Security Company Arctic Wolf has reported that it has documented more than 400 incidents where threat actors flooded employees’ inboxes with spam, to the point of extreme frustration, then used Teams to contact the frustrated employee posting as IT support to assist in fixing the problem. The Teams contact comes within minutes of the flooding of the inbox. Because the Teams contact is from a legitimate platform and is not a vulnerability with Teams, the victim believes it is legitimate and accepts the help. This is another example of how threat actors use legitimate tools in a malicious way.

In using the legitimate Teams platform, the threat actor can bypass internal security measures to detect unauthorized activity, and legitimate IT professionals are unable to detect or defend users against the activity.

When the victim responds, Arctic Wolf found that it took the threat actor less than 15 minutes to obtain remote access. First, the threat actor asks the victim to switch to a Teams voice call and the threat actor then walks the victim through the installation of remote access software. The threat actor deploys the remote access software and starts running malicious code.

Be wary of any call or message from an outside organization, and only accept external chats with “specific partner domains.” IT professionals may wish to block “unmanaged Teams accounts and trial tenants and limiting Quick Assist and other remote access software to authorized IT staff.” Users should be aware of this threat and the unauthorized use of Teams, and to avoid any Teams chats or messages initiated from outside their organization. If your inbox gets flooded with spam, or you receive an unknown Teams call or chat, don’t answer it or respond–call your internal IT professionals on a reliable internal number.

On October 26, 2026, a federal judge denied ed-tech provider PowerSchool’s motion for partial judgment, keeping a California medical-privacy claim alive in In re PowerSchool Holdings, Inc. & PowerSchool Group, LLC Customer Security Breach Litig., No. 25-md-03149-AJB-MSB, slip op. at 12 (S.D. Cal. Oct. 26, 2026).

The case stems from a 2024 data breach that allegedly affected nearly 50 million K–12 students and teachers. PowerSchool provides software and data-management services to school districts. The plaintiffs allege that the company-maintained student medical information, including diagnoses, medications, and allergies, and made it available to school personnel and health-care providers. The court did not decide whether that handling violated the law. Here, it only decided whether the plaintiffs’ allegations were enough for the claim to continue.

You may wonder why an ed-tech company is facing a health-care privacy claim. Under California’s Confidentiality of Medical Information Act (CMIA), whether the law applies can depend on what a company does with medical information, not just the industry it serves. The CMIA generally bars covered entities from disclosing a patient’s medical information without authorization. To proceed, plaintiffs must plausibly allege that PowerSchool falls within a covered category, such as a health-care provider or contractor. The CMIA’s definition of a health-care provider can include a business that maintains medical information to make it available to individuals or providers for managing health information or for diagnosis and treatment.

PowerSchool argued that a recent California Supreme Court decision involving another education-technology company foreclosed the claim. The judge disagreed because that case involved allegations that student data was used for educational screening, while these plaintiffs allege that PowerSchool maintained and shared medical information for health-care purposes. According to the judge, that was enough for the CMIA-provider theory to proceed. A school-software company’s role can extend beyond education. When a platform handles student medical records to support care, it might find itself in the CMIA’s provider lane, too

AI notetakers are widely used by businesses in all industries. Although efficient, they pose privacy and cybersecurity risks, including lax compliance with established privacy and security frameworks such as GDPR or SOC 2, weak encryption, and recording conversations without consent, which may be in violation of one-party recording laws. For lawyers, it could mean an unauthorized waiver of privilege.

Before deploying an AI notetaker in your environment, it is important to assess the risk it poses to your organization, like any newly deployed technology. Unfortunately, many AI notetakers are embedded in conference platforms, and it may be difficult for users to turn them off. Consider establishing a process to approve AI notetaking for users, including training employees on which platforms have been sanctioned, obtaining consent from all participants during the use of the AI notetaker, establishing who has access to transcripts and how they are maintained, vetting vendors on training from your data, and reviewing vendors vendor contracts for privacy and security protections. Obvious places where AI notetaking may be prohibited include meetings with legal counsel, human resources meetings, and meetings discussing highly confidential matters.

Another consideration is how employees are using private AI notetakers in the workplace. Shadow AI notetakers are being used by employees in their personal lives, and that use spreads into the workplace. They can present themselves as apps on mobile phones or watches, or could be recording through sunglasses or wearable devices. The use of shadow AI notetakers presents a risk to the organization as the use is not sanctioned, governed or subject to the organization’s established policies and procedures.

Shadow AI notetakers present real risks to an organization as users may not be disclosing the use of the AI notetakers to others they are recording, are not obtaining consent, and are secretly recording conversations. In one example, an executive from an organization was having a private conversation with another employee, and unbeknownst to him, the other employee was secretly recording the conversation and the executive was fired.  This shows how ubiquitous AI notetakers have become and that there is no such thing as a private conversation anymore. Executives need to be aware of the risks associated with AI notetakers, assess them, and put a governance program in place to address their use in the organization like any other newly deployed technology. Employees need to be aware of the risks, follow the organization’s guidelines and ask that AI notetakers be dismissed from meetings discussing legal, human resources, or highly confidential matters.

