A recent federal decision shows how data-breach claims can turn on the connection between the exposed information and the alleged harm. In Volio v. Sugarhouse HSP Gaming, L.P., No. 2:25-cv-00039 (E.D.Pa. Aug. 7, 2026), current and former employees and casino patrons sued after Rivers Casino Philadelphia allegedly discovered unauthorized access to its network and
Data Breach
Doxim Data Breach Settlement Underscores Third-Party Data Security Risk
By Roma Patel on
Posted in Enforcement + Litigation
On May 5, 2026, the parties in In re Doxim, Inc. Data Security Incident Litigation (E.D. Mich. June 13, 2024), filed a proposed $5.5 million class action settlement arising from a cyber incident involving Doxim, a software provider serving credit unions, wealth management service providers, and banking sectors in the United States and Canada.
Doxim…
Privacy Tip #487 – Eurail Notifies 300,000+ Individuals of Data Breach
By Linn Foster Freedman on
Posted in Privacy Tips
I have very fond memories of using a Eurail pass back in the day while backpacking through Europe as a student. I was saddened to see that Eurail was the victim of a data breach in December 2025 when attackers obtained access to travelers’ full names and contact information, including email addresses, passport details, ID…
Expel Annual Threat Report Shows Identity Compromise Continues to Be Threat Actors’ Favorite Tool
By Linn Foster Freedman on
Posted in Cybersecurity
Cybersecurity firm Expel recently published its 2026 Threat Report, which analyzed over 1,000,000 alerts in its Security Operations Center throughout 2025. The results showed that threat actors continue to use compromised credentials to gain access to company systems. The Report highlights the need for companies to educate their employees on an ongoing basis of how…
No Good Deed Goes Unpunished: Victim Stryker Sued for Iranian-Backed Cyber Attack
By Linn Foster Freedman on
Posted in Enforcement + Litigation
As we reported last week, Stryker was attacked by Iranian-backed hackers in retaliation for Israeli and U.S. strikes against Iran. It was a significant cyberattack, known as a wiper attack. A wiper attack is designed not to extort money from a victim, but instead to send a message and destroy the victim’s data to…
Privacy Tip #482 – ShinyHunters Hits Wynn Resorts
By Linn Foster Freedman on
Posted in Privacy Tips
ShinyHunters continues to wreak havoc against well-known brands; most recently, Wynn Resorts. Wynn Resorts has confirmed that “an unauthorized third party acquired certain employee data.” It is believed that the threat actor was ShinyHunters. Fortunately for Wynn, the incident is not affecting its operations, and its resorts remain fully functional.
ShinyHunters announced it was the…
Privacy Tip #474 – TransUnion Breach Affects 4.4 Million Individuals
By Linn Foster Freedman on
Posted in Privacy Tips
TransUnion has announced that attackers gained unauthorized access to a third‑party application used in its U.S. consumer support operation that is reported to be linked to a broader wave of attacks targeting Salesforce‑connected applications across major industries.
The breach affected more than 4.4 million individuals, but TransUnion emphasized that its core credit reporting systems were…
Auto Credit Check Company Breach Affects 5.6 Million
By Linn Foster Freedman on
Posted in Cybersecurity
700Credit, a Michigan-based company that runs credit checks and identification verification services for automobile dealerships nationwide, has announced that an “integrated partner” was compromised, allowing a bad actor to obtain unauthorized access to its network of information about individuals whose credit the company checked. The incident was discovered on October 25, 2025.
Michigan officials confirmed…
Adidas and UChicago Sued Over Data Breaches Caused by Third-Party Vendors
By Kathryn Rattigan on
Posted in Enforcement + Litigation
What do a global sportswear giant and a prestigious medical center have in common? Apparently, a shared struggle defending data breach lawsuits for breaches of sensitive personal information caused by third-party vendors.
This week, Adidas America and the University of Chicago Medical Center found themselves on the receiving end of data breach lawsuits. The plaintiffs…
FTC Order with GoDaddy Finalized Over Lax Data Security
By Linn Foster Freedman on
Posted in Enforcement + Litigation
On May 21, 2025, the Federal Trade Commission (FTC) finalized its order with GoDaddy over allegations that GoDaddy “failed to implement standard data security tools and practices to protect customers’ websites and data.” In a Complaint filed against GoDaddy in January 2025, the FTC alleged that the company had “failed to implement reasonable and appropriate…