Category: Security & Privacy

Fintech company Marquis has disclosed plans to pursue compensation from its firewall provider SonicWall, attributing a 2025 data breach to vulnerabilities stemming from SonicWall’s own security incident. According to a memo shared with customers and reviewed by TechCrunch, Marquis asserts that the ransomware attack it experienced in August 2025 was facilitated by hackers exploiting security information exposed in SonicWall’s breach. The breach at SonicWall reportedly provided hackers with the credentials necessary to execute the ransomware attack on Marquis.

Marquis’ investigation revealed that the hackers leveraged data obtained from SonicWall to bypass its firewall protections. Notably, Marquis had stored a backup of its firewall configuration file in SonicWall’s cloud. As a response to the breach, Marquis is considering its next steps regarding its firewall provider, with a focus on recovering any costs incurred by the company and its clients in addressing the breach.

When approached for comment, a representative for Marquis did not contest the assertions made in the customer communication but reiterated the connection between Marquis’ breach and the earlier compromise of its firewall configuration by a threat actor who gained unauthorized access to SonicWall’s cloud backup service.

Source: TechCrunch

The acting head of the U.S. Cybersecurity and Infrastructure Security Agency (CISA), Madhu Gottumukkala, reportedly uploaded sensitive government documents to ChatGPT, a large language model. The documents, marked ‘for official use only,’ triggered security warnings meant to prevent data theft or disclosure from federal networks. This revelation, as reported by Politico, raised concerns within the Department of Homeland Security about potential risks to government security.

While Gottumukkala was granted an exception to use ChatGPT, the act of feeding unclassified but internal government data into a public AI model like ChatGPT poses significant issues. By allowing the model to train on such information, there’s a risk that the contents could be inadvertently shared with others. This incident underscores the challenges of balancing convenience with data security, especially in high-stakes government environments.

A CISA spokesperson mentioned that Gottumukkala’s use of ChatGPT was temporary and restricted. Prior to his role at CISA, Gottumukkala faced scrutiny for failing a counterintelligence polygraph, leading to the suspension of six career staff from accessing classified information.

Source: TechCrunch

Google has unveiled a range of new security features for Android devices, aiming to reduce theft incidents and enhance user protection. These updates, including reinforced authentication measures and improved recovery tools, build upon the existing Theft Detection Lock and Offline Device Lock functionalities introduced in 2024.

While iPhones have traditionally been prime targets due to their high resale value, Android smartphones, especially premium models like the Google Pixel Pro and flagship foldables from brands like Samsung, are also vulnerable to theft.

One notable addition is the enhanced Failed Authentication Lock feature, allowing users on Android 16 and above to control the automatic device lock after numerous failed login attempts through a dedicated toggle switch in the device settings. The update also extends protection against PIN, pattern, or password guessing by prolonging the lockout duration post multiple failures. Moreover, Identity Check now covers all biometric-based features and apps, such as banking applications and Google Password Manager, for devices running Android 15 and newer.

For added security, the Remote Lock tool now offers an optional security challenge or question when locking a misplaced or stolen device via a web browser, ensuring that only the legitimate owner can trigger the lock. In Brazil, two theft protection features will be activated by default, including Theft Detection Lock, which leverages on-device AI to detect suspicious movements indicative of a snatch-and-run theft, and Remote Lock accessibility through android.com/lock.

Source: TechCrunch

WhatsApp, owned by Meta, has introduced a new security feature called Strict Account Settings to protect users from cyber threats. This move follows legal action against Meta regarding alleged privacy misrepresentations involving WhatsApp. The feature imposes stringent measures such as blocking media from unknown senders, muting calls from unfamiliar numbers, disabling link previews, and enabling the blocking of numerous unknown messages.

With Strict Account Settings active, users automatically enable two-step verification and receive security notifications for any changes in chat partner codes. Additionally, the privacy control restricts the visibility of last seen status, online status, profile photo, about details, and profile links to only contacts. Moreover, users can now limit group additions to pre-approved contacts or selected individuals.

Meta describes this feature as a security enhancement designed to reduce users’ susceptibility to cyber attacks by restricting account functionality. The company emphasizes that this upgrade, beneficial for journalists and public figures, will gradually roll out in the upcoming weeks.