Corporate legal departments are increasingly looking to see how outside counsel use artificial intelligence (AI). At a recent DRI, Association of Lawyers Defending Business conference, legal leaders from Bayer, Fifth Third Bank, and Progressive discussed how AI is entering outside-counsel guidelines and requests for proposals. One panelist captured the competitive shift: outside counsel who learn to use AI may replace those who do not.

This shift is part of a broader change in the work of in-house legal teams. The panelists described spending more time on emerging technology, including how to advise businesses on AI and how to incorporate it into internal operations. They also emphasized the value of adaptability as organizations respond to new demands. For clients, the question is not simply whether their lawyers use AI, but whether they can help make its use practical, thoughtful, and aligned with the business. Working with clients on the legal and governance considerations that arise as they adopt and use AI helps connect the technology’s potential with the responsibilities that come with it. As AI becomes part of the client-counsel conversation, that combination of practical experience and sound judgment will matter more and more. 

The legal profession’s apprenticeship model has never been as reliable as many might think. Junior lawyers do not automatically learn from late-night proofreading, routine markups, or being assigned work without guidance. Their development often depends on being paired with a senior lawyer who has the time and skill to teach, and work on matters that allow room to learn. AI gives law firms a chance to make that development more deliberate. For in-house counsel choosing outside advisers, the question is not only whether a firm uses AI efficiently, but whether it is preparing junior lawyers to become the thoughtful, commercially aware counselors clients will need over time.

AI can either strengthen apprenticeship or hollow it out. When lawyers use it to bypass junior associates’ participation in research, drafting, or analysis, they may save time while removing opportunities to learn how experienced lawyers frame problems and weigh tradeoffs. However, when senior and junior lawyers work together to define a task, identify reliable sources, assess AI-generated work, and discuss what the tool missed, the process can make legal reasoning more visible. Junior lawyers can build skills by checking outputs against source material, testing the strength of the analysis, and explaining how revisions serve the client’s goals. The aim is not to preserve tedious work for its own sake, but to protect the productive struggle through which sound judgment develops. That judgment matters earlier in a lawyer’s career as AI accelerates legal work and raises expectations. AI fluency is more than writing effective prompts: it means knowing when to use AI, what context and sources matter, what a good answer should contain, and whether the result is reliable for the client’s legal and commercial needs. Those abilities require foundational knowledge, supervision, and feedback, not just access to a tool. In-house legal teams can ask outside firms how AI fits into their training and review practices, and whether junior lawyers have meaningful opportunities to develop these skills. Firms that invest in that development may deliver more than near-term efficiency because they can build a stronger pipeline of advisers who understand both the law and the clients they serve

Major U.S. banks are sounding the alarm about the risk to customers that are providing their banking credentials to AI agents to access their bank accounts. Bank executives are calling the situation “horrifying.” The fear is that the agents are going beyond the instructions of the user, and are making purchasing decisions or moving money from the account that could have grave financial consequences for the customer.

Bank executives have observed that AI agents are contacting call centers and are taking “actions independent of user instructions.” Banks are having difficulty determining whether the agent is authorized or going rogue. In response, major banks, such as Morgan Stanley, JPMorgan, Bank of America and Citi are restricting the use of AI agents’ access to bank accounts.

Relying on an AI agent to make financial decisions is risky enough, but “sharing your banking username and password with an AI assistant runs the risk that it could do something with your finances without your knowledge, or that your bank thinks someone’s raiding your account and locks you out of it. Worse, a security flaw in the AI assistant could result in it leaking your banking credentials elsewhere, giving financially motivated hackers a way into your bank account.” In addition, consider the fact that many, if not all, AI agents may go rogue, which is indeed “horrifying.” It is good cyber hygiene not to give your credentials to your banking account to anyone, including a bot. It is also potentially against bank policies. Most importantly, understand that if something goes wrong when you allow a bot to do your banking for you, “it’s on you.” Bank of America has made it clear that “if you do share your credentials, keep in mind that you’re responsible for activity resulting from that access.”

Comparitech’s Q3 roundup concludes that in the third quarter of 2026, ransomware attacks against the healthcare industry “rose by 40 percent when compared to Q2 2026 … and more than doubled … when compared to the same period last year.” This computes to 3.33 attacks per day.

The attacks were against hospitals, clinics, direct care providers, pharmaceutical/medical manufacturers, medical billing providers, and health tech companies.

The U.S. had the highest number of attacks in the world (185), which was an increase of 64% from Q2 to Q3 2026. And these were only the “confirmed” attacks, which is when the victim publicly discloses the attack that involved ransomware; or the victim publicly acknowledges a cyber attack that matches a claim by a ransomware group.

These statistics do not include attacks that are never publicly acknowledged by an organization, which means the statistics are undoubtedly higher.

