In the wake of targeted cybersecurity attacks against European industrial refrigeration manufacturers, the Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Health and Human Services (HHS), U.S. Department of Agriculture (USDA), and the Department of Transportation (DoT) warned industrial refrigeration and cold chain monitoring systems of malicious cyber activity targeting their industry and provided recommendations for preparation and defense.

The alert is targeted toward “[o]rganizations in the Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems Sectors that widely use these systems, including in refrigerated transport services, for automated and remote monitoring of temperatures, continuous temperature logging, defrost cycle management, and energy optimization.”

The warning was in response to a hacking attack into the refrigeration controllers of major supermarket chains of up to 700 French supermarkets that set them to defrost mode overnight, causing the refrigerators to overheat. The cold chain disruption forced the French supermarkets to discard vast stocks of spoiled goods, resulting in losses estimated to total tens of millions of euros. It is believed that the Iranian government was behind the attack. After the attacks in France, similar attacks were launched against Belgium, Luxembourg, and Sweden. The same operators are also believed to be behind attacks against blood banks in France.

The implications of this type of attack are serious and concerning. Common uses for cold chain techniques include food and produce, pharmaceuticals, vaccines, blood and human tissue, and chemicals. These are all products that people rely on every day for existence, and a disruption in the availability of these products could be devastating.

U.S. based companies involved in industrial refrigeration and cold chain services accessible from the internet can be at risk, as hackers can remotely interfere and cause widespread inventory loss and equipment hazards. These companies are urged by CISA “to defend against this activity by using strong authentication, keeping systems updated, identifying any systems that are accessible from the internet, removing unnecessary remote access, and securing any necessary remote access.”

On November 2, 2026, the National Institute of Standards and Technology (NIST) released Small Business Cybersecurity: Non-Employer Firms, a guide for businesses with no paid employees that may also help firms with limited staff or IT resources.

The guide uses six functions from the NIST Cybersecurity Framework: Govern, Identify, Protect, Detect, Respond, and Recover. Before choosing safeguards, a business should know what information it holds, where it is stored, who can access it, and which outside services it relies on. NIST recommends keeping an inventory of important devices, software, data, and suppliers, and tracking the legal, regulatory, and contractual security requirements that apply.

An inventory helps a small business decide which protections deserve attention first. Email, cloud storage, and online banking are good places to start because they can expose sensitive files or money if an account is taken over. NIST recommends enabling multifactor authentication on sensitive accounts, choosing phishing-resistant options where available, and using strong, unique passwords. It also advises using a standard user account for everyday work rather than staying logged in with administrative privileges. Keeping software updated is important for the same reason, as outdated or unsupported programs may leave known security weaknesses unaddressed.

NIST also recommends protecting backups, testing that they can be restored, and keeping at least one copy disconnected from the device. Ransomware can encrypt files on a computer and reach backups that remain connected. An offline copy is less exposed, but it still needs to be tested. A backup that cannot be restored will not help the business recover.

In addition, NIST recommends that small businesses monitor for signs of suspicious activity and prepare an incident response plan before an attack occurs. The guide suggests keeping contact information for legal counsel and incident response professionals in a paper copy and describes steps such as isolating affected devices and checking backups and account settings before restoring systems.

A small business may not always have a dedicated security team, but it still needs clear answers to three questions: what information matters most; how it would recover that information; and who must be contacted if it is exposed. NIST’s guide gives owners a framework for answering them before an incident.

This post was co-authored by William J. Egan, partner in Robinson+Cole’s Litigation group.

In D’Antonio v. Tripadvisor, LLC, Case No. 2684CV00331 (Mass. Super. Ct. Aug. 31, 2026), a Massachusetts Superior Court dismissed a California Invasion of Privacy Act (CIPA) claim over Tripadvisor’s alleged use of a third-party advertising tracker. The plaintiff alleged that the Casale Media tracker collected IP addresses, device metadata, and unique identifiers, matched them to consumer profiles, and shared or sold the resulting information without consent. The court did not decide whether those alleged practices violated CIPA; it held that Tripadvisor’s Terms of Use selected Massachusetts law, which barred the plaintiff from pursuing the claim under California law.