To activate Strict Account Settings, users can navigate to Settings > Privacy > Advanced. Notably, changes to this setting are only permitted from the primary device, not companion platforms such as WhatsApp for Web or Windows.

Source: TechCrunch

Aylo, the parent company of popular tube sites including Pornhub, has announced its decision to restrict access to its platforms in the United Kingdom starting February 2. This move comes in response to the UK’s Online Safety Act (OSA), which requires websites with adult content to verify the ages of visitors to prevent minors from accessing inappropriate material.

Instead of complying with the age verification mandates, Aylo has opted to block access to platforms like Pornhub in the UK. However, users who have already verified their identity will retain access to their accounts. The company stated that it believes the OSA has not been successful in its aim to restrict minors’ access to adult content, leading to increased traffic on unregulated parts of the internet and potentially compromising the privacy of UK citizens.

Ofcom, the UK regulator overseeing OSA enforcement, refuted Aylo’s claims, emphasizing that porn services can choose to implement age checks or block access. Ofcom encouraged the industry to develop effective device-level solutions for age verification.

Age verification technology remains a contentious issue globally, with concerns raised about its impact on adult privacy despite its child safety objectives. The clash between regulatory requirements and privacy considerations continues to spark debate within the tech community.

Source: TechCrunch

Google has agreed to pay $68 million to settle claims that its voice assistant unlawfully intercepted and recorded users’ confidential communications without consent, according to Reuters. The class-action lawsuit alleged that Google used the recorded information for targeted advertising and other purposes without authorization.

The case revolved around the issue of ‘false accepts,’ where Google Assistant reportedly recorded users’ conversations even without a wake word trigger. Google did not admit any wrongdoing in the settlement, but emphasized the importance of user privacy and consent in voice assistant technology.

This settlement highlights the growing concern over privacy in voice-activated devices. In a similar incident, Apple previously settled a $95 million lawsuit over allegations that Siri had recorded conversations without user initiation.

Tech companies continue to face legal challenges regarding privacy practices. Last year, Google paid $1.4 billion to Texas to resolve lawsuits related to data privacy violations. These cases underscore the need for stringent privacy regulations and transparency in how tech companies handle user data.

Source: TechCrunch

The Trump administration has prioritized immigration control, leading to a significant increase in deportations by Immigration and Customs Enforcement (ICE) and Customs and Border Protection. ICE has been utilizing various technologies to aid in identifying and monitoring individuals targeted for deportation, sparking debates on privacy and legal boundaries.

One key technology ICE employs is cell-site simulators, also known as ‘stingrays.’ These devices mimic cell towers to intercept phone signals, allowing authorities to track phones, intercept calls, and monitor internet activity. ICE has signed contracts for specialized surveillance vans from TechOps Specialty Vehicles (TOSV) to support their operations.

By leveraging these technologies, ICE has intensified its efforts to locate and remove undocumented individuals, resulting in widespread protests and legal challenges. The use of such tech tools raises concerns about privacy violations and constitutional rights.

Source: TechCrunch

The London High Court has ruled in favor of Ghanem Al-Masarir, a Saudi satirist and human rights activist, awarding him more than £3 million in damages after determining that his phone was hacked using government-grade spyware. Al-Masarir, known for his critical content on Saudi Arabia, alleged that his phone was targeted with Pegasus spyware, a tool typically sold to governments for surveillance purposes. The court also found evidence linking the Saudi government to a physical assault on Al-Masarir in London, coinciding with the hacking incident.

Real-world attacks like the one on Al-Masarir are often accompanied by digital surveillance tools such as Pegasus, underscoring the intersection of physical and digital threats faced by activists. Despite facing legal challenges and claims of state immunity from Saudi Arabia, the High Court held the Saudi government accountable for the hacking and assault against Al-Masarir.

This case highlights the use of sophisticated spyware technologies by governments for surveillance and potential targeting of dissenting voices. The ruling sets a precedent for holding state actors responsible for cyber intrusions and physical attacks on individuals, emphasizing the need for robust privacy protections and accountability measures in the digital age.

Source: TechCrunch