenPwned, ShinyHunters targeted fashion brand Zara in a cyber-attack and claimed that it had stolen 197,000 unique email addresses, product SKUs, order IDs, and the originating market. The incident involved a former technology provider (AI analytics platform Anodot) for Zara’s parent company, Inditex, which resulted in the exposure of the personal information. ShinyHunters claimed to have leaked 140GB of data, which is reported to have included compromised authentication tokens for Anodot users.
Learn more about how token-based attacks work and find tips on how to prevent them in this week's privacy tip. Read more
RECENT EVENTS + NEWS
Linn Freedman to Present BBA Panel on AI and Real-World Lessons
Artificial Intelligence practice chair Linn F. Freedman will be among the speakers presenting on a panel titled “AI at Work: Real-World Lessons Learned,” as part of the Boston Bar Association’s (BBA) Legal Hour, on May 19, 2026. Linn’s panel will explore on-the-ground experiences spanning hiring, monitoring, productivity tools, product development, data security, and governance, highlighting how employment, privacy, cybersecurity, and AI governance issues increasingly intersect.