The court relied on the earlier California court’s finding that the plaintiff had entered a valid contract through Tripadvisor’s online registration process. It also concluded independently that Tripadvisor gave reasonable notice of its Terms of Use and that the plaintiff manifested assent by proceeding through two registration screens displaying, “By proceeding, you agree to our Terms of Use.” Because plaintiff’s counsel acknowledged that the claim could not be reframed under Massachusetts law, the court dismissed the complaint with prejudice.

The decision highlights the potential value of well-drafted choice-of-law and forum-selection provisions, while underscoring that their enforceability depends on the circumstances, including the state’s connection to the transaction and the clarity of the online assent process. It does not eliminate CIPA exposure or resolve the merits of website-tracking claims; instead, it illustrates how contractual terms and litigation strategy can shape where and under what law those claims proceed. Companies should review their registration flows to confirm that terms are clearly presented, that users’ affirmative actions are tied to assent, and assess whether their choice-of-law and forum provisions fit their operations and customer relationships.

Two California drivers have filed a class action against Axon Enterprise, alleging that the company’s automated license plate reader (ALPR) network tracks and stores California residents’ movements without the privacy disclosures state law requires. The complaint states that Axon’s fixed and police-vehicle cameras capture license plates, locations, timestamps, and vehicle characteristics, and then combines this information with other camera feeds and makes it searchable through its Evidence and Fusus software.

At the center of the case is California’s Automated License Plate Reader Privacy Act. Plaintiffs allege that Axon, as both an ALPR operator and end user, failed to implement and conspicuously post a required usage and privacy policy. According to the regulation, the privacy policy must address topics including authorized uses, access, sharing, security, data accuracy, and retention. The complaint also asserts claims for invasion of privacy under the California Constitution and intrusion upon seclusion, arguing that aggregating location records over time can reveal intimate details of a person’s life.

The plaintiffs seek to represent a class of people whose ALPR information was collected in California and processed or stored by Axon from November 3, 2023, onward. They request class certification, injunctive relief, and actual, liquidated, and punitive damages, among other remedies. For companies that operate surveillance technologies or provide the platforms that store and analyze the resulting data, the suit is a reminder that privacy compliance may turn not only on what customers do, but also on the vendor’s own role in collecting, accessing, and managing information, and on whether required disclosures and controls are in place.

A California federal court has allowed two privacy claims against Sony to proceed in litigation over allegations that its smart TVs used automatic content recognition technology to collect viewers’ viewing data and share it with third parties. The court dismissed 15 of the 17 claims, with leave to amend, but found the alleged collection and broad dissemination of sensitive viewing information sufficient at this stage to support claims for invasion of privacy and public disclosure of private facts.

The ruling also rejected Sony’s effort to compel arbitration, concluding that the limited warranty included with the TVs did not give consumers fair notice that using the device could bind them to arbitrate claims. For companies deploying connected-device technologies, the decision is a reminder that privacy litigation can turn on both the details of what data is collected and shared and the clarity of the notice and assent process. The court’s conclusions remain tied to the allegations and procedural posture of this case; most claims were dismissed, and the plaintiffs were permitted to amend. Read the full decision.

A proposed class action against Allegheny Health Network (AHN) puts patient consent practices for AI documentation tools under scrutiny. The complaint alleges that patients were told an AI tool would be used during appointments but were not told that their conversations would be transmitted to Abridge AI or could be retained for the company’s commercial purposes. It further alleges that AHN did not adequately disclose those uses.

The case highlights a practical challenge for healthcare organizations adopting ambient AI: disclosure should explain what is recorded, who receives the information, and how it may be used, not simply that an AI tool is involved. The plaintiff alleges that patient encounters contributed to Abridge AI’s proprietary data and asserts claims under Pennsylvania wiretapping law, physician-patient confidentiality, privacy, implied contract, and unjust enrichment.

