On October 13, 2026, the Department of Justice (DOJ) announced that it made two arrests, searched multiple laptop farms, and seized 187 computer devises used by the Democratic People’s Republic of North Korea (DPRK) to defraud U.S. based companies to “fund its regime through remote information technology (IT) work for U.S. companies.” The coordinated effort, dubbed “operation Lonestar Roundup,” took place primarily in Ohio and Texas.

According to the DOJ’s press release, “North Korea continues to deploy remote IT workers using stolen identities to infiltrate American companies and generate revenue for the regime and its weapons programs.” The Federal Bureau of Investigation (FBI) and DOJ successfully deployed a coordinated effort against the scheme and “secured charges against 14 individuals, conducted two arrests, seized nearly 190 devices, and executed operations at more than 40 suspected “laptop farms” across Texas. Disappointing was the arrest of two U.S. nationals, along with ten Chinese nationals, and two unidentified individuals involved in the multi-year fraud scheme. The scheme worked like this:

According to the indictment, from 2019 to in or around July 2025, DPRK IT workers applied for and obtained remote positions by using stolen or fabricated identity documents, virtual private networks and proxy infrastructure to appear as though they were U.S. persons working from within the United States. They also relied on U.S.-based facilitators who received and hosted multiple laptop computers — issued by victim U.S. companies — at their residences in the United States (“laptop farms”), housed and configured those devices, installed remote-access software and transferred earnings to DPRK‑controlled accounts.

More than 70 U.S. companies were affected, and the scheme generated over $3 million in revenue. “Victim employers included companies in the health care, communications, cyber support, retail, and manufacturing sectors across Ohio, sixteen additional states, and the District of Columbia.”

In conjunction with the announcement, the FBI issued a public service announcement to assist companies with mitigation guidance. Companies that employ remote IT professionals should pay close attention to recruiting and hiring practices to prevent becoming a victim.

To learn more about actions against North Korean cyber threat actors, click here.

On October 8, 2026, a federal judge in Pennsylvania allowed most claims in a student data-breach lawsuit against Fireworks Software, Inc. to proceed, while dismissing a New Jersey consumer-fraud claim. Adamek v. Fireworks Software, Inc., No. 2:24-cv-05185-NIQA, slip op. at 4–15 (E.D. Pa. Oct. 8, 2026), is a class action litigation following a 2024 breach involving Rowan College students’ personal information. Plaintiffs alleged an unknown actor accessed Fireworks’ systems, exposing names, birth dates, Social Security numbers, and Alien Registration numbers. They claimed Fireworks failed to reasonably safeguard that data, leaving students facing identity-theft risks and mitigation costs.

The court deferred a broader choice-of-law decision until the factual record develops, but applied New Jersey law to the New Jersey Consumer Fraud Act claim. It dismissed that claim because generalized allegations of inadequate security did not identify specific deceptive conduct or establish a duty to disclose Fireworks’ security measures. However, other claims survived.

As to the claim of negligence, the court found it plausible that Fireworks owed students a duty of reasonable care because, as a software provider serving higher-education institutions, it held their sensitive information. Plaintiffs alleged that Fireworks breached that duty by failing to assess security risks, maintain adequate safeguards, test and monitor its systems, detect the breach, and provide timely notice. The court also concluded that the alleged appearance of a student’s information on the dark web, together with expenses incurred to mitigate identity-theft risks, was enough at this stage to plead causation and actual damages.

The contract claim also survived because the complaint plausibly alleged that Rowan College’s agreement with Fireworks was intended to protect students’ information, making them potential third-party beneficiaries. The court also allowed the unjust-enrichment claim to proceed because, even though the students provided their data through the college, Fireworks allegedly benefited from managing and retaining it.

Though the ruling is not a finding of liability, it shows how a data breach case can move forward when plaintiffs link a vendor’s custody of sensitive information to specific security failures, resulting harm, and contractual responsibilities. For companies handling student data, those connections, as well as the agreements and safeguards behind them, can shape a dispute long after the breach itself is contained.

Federal agencies’ growing use of artificial intelligence (AI) in procurement is opening a new front in bid protests. In Trax International Corp., No. 26-796 (Fed. Cl. Sept. 22, 2026), a federal appellate court rejected a challenge to a $449 million Army contract because Trax did not connect the Army’s use of AI to evaluation errors or show why reliance on AI undermined the award decision. The court noted that portions of the Army’s evaluation were nearly identical to an AI-generated assessment but held that “more is needed” to establish improper reliance. The ruling is narrow, but it signals that AI-generated material may become part of the protest record: the court required the Army to produce AI-generated evaluations, despite the government’s initial position that they were not part of the decision-making process.

