Right To Know - October 2026, Vol. 46

Cyber, Privacy, and Technology Report

Welcome to your monthly rundown of all things cyber, privacy, and technology, where we highlight all the happenings you may have missed.

View previous issues and sign up to receive future newsletters by email here. 

Litigation & Enforcement: 

• OpenAI Sued for Rogue AI Agents: On Sept. 29th, the non-profit organization Legal Advocates for Safe Science and Technology (“LASST”) sued OpenAI in California State Court over OpenAI’s agents accessing another company’s (Hugging Face’s) systems without authorization. The complaint alleges that OpenAI knew about the AI agents’ activities and violated California’s Unfair Competition Law. The complaint seeks injunctive relief and attorneys’ fees. 
• Arizona Appeals Court Vacates Sentence That Relied on AI Video of Victim: On Sept. 30th, the Arizona Court of Appeals vacated the sentence of Gabriel Horcasitas who was convicted of manslaughter in a road rage incident. Horcasitas was sentenced to 10.5 years for the manslaughter charge and challenged his conviction and sentence. With respect to sentencing, the trial court was presented with, and relied on, an AI generated video that depicted the deceased victim talking to the court. In announcing the sentence, the trial court specifically referenced the AI video, including stating “I loved that AI.” The appellate court vacated the sentence finding the AI video, which did not depict any actual events, was so prejudicial that it rendered the sentencing unfair.  
• New CIPA/CMIA Decision: In Doe v. Adventist Health System/West, patients alleged that Adventist Health used Meta Pixel and Google Analytics on its health-risk assessment websites and patient portal to transmit users’ information and online activity to Meta and Google without consent, in violation of CIPA and CMIA. The trial court denied class certification, finding that liability would require individualized inquiries into what information each patient transmitted and whether that information qualified as protected communications or medical information. The California Court of Appeal reversed in part, holding that several claims, including the surviving CIPA § 631 claim, could potentially be proven using common technical evidence regarding the operation of the tracking technologies and the information uniformly transmitted to third parties. The court therefore remanded for further certification proceedings. However, it affirmed denial of certification for the patient-portal CMIA claim because plaintiffs had not shown that all portal users necessarily transmitted protected medical information. 
• Dartmouth Pays $750,000 Following Oracle Breach