For healthcare organizations and technology providers, this case is a reminder to review the full lifecycle of patient data used in AI documentation: what the tool captures, where data goes, how long it is retained, and whether it may be used to develop or improve products. Review patient-facing notices and consent workflows alongside vendor contracts and internal practices and make sure that any option to decline the tool is clear and workable in practice. Those steps can help align what patients are told with how the technology operates.

Consumer Reports (CR), Aspen Digital, and the Global Cyber Alliance recently released the fifth annual Consumer Cyber Readiness Report for Cybersecurity Awareness Month. The report explores how American consumers perceive and manage digital security and offers new insights into the rise of digital scams and fraud.

A CR survey of 4,682 U.S. adults conducted in March and April 2026 found that 9 in 10 American consumers had encountered at least one digital scam or attempted cyberattack. Of those who were victims, 17% percent lost money to scams: 10% permanently and 7% temporarily, with money recovered in some cases.

A separate CR survey of 2,082 U.S. adults in May 2026 found a sharp decline in confidence in personal data privacy. Only 32% were at least somewhat confident that information such as their Social Security number, health history, and financial details remained private, compared with 48% in a nationally representative survey of 2,333 U.S. adults in May 2025. Those who were “not confident at all” nearly doubled, from 16% to 29%.

CR noted that AI is making cyber fraud faster, cheaper, and more personalized. The survey showed that one in five consumers who had encountered a scam attempt (20%) reported that the most recent scam attempt they encountered was customized using their personal details. Phone calls were the most common technique used, with a third of those surveyed saying their most recent scam attempt began with a phone call and was personalized to them.

Vishing continues to be a real threat to both individuals and businesses. (insert previous blog articles about vishing here). When 9 out of 10 Americans have been the target of cyber fraud, a third are related to a social engineering attack, and AI is used to accelerate and personalize the attacks, it is imperative that individuals are aware of the threat and protect themselves against it.

Here are some solid tips to protect yourself from a targeted cyber-attack through the use of vishing techniques: https://blog.defend-id.com/2026/05/27/vishing-attacks/

My buddies at CrowdStrike have uncovered a campaign launched by threat actor VAPOR PANDA starting on October 17, 2026, where ARTEX (an AI-powered penetration testing tool developed in China) is used with the Chinese-developed DeepSeek LLM to attack “more than 200 distinct organizations worldwide, including foreign ministries in Latin America, Europe, Asia, and the Middle East; semiconductor, defense, and think tank organizations in the U.S.; and telecommunications providers in multiple regions.”

According to the CrowdStrike researchers, they observed an ARTEX controller linked to VENDOR PANDA infrastructure direct exploitation activity “against entities in at least 14 countries over an 11-day window.” This included “19 U.S.-based organizations in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors.” CrowdStrike confirmed that VENDOR PANDA was able to gain access, deploy malware, conduct credential spraying, network scanning, and reconnaissance.

What was different about this campaign was the speed and scope of the operation. In this campaign, the AI agents used the pen testing tools to run multiple engagements that allowed the agents to pursue “multiple attack paths in parallel, spanning web applications, cloud services, container environments, Active Directory, and mail and VPN infrastructure. They shifted to alternative approaches when a path failed. This breadth likely enables a single operator to apply a wider range of techniques against more targets at once than would be feasible through manual operations.”

The use of ARTEX allowed the threat actors to attack more targets at a faster speed than seen before. CrowdStrike posits that the use of ARTEX, paired with commercially available LLMs will allow “small teams to quickly scale intrusions across many targets simultaneously.”

CrowdStrike recommends:

  • Rotate signing keys, preauthentication keys, and service credentials after any suspected data exposure, including keys contained in historical backups and directory exports.
  • Enforce SAML signature validation, require IMDSv2, and restrict cloud roles’ command-execution permissions to the minimum required instances.
  • Hunt for ARTEX markers, including command-line parameters containing artx or artex strings, artx-prefixed cloud roles, art18- administration-command comments, and the C:\ProgramData\artx5v\ directory.
  • Patch internet-facing appliances, particularly long-lived Linux-based servers, and ensure they run the latest available software and firmware.
  • Deploy an advanced, real-time endpoint detection and response (EDR) agent, such as the CrowdStrike Falcon sensor, across the environment, including on servers considered inaccessible from the public internet.