The central question for future protests may be less whether an agency used AI and more whether the record shows meaningful human judgment. FAR 15.308 requires the source selection authority to exercise “independent judgment” and document the award decision. AI may help agencies triage or summarize lengthy proposals, but evaluators cannot simply adopt its output, particularly if it contains hallucinated references, erroneous conclusions, or findings inconsistent with the solicitation. A record that fails to explain how evaluators reached their ratings may give protesters a viable challenge even without proof that AI caused a specific error.

For contractors, the case points to practical questions for developing a protest: what AI-generated evaluations or summaries were created, who received them, and how were they checked against the proposals and solicitation? The court’s separate October 5, 2026, order seeking additional information about government declarations also underscores the importance of a complete and accurate record. Agencies that document how evaluators reviewed AI outputs and reached their own conclusions may be better positioned to defend an award; unsupported or unexplained AI-generated language in the evaluation may leave a meaningful opening for challenge.

Artificial intelligence (AI) is changing more than how legal work gets done; it is reshaping how in-house teams and outside counsel work together. As AI enters legal workflows, assumptions about who uses which tools, what information goes into them, and how the work is delivered can create friction if the parties have not discussed them. The better approach is to make AI use a routine part of engagement and matter planning, not a surprise discovered after work is underway.

Those conversations can be practical and matter-specific:

  • Which tools may be used?
  • What data may be entered, retained, or excluded?
  • What work is appropriate for AI, and what requires human review or escalation?

The parties should also discuss how they will address confidentiality risks and check the reliability of AI-generated outputs. These questions matter especially when counsel and clients work across shared platforms or use tools provided by a third party.

AI can also prompt a thoughtful reassessment of workflows, pricing, and the value delivered, not a presumption that every efficiency translates directly into lower fees. A structured trial, with clear expectations and room to refine the process, can help counsel and clients learn what works while preserving trust. The goal is not to negotiate every tool in the abstract; it is to establish a shared baseline before assumptions take hold. 

On October 14, 2026, a coalition of 40 state Attorneys General filed a Notice of Interest and Reservation of Rights in the bankruptcy proceeding involving debtor, Character Technologies, Inc. (Character) regarding its product Character.AI’s “outstanding regulatory, safety and privacy issues.”

According to the Notice, Character “designed, built, and distributed Character.AI, an artificial intelligence consumer chatbot product that invites millions of people, including children, to interact with AI-powered ‘characters’ designed to mimic human conversation.” It then marketed Character.AI to children and adults for story telling “despite knowing that its chatbots posed serious safety risks.” In doing so, the “Debtor collects, stores, and analyzes users’ sensitive data, including chat content, declared and inferred ages, emotional and health-related disclosures, and usage patterns and behaviors, and uses this data for analytics, personalization, age assurance, monetization, and to train and improve their product.”

Several states investigated Character for consumer protection and privacy violations following the filing of a wrongful death suit against it, which alleged that Character.AI’s chatbot engaged in a relationship with a 14-year-old boy that “encouraged his suicidal thoughts” before he died by suicide.

The AGs filed the Notice to put “all parties on notice of the regulatory issues that will need to be addressed in any sale or transfer of the Debtor’s business or assets … due to the highly sensitive nature of the conversations many users have with Character.AI chatbot characters, the large number of minors who use the product, the serious risks posed by specific features of the product, and the speed at which bankruptcy cases progress.” The specific instances cited by the Notice are chilling, and parents should review them and consider them when discussing the use of AI tools by minor children.

The AGs also list the regulatory concerns that they suggest need to be addressed in any sale of Character.

Kudos to the 40 AGs that are keeping an eye on the risks to consumers, particularly children here, and banding together to continue to protect consumers’ privacy. The tip here is to read the Notice, understand how these AI tools are collecting, using and communicating with children, monitor the use of chatbots and AI tools by your children, and discuss the risks with them so both you and they become more knowledgeable about the technology and the harms it can cause.

Maybe attacking the FBI was not such a brilliant idea. Following the FBI attack, one of the suspected leaders of ShinyHunters has been detained and is in custody. Apparently, there is no honor among thieves, as he is reportedly assisting law enforcement by naming other members of the cyber gang.

The suspect, Saif al-Din Khader, a teenager from Amman, Jordan, was in the process of extorting a company that allegedly employed his father when he was detained. What a guy.

His detainment follows the arrest of a 24-year-old man in Amsterdam, also allegedly a part of the ShinyHunters criminal gang.

According to the FBI, ShinyHunters affiliates “have allegedly breached more than 140 organizations and taken at least $70 million in extortion payments,” since 2025.

Hopefully the detainment and arrest of these members of ShinyHunters is the beginning of the dismantling of this vexatious group.

On September 30, 2026, a New York federal judge denied Major League Baseball’s digital-ticketing arm, MLB Advanced Media, L.P. (MLBAM), a chance to send to arbitration most claims over tickets that disappeared from the MLB Ballpark app after a cyberattack. Lanham v. MLB Advanced Media, L.P., No. 25-cv-7780 (AS), slip op. at 6–8 (S.D.N.Y. Sept. 30, 2026). The order is a reminder that arbitration language in online terms of use does not guarantee a cyber dispute will be arbitrated.

The complaint alleged that attackers used credentials leaked or stolen from other websites to access MLBAM accounts and steal fans’ tickets. The plaintiffs claimed the app’s security flaws enabled the intrusions.

The court saw two main hurdles to arbitration. The first was whether the plaintiffs had agreed to MLBAM’s 2024 terms of use at all. MLBAM pointed to emails and app pop-ups announcing the changes, plus terms linked on sign-up and login screens during the 2025 season. However, most plaintiffs had opened their accounts years earlier, and the court held that the record did not establish whether and when they encountered a screen that required them to accept the updated terms.

Second, the terms excluded claims related to alleged violations of users’ privacy rights or interests. MLBAM argued that plaintiffs alleged only potential privacy violations and that exposed information was publicly available. The judge focused instead on the alleged account intrusions: users had a privacy interest in their accounts and contents, even if the claims also involved missing tickets. Because the carveout covered “any” related claim and its examples were nonexclusive, it was “capacious.”

Organizations should keep in mind that notice of revised terms may not establish assent, particularly for longtime users. Records showing which version each user accepted, when, and through what screen, can help demonstrate user agreement. They should also consider how broadly a privacy carveout may reach claims involving account access, exposed information, or missing digital property. If certain disputes are intended to remain in arbitration, the carveout’s boundaries should be clear. Otherwise, the exception could take arbitration out of play.

The Federal Trade Commission’s (FTC) proposed enforcement policy statement on personalized pricing signals that businesses may face scrutiny when they use consumer-specific data to set different prices for different customers without disclosing that practice. The statement is not binding law, but the FTC says it intends to use its existing Section 5 authority to address potentially deceptive or unfair practices. Its focus is distinct from ordinary dynamic pricing based on market-wide factors such as supply, demand, or inventory: personalized pricing relies on information or inferences tied to an individual consumer or household.

For businesses, the practical question is not only whether a price varies, but what data and assumptions drive the variation, and what consumers are told about them. The FTC’s position is that an effective disclosure should clearly state that the price is personalized, explain the basis for the personalization, and identify the types of data used; privacy notices and consent practices may also warrant review.

Companies can start by mapping where consumer-specific data affects prices, then assessing disclosures across websites, checkout flows, phone scripts, and chat interfaces. To view the full FTC statement, click here.

In the wake of two lawsuits against it, California Attorney General Rob Bonta recently served an investigative subpoena on OpenAI as part of the California Department of Justice’s (DOJ) ongoing investigation of incidents resulting from the operations of OpenAI and its artificial intelligence (AI) models.

According to the Attorney General’s press release, the DOJ announced last month that it “is conducting a formal investigation into the Hugging Face incident, while continuing to more broadly monitor the AI industry’s compliance with California laws. The subpoena is part of a broader inquiry into cybersecurity incidents and risks involving the company and its models.”

The DOJ’s subpoena seeks answers to “additional questions regarding cybersecurity incidents and risks involving the company and its AI models.”

It may take some time for the two lawsuits and the subpoena to wind through the legal system, but hopefully more information will be obtained through these processes on how the OpenAI agents are hacking other companies and what OpenAI is doing to rein them in.

Clients are increasingly turning to AI before they speak with outside counsel, and sometimes after, by pasting legal advice, contract language, or other work product into a public AI model to ask follow-up questions. Used thoughtfully, these tools can help clients frame questions and organize information, but an answer that sounds confident is not necessarily grounded in the facts, current law, or the company’s actual obligations. Additionally, sharing sensitive business or legal information with a public tool can raise separate confidentiality and data-handling concerns.

A familiar example is the California Consumer Privacy Act (CCPA). AI-generated privacy-policy suggestions often recommend adding CCPA disclosures, even when the business may not be subject to the law or the suggested language does not fit its practices. Adding statements about consumer rights, data uses, or processes that the company does not actually follow can create confusion and potential legal exposure; removing language counsel drafted can create its own problems. The issue is not that AI is always wrong, it is that generic answers can turn on facts the tool was never given, or cannot reliably assess.

The practical question for clients and counsel is how to use AI without letting plausible-sounding outputs become an unreviewed legal position or business commitment. That means being deliberate about what information goes into a tool, checking its sources and assumptions, and treating its output as a starting point, not a substitute for advice grounded in the company’s facts. This is a useful conversation for General Counsel and outside counsel to have together: where AI can help, where it can mislead, and what review practices make its use safer and more productive. Outside counsel, General Counsel, and AI platforms can work as an efficient, effective team if parameters and expectations are put in place.