Comparitech’s Q3 roundup concludes that in the third quarter of 2026, ransomware attacks against the healthcare industry “rose by 40 percent when compared to Q2 2026 … and more than doubled … when compared to the same period last year.” This computes to 3.33 attacks per day.

The attacks were against hospitals, clinics, direct care providers, pharmaceutical/medical manufacturers, medical billing providers, and health tech companies.

The U.S. had the highest number of attacks in the world (185), which was an increase of 64% from Q2 to Q3 2026. And these were only the “confirmed” attacks, which is when the victim publicly discloses the attack that involved ransomware; or the victim publicly acknowledges a cyber attack that matches a claim by a ransomware group.

These statistics do not include attacks that are never publicly acknowledged by an organization, which means the statistics are undoubtedly higher.

The health care industry continues to get hammered by ransomware attacks. Core defense strategies are crucial in protecting against cyber- attacks, including ransomware attacks. These strategies include:

  • Robust backups;
  • Network segmentation;
  • Access control & zero trust;
  • Endpoint protection;
  • Patch & vulnerability management;
  • Employee hygiene, training and education; and
  • Incident response planning.

In response to the dramatic increase in ransomware attacks against the healthcare industry, IT professionals working in that sector would do well to understand the increased risk and prepare for an attack by implementing the above strategies.

Consumer protection litigation is climbing, even as federal enforcement filings decline. According to Lex Machina’s 2026 Consumer Protection Litigation Report, federal consumer protection filings reached 20,353 in 2025, a 31% increase over 2024 and a 10-year high. Credit reporting and telemarketing disputes were major drivers: Fair Credit Reporting Act (FCRA) cases reached 7,750, while Telephone Consumer Protection Act (TCPA) filings rose from 1,682 to 2,748. With more than 12,000 consumer protection lawsuits filed in the first half of 2026, the report suggests the upward trend is continuing.

AI is adding another layer of complexity to both credit reporting and consumer outreach. The report highlights the Federal Communications Commission’s February 2024 confirmation that the TCPA covers AI-generated human voices, along with its subsequent move to expressly codify do-not-call protections for marketing texts. On the hiring side, AI tools that combine online information with predictive models to rank applicants are drawing scrutiny under the FCRA. In Kistler v. Eightfold AI Inc., case no. 3:26-cv-01768 (N.D. Cal. filed Jan. 2026), plaintiffs allege that automated applicant profiles qualify as consumer reports and that the recruiting company supplied them without required disclosures or opportunities to dispute errors; those claims are pending, not yet established violations.

Data breach litigation is also rising, reaching 2,980 new cases in 2025, compared with 711 in 2022. For businesses, these trends support treating privacy, cybersecurity, marketing, and AI governance as connected risk-management priorities rather than separate compliance exercises. A practical starting point is to review consent and opt-out workflows, examine what data recruiting and screening vendors collect and how they generate scores, and revisit incident-response readiness. Vendor diligence should go beyond whether a tool works to address how its data practices and outputs could create legal exposure. Businesses should evaluate the underlying activity, not just the technology’s label.

Missouri Attorney General Catherine Hanaway announced on October 14, 2026, that her office has initiated a formal investigation into TikTok, Inc., “to determine whether the company has deceived families, exploited young users, or put children at risk through its platform’s design and operation.”

The Missouri AG’s office issued a civil investigative demand requiring TikTok to answer questions about how the platform “selects and promotes content for children,” and to explain how the platform “evaluates watch time, reactions, and other signals in ways that may push inappropriate or harmful content to young users.”

The investigation concentrates on TikTok’s collection of data from children under 13, minors under 18, and young adults under 24. The office is “demanding information on the company’s internal methods for determining a user’s age, the rules and safeguards TikTok claims to apply to its younger audience, and the actual enforcement of those policies. TikTok must also produce its internal research into how children engage with the platform, including any studies on youth mental health, problematic use, and exposure to harmful material.”

The Missouri AG is following in the footsteps of numerous other AGs investigating or suing TikTok for various allegations of harm to children and youth.

