CYBERSECURITY

Verizon’s 2026 Data Breach Investigations Report Highlights

I am a big fan of Verizon’s yearly Data Breach Investigations Report. I follow it closely, as it confirms what we are seeing in the field, and provides validation for defense strategies employed to protect against attacks. The 2026 Report was recently published, and as I have mentioned before, it is well worth reading.

At a high level, the tone is that attacks remain consistent with previous years, but threat actors are employing new methods, including the use of generative artificial intelligence augmented malware. The message is that although there are more zero day vulnerabilities, social engineering is increasingly successful and the speed of attacks has increased. Those defending systems know the landscape well and need to continue focusing on defending against the most common threats: system intrusion, social engineering, basic web application attacks, miscellaneous errors and privilege misuse. Read more

ENFORCEMENT + LITIGATION

Verification Texts Are Not Automatically TCPA Ads, New Jersey Court Holds

On May 20, 2026, in Zelma v. Wonder Group Inc. (D.N.J. May 20, 2026), a federal court in New Jersey largely dismissed Telephone Consumer Protection Act (TCPA) claims against food-tech company Wonder Group Inc. (Wonder), holding that two bare verification-code text messages were not “telephone solicitations” or “unsolicited advertisements.”

The TCPA regulates certain calls and text messages, including telemarketing and unsolicited advertising. Here, a pro se plaintiff sued Wonder after receiving two text messages, each containing only a Wonder verification code. The plaintiff alleged that he had never heard of Wonder, had not asked for communications from the company, and had listed his cell number on federal and state do-not-call registries since 2003. He argued that the messages were not innocent authentication texts, but a way to push him toward Wonder’s website and services. Read more

DATA PRIVACY

A Strong Defense Ruling for Companies Facing CIPA Website Tracking Claims

A recent Third Circuit decision gives companies another strong defense point in the wave of website tracking and session replay litigation, including claims brought under the California Invasion of Privacy Act (CIPA). In Smidga v. Spirit Airlines, the plaintiffs alleged that Spirit used session replay code to record website visitors’ interactions, including text entries, clicks, and geolocation, and one plaintiff asserted a CIPA claim based on that alleged tracking. The Third Circuit affirmed dismissal because the plaintiffs failed to show a concrete privacy injury sufficient for Article III standing, relying heavily on its recent Cook v. GameStop decision involving similar session replay allegations. Read more

ARTIFICIAL INTELLIGENCE

Shadow AI Continues to Expose Company IP

Verizon recently published its 2026 Data Breach Investigations Report, which is full of helpful information for cybersecurity professionals to implement strategies for protection of systems. For a summary, click here.

The Report notes that a whopping “67% of users are using non-corporate accounts on their corporate devices to access AI services” and “45% of employees are now considered regular users of AI (authorized or not) on their corporate devices.” Verizon’s data shows that “Shadow AI is now the third most common non-malicious insider action detected…a fourfold increase in percentage from the previous year.” Read more

Colorado Rewrites Its AI Law Before It Takes Effect

Colorado has now significantly revised its AI governance framework before the law ever takes effect. SB 26-189, approved by Governor Jared Polis on May 14, 2026, repeals and reenacts key portions of the Colorado Artificial Intelligence Act (CAIA) and reframes the law around “automated decision-making technology” (ADMT) used to materially influence consequential decisions in areas such as employment, housing, financial and lending services, insurance, health care, education, and essential government services. Read more

Privacy Tip #493

Stop Using Shadow AI!

As you can tell, I am obsessed with Verizon’s Data Breach Investigations Report. It is worthy of full immersion, and I am picking it apart with precision (here and here). I always spend a lot of time delving into it as it informs and confirms strategies to assist others with prevention and resilience.

One of the important findings from the Report is that 67% of users in companies are using non-corporate generative AI tools on their corporate devices for their work. This unauthorized use is “now the third most common non-malicious insider action detected in our data loss prevention data set in 2025, a fourfold increase in percentage from the previous year.”

Learn more about Shadow AI, Verizon’s Data Breach Investigations Report, and the importance of an AI Governance program in this week’s privacy tip. Read more