The health care industry continues to get hammered by ransomware attacks. Core defense strategies are crucial in protecting against cyber- attacks, including ransomware attacks. These strategies include:

  • Robust backups;
  • Network segmentation;
  • Access control & zero trust;
  • Endpoint protection;
  • Patch & vulnerability management;
  • Employee hygiene, training and education; and
  • Incident response planning.

In response to the dramatic increase in ransomware attacks against the healthcare industry, IT professionals working in that sector would do well to understand the increased risk and prepare for an attack by implementing the above strategies.

Consumer protection litigation is climbing, even as federal enforcement filings decline. According to Lex Machina’s 2026 Consumer Protection Litigation Report, federal consumer protection filings reached 20,353 in 2025, a 31% increase over 2024 and a 10-year high. Credit reporting and telemarketing disputes were major drivers: Fair Credit Reporting Act (FCRA) cases reached 7,750, while Telephone Consumer Protection Act (TCPA) filings rose from 1,682 to 2,748. With more than 12,000 consumer protection lawsuits filed in the first half of 2026, the report suggests the upward trend is continuing.

AI is adding another layer of complexity to both credit reporting and consumer outreach. The report highlights the Federal Communications Commission’s February 2024 confirmation that the TCPA covers AI-generated human voices, along with its subsequent move to expressly codify do-not-call protections for marketing texts. On the hiring side, AI tools that combine online information with predictive models to rank applicants are drawing scrutiny under the FCRA. In Kistler v. Eightfold AI Inc., case no. 3:26-cv-01768 (N.D. Cal. filed Jan. 2026), plaintiffs allege that automated applicant profiles qualify as consumer reports and that the recruiting company supplied them without required disclosures or opportunities to dispute errors; those claims are pending, not yet established violations.

Data breach litigation is also rising, reaching 2,980 new cases in 2025, compared with 711 in 2022. For businesses, these trends support treating privacy, cybersecurity, marketing, and AI governance as connected risk-management priorities rather than separate compliance exercises. A practical starting point is to review consent and opt-out workflows, examine what data recruiting and screening vendors collect and how they generate scores, and revisit incident-response readiness. Vendor diligence should go beyond whether a tool works to address how its data practices and outputs could create legal exposure. Businesses should evaluate the underlying activity, not just the technology’s label.

Missouri Attorney General Catherine Hanaway announced on October 14, 2026, that her office has initiated a formal investigation into TikTok, Inc., “to determine whether the company has deceived families, exploited young users, or put children at risk through its platform’s design and operation.”

The Missouri AG’s office issued a civil investigative demand requiring TikTok to answer questions about how the platform “selects and promotes content for children,” and to explain how the platform “evaluates watch time, reactions, and other signals in ways that may push inappropriate or harmful content to young users.”

The investigation concentrates on TikTok’s collection of data from children under 13, minors under 18, and young adults under 24. The office is “demanding information on the company’s internal methods for determining a user’s age, the rules and safeguards TikTok claims to apply to its younger audience, and the actual enforcement of those policies. TikTok must also produce its internal research into how children engage with the platform, including any studies on youth mental health, problematic use, and exposure to harmful material.”

The Missouri AG is following in the footsteps of numerous other AGs investigating or suing TikTok for various allegations of harm to children and youth.

On October 19, 2026, a federal district court judge allowed ordinary negligence and implied-contract claims to proceed in a proposed class action against Kaplan North America. See Linsell v. Kaplan N. Am., LLC, No. 0:26-cv-60785-WPD, slip op. (S.D. Fla. Oct. 19, 2026). The plaintiffs all sought Kaplan’s test-preparation, professional-licensing, or educational services. The case stems from an unauthorized actor’s access to Kaplan’s servers between October 30 and November 18, 2025, and the alleged theft of files containing names, Social Security numbers, and/or driver’s license numbers. Several plaintiffs allege actual misuse, including fraudulent charges, unauthorized account activity, attempted accounts or loans, and dark-web notifications. One news report put the number of affected consumers at about 1.4 million.

Kaplan’s motion to dismiss failed on the ordinary-negligence and implied-contract claims. The court found the alleged timing and misuse sufficient to plausibly connect some plaintiffs’ injuries to the breach at this stage. It also reasoned that customers required to provide sensitive information to receive services could plausibly expect Kaplan to safeguard it, even without an express promise to provide separate data-security services. The ruling does not establish that Kaplan’s security was inadequate or that it is liable.

Other claims were dismissed. The court dismissed unjust enrichment because plaintiffs did not plausibly allege Kaplan received an additional benefit from the data breach beyond payment for services worth what they cost. It also dismissed the California Consumer Privacy Act (CCPA) claim for lack of standing, holding that the California plaintiff alleged diminished information value and mitigation efforts, but no actual misuse or specific evidence of misuse. The court did not decide the CCPA claim’s merits.

For organizations, the ruling illustrates two distinct risks after a data breach. A negligence claim may focus on whether safeguards were reasonable in light of the information’s sensitivity, whereas an implied-contract claim may focus on whether the circumstances of collecting that information created a reasonable expectation that it would be protected.