CrowdStrike published the indicators of compromise, which should be reviewed and blocked by IT professionals.

On October 29, 2026, General Motors (GM) agreed to pay $220 million to 35 state Attorneys General over allegations that its Smart Driver program associated with its OnStar service violated the privacy of users. The AGs alleged that GM illegally sold drivers’ private location and driving behavior data to brokers without users’ consent, who then sold it to insurers that allegedly used it to set and increase auto insurance rates.

The complaint against GM included allegations that the data collected and sold included: “huge volumes of consumer driver behavior information, such as hard braking, hard acceleration, hard cornering, crossing of a designated high-speed threshold, seat belt usage, late night driving, and trip time and duration for such events.” Through the OnStar program, GM also collected “precise geolocation data linked to identifiable personal information, including name, address and Vehicle Identification Number.” The geolocation data included latitude and longitude, elevation, speed and a trip identifier that could tie together to “identify the entire route of a specific trip taken by a single vehicle.” Precise geolocation data was collected every three seconds from the time the user turned the vehicle on until the ignition was turned off. The complaint alleged that GM’s enrollment process failed to disclose the sale of their data and “contradicted its representations … that it would only share anonymous driving data with insurance companies. In reality, GM sold the identifiable driving data of all Smart Driver participants” to third parties for its repackaging and sale to insurance companies. The complaint alleges that GM made over $20 million from the sale of the data.

In addition to the settlement amount, the Consent Decree provides that GM agrees to limit the driving data that it collects, obtain express consent from drivers before collecting or sharing the data, develop, implement and maintain a comprehensive information privacy program for the collected driver data, including being transparent with drivers about the collection, use and sale of driver data, employ a Chief Privacy Officer, perform data protection assessments when engaging in a new high risk processing activity, implement data minimization efforts, provide consumers with a transparent privacy notice, and obtain express consent prior to collecting or using driver data. All of these items are solid measures to employ when collecting the type of data that is the subject matter of the settlement.

This settlement follows GM’s prior agreement to pay California $12.7 million to settle an investigation into its alleged sale of driver data to data brokers, and a January 2025 settlement with the Federal Trade Commission to refrain from disclosing vehicle geolocation and driver behavior data to consumer reporting agencies.

Drivers should be aware that their cars are collecting large amounts of very specific data about the functionality of the car, and the behavior of the driver. Be sure to read the privacy policies of the manufacturer so you are educated about the data collected, and used on your vehicle and your driving behavior, and make informed consent prior to the collection and use of that data.

On October 22, 2026, Pennsylvania Governor Shapiro signed the Artificial Intelligence Deceptive Advertising Act, setting disclosure rules for AI ads in the state.

The Act defines “synthetic content” broadly to include images, video, audio, or text significantly modified or generated by AI. It prohibits advertisers from knowingly, recklessly, or willfully creating or disseminating ads that use such content to create a false impression about a product’s or service’s nature, origin, or authenticity, unless the ad includes a clear and conspicuous disclosure.

The disclosure must identify the content as AI-modified or AI-generated, appear the first time consumers encounter it, and be provided in the same format as the synthetic content. Where technically feasible, it must also be “permanent or extraordinarily difficult to remove.” The disclosure must be understandable in the language or other interaction the consumer uses, consistent with the ad, and, depending on its format, audible or readable. There are several exemptions, including for fictional depictions, parody, satire, commentary, and criticism. Ads limited to text are also excluded from the disclosure requirement, even if the text was generated or significantly modified by AI.

The Act takes effect December 21, 2026. The Attorney General or a district attorney may seek an injunction or bring a civil action. A court may impose a civil fine of up to $3,000 for a violation.

For organizations using AI for advertising, the risk arises when an ad could mislead consumers. A synthetic product image could raise concerns if it misrepresents the offering, and a disclosure may still fall short if consumers are unlikely to notice it or if it conflicts with the ad’s message. Review will be especially important for realistic synthetic media that could be mistaken for a genuine product, person, or endorsement.