On October 19, 2026, a federal district court judge allowed ordinary negligence and implied-contract claims to proceed in a proposed class action against Kaplan North America. See Linsell v. Kaplan N. Am., LLC, No. 0:26-cv-60785-WPD, slip op. (S.D. Fla. Oct. 19, 2026). The plaintiffs all sought Kaplan’s test-preparation, professional-licensing, or educational services. The case stems from an unauthorized actor’s access to Kaplan’s servers between October 30 and November 18, 2025, and the alleged theft of files containing names, Social Security numbers, and/or driver’s license numbers. Several plaintiffs allege actual misuse, including fraudulent charges, unauthorized account activity, attempted accounts or loans, and dark-web notifications. One news report put the number of affected consumers at about 1.4 million.

Kaplan’s motion to dismiss failed on the ordinary-negligence and implied-contract claims. The court found the alleged timing and misuse sufficient to plausibly connect some plaintiffs’ injuries to the breach at this stage. It also reasoned that customers required to provide sensitive information to receive services could plausibly expect Kaplan to safeguard it, even without an express promise to provide separate data-security services. The ruling does not establish that Kaplan’s security was inadequate or that it is liable.

Other claims were dismissed. The court dismissed unjust enrichment because plaintiffs did not plausibly allege Kaplan received an additional benefit from the data breach beyond payment for services worth what they cost. It also dismissed the California Consumer Privacy Act (CCPA) claim for lack of standing, holding that the California plaintiff alleged diminished information value and mitigation efforts, but no actual misuse or specific evidence of misuse. The court did not decide the CCPA claim’s merits.

For organizations, the ruling illustrates two distinct risks after a data breach. A negligence claim may focus on whether safeguards were reasonable in light of the information’s sensitivity, whereas an implied-contract claim may focus on whether the circumstances of collecting that information created a reasonable expectation that it would be protected.

A researcher at security firm NorForge has discovered that a Chinese-speaking criminal launched autonomous AI agents through Carin, a general-purpose problem-solving engine that can coordinate AI agents for a specific task, including penetration testing, toward 1,200 targeted sites, and was able to break into over 100 of them with “almost no help” because website operators had “left their control panels open on the internet.”

The operator gave the AI agents simple tactics, “and the agents went from there.” They were able to break into the websites in an average of 23 hours and used the DeepSeek and Claude Code products.

Some tips to defend against this type of campaign include:

  • Exposed panels. Agent control panels of this kind often answer on port 8000, so an exposed one without a login is worth hunting for.
  • Stray upload forms. An unexpected file-upload form sitting in a hidden directory is the foothold these agents aimed for.
  • Magento patching. A worker directory NorForge browsed held a proof-of-concept for a critical Magento flaw, StyleSmuggler (CVE-2026-75650), and a test lab for it. There is no evidence it was used in these break-ins, but any shop still on an affected build should apply Adobe’s hotfix for it: Adobe Commerce 2.4.4 through 2.4.9, or Magento Open Source 2.4.6 through 2.4.9.

There is a reason why every single state data breach notification law in the United States requires organizations to notify individuals in the event a driver’s license has been compromised. And I have two real life stories to show why it is so important to keep your driver’s license number safe and secure, just like your Social Security number.

Last week, two good friends shared their recent stories with me of personal fraud. The first found out that $920 in cash had been withdrawn from his joint checking account in early September that he did not withdraw. He called the bank to report the withdrawal and after some back and forth, the bank advised that someone with his driver’s license (which was fake) and bank account number had walked into the bank branch in a completely different state and was able to withdraw the cash. The victim had deployed multi-factor authentication on his account but was never notified of the withdrawal. It was quite surprising that a bank would allow a withdrawal from a bank account with just a driver’s license (that was fake) and the bank account number.

Just a few days later, after I told someone about this surprising fact pattern, they told me that the same thing happened to them. In their situation, someone walked into a credit union in another state where they did not reside and had a fake driver’s license and their bank account number, and with those two items, was able to get a money order issued for $2,700 against their bank in another state. Again, a very surprising scenario.

On September 1, 2026, my colleague Brian Krebs of KrebsonSecurity, reported that the Russian cybercrime forum Exploit was offering access to identity documents of more than 170 million people in North America. According to Krebs, the service, also known as Nexus, was advertising the sale of and access to driver’s license scans and other forms of identification. They alleged that they had over 153 million driver’s licenses, over 10 million ID cards, and millions of other documents, (including the driver’s license for the assistant director of the FBI). The company that had been compromised, IDScan.net, located in New Orleans, publicly disclosed the incident on September 4, 2026. The incident is being investigated by the FBI.

On top of that, just a few days later, the Florida Department of Highway Safety confirmed that the credentials of a local police employee’s device had been compromised that allowed the ShinyHunters criminal gang access to driver’s license information, motor vehicle records, document images and other personal information of more than 200,000 Floridians. 

These incidents make September one of the worst months ever for the compromise of individuals’ driver’s license information.

Getting back to the original story. Now that over 153 million driver’s licenses have been compromised, and that criminals appear to be able to use those driver’s licenses to withdraw funds from bank accounts and obtain money orders, how can one protect themselves?

It is nearly impossible to get a new driver’s license number. It is equivalent to a Social Security number. Here are some tips (also here) (though they don’t really address how a criminal can withdraw money out of an account with a fake driver’s license or obtain a money order—banks and credit unions should consider how to authenticate customers knowing that 153 million driver’s licenses have been compromised):

  • Monitor your credit report and financial statements;
  • Place a fraud alert on your credit or freeze your credit;
  • Follow up if you see any anomalies on your credit report or obtain communications from financial institutions with which you don’t have a relationship;
  • If you have been a victim, contact law enforcement and file a police report;
  • Notify the Department of Motor Vehicles; and
  • Enroll in a credit monitoring program.

If you receive a letter that your driver’s license has been compromised, you may wish to consider signing up for the services offered, and either way, follow the tips above to protect yourself from becoming a victim.

On October 13, 2026, the Department of Justice (DOJ) announced that it made two arrests, searched multiple laptop farms, and seized 187 computer devises used by the Democratic People’s Republic of North Korea (DPRK) to defraud U.S. based companies to “fund its regime through remote information technology (IT) work for U.S. companies.” The coordinated effort, dubbed “operation Lonestar Roundup,” took place primarily in Ohio and Texas.

According to the DOJ’s press release, “North Korea continues to deploy remote IT workers using stolen identities to infiltrate American companies and generate revenue for the regime and its weapons programs.” The Federal Bureau of Investigation (FBI) and DOJ successfully deployed a coordinated effort against the scheme and “secured charges against 14 individuals, conducted two arrests, seized nearly 190 devices, and executed operations at more than 40 suspected “laptop farms” across Texas. Disappointing was the arrest of two U.S. nationals, along with ten Chinese nationals, and two unidentified individuals involved in the multi-year fraud scheme. The scheme worked like this:

According to the indictment, from 2019 to in or around July 2025, DPRK IT workers applied for and obtained remote positions by using stolen or fabricated identity documents, virtual private networks and proxy infrastructure to appear as though they were U.S. persons working from within the United States. They also relied on U.S.-based facilitators who received and hosted multiple laptop computers — issued by victim U.S. companies — at their residences in the United States (“laptop farms”), housed and configured those devices, installed remote-access software and transferred earnings to DPRK‑controlled accounts.

More than 70 U.S. companies were affected, and the scheme generated over $3 million in revenue. “Victim employers included companies in the health care, communications, cyber support, retail, and manufacturing sectors across Ohio, sixteen additional states, and the District of Columbia.”

In conjunction with the announcement, the FBI issued a public service announcement to assist companies with mitigation guidance. Companies that employ remote IT professionals should pay close attention to recruiting and hiring practices to prevent becoming a victim.

To learn more about actions against North Korean cyber threat actors, click here.

On October 8, 2026, a federal judge in Pennsylvania allowed most claims in a student data-breach lawsuit against Fireworks Software, Inc. to proceed, while dismissing a New Jersey consumer-fraud claim. Adamek v. Fireworks Software, Inc., No. 2:24-cv-05185-NIQA, slip op. at 4–15 (E.D. Pa. Oct. 8, 2026), is a class action litigation following a 2024 breach involving Rowan College students’ personal information. Plaintiffs alleged an unknown actor accessed Fireworks’ systems, exposing names, birth dates, Social Security numbers, and Alien Registration numbers. They claimed Fireworks failed to reasonably safeguard that data, leaving students facing identity-theft risks and mitigation costs.

The court deferred a broader choice-of-law decision until the factual record develops, but applied New Jersey law to the New Jersey Consumer Fraud Act claim. It dismissed that claim because generalized allegations of inadequate security did not identify specific deceptive conduct or establish a duty to disclose Fireworks’ security measures. However, other claims survived.

As to the claim of negligence, the court found it plausible that Fireworks owed students a duty of reasonable care because, as a software provider serving higher-education institutions, it held their sensitive information. Plaintiffs alleged that Fireworks breached that duty by failing to assess security risks, maintain adequate safeguards, test and monitor its systems, detect the breach, and provide timely notice. The court also concluded that the alleged appearance of a student’s information on the dark web, together with expenses incurred to mitigate identity-theft risks, was enough at this stage to plead causation and actual damages.

The contract claim also survived because the complaint plausibly alleged that Rowan College’s agreement with Fireworks was intended to protect students’ information, making them potential third-party beneficiaries. The court also allowed the unjust-enrichment claim to proceed because, even though the students provided their data through the college, Fireworks allegedly benefited from managing and retaining it.

Though the ruling is not a finding of liability, it shows how a data breach case can move forward when plaintiffs link a vendor’s custody of sensitive information to specific security failures, resulting harm, and contractual responsibilities. For companies handling student data, those connections, as well as the agreements and safeguards behind them, can shape a dispute long after the breach itself is contained.

Federal agencies’ growing use of artificial intelligence (AI) in procurement is opening a new front in bid protests. In Trax International Corp., No. 26-796 (Fed. Cl. Sept. 22, 2026), a federal appellate court rejected a challenge to a $449 million Army contract because Trax did not connect the Army’s use of AI to evaluation errors or show why reliance on AI undermined the award decision. The court noted that portions of the Army’s evaluation were nearly identical to an AI-generated assessment but held that “more is needed” to establish improper reliance. The ruling is narrow, but it signals that AI-generated material may become part of the protest record: the court required the Army to produce AI-generated evaluations, despite the government’s initial position that they were not part of the decision-making process.

The central question for future protests may be less whether an agency used AI and more whether the record shows meaningful human judgment. FAR 15.308 requires the source selection authority to exercise “independent judgment” and document the award decision. AI may help agencies triage or summarize lengthy proposals, but evaluators cannot simply adopt its output, particularly if it contains hallucinated references, erroneous conclusions, or findings inconsistent with the solicitation. A record that fails to explain how evaluators reached their ratings may give protesters a viable challenge even without proof that AI caused a specific error.

For contractors, the case points to practical questions for developing a protest: what AI-generated evaluations or summaries were created, who received them, and how were they checked against the proposals and solicitation? The court’s separate October 5, 2026, order seeking additional information about government declarations also underscores the importance of a complete and accurate record. Agencies that document how evaluators reviewed AI outputs and reached their own conclusions may be better positioned to defend an award; unsupported or unexplained AI-generated language in the evaluation may leave a meaningful opening for challenge.

Artificial intelligence (AI) is changing more than how legal work gets done; it is reshaping how in-house teams and outside counsel work together. As AI enters legal workflows, assumptions about who uses which tools, what information goes into them, and how the work is delivered can create friction if the parties have not discussed them. The better approach is to make AI use a routine part of engagement and matter planning, not a surprise discovered after work is underway.

Those conversations can be practical and matter-specific:

  • Which tools may be used?
  • What data may be entered, retained, or excluded?
  • What work is appropriate for AI, and what requires human review or escalation?

The parties should also discuss how they will address confidentiality risks and check the reliability of AI-generated outputs. These questions matter especially when counsel and clients work across shared platforms or use tools provided by a third party.

AI can also prompt a thoughtful reassessment of workflows, pricing, and the value delivered, not a presumption that every efficiency translates directly into lower fees. A structured trial, with clear expectations and room to refine the process, can help counsel and clients learn what works while preserving trust. The goal is not to negotiate every tool in the abstract; it is to establish a shared baseline before assumptions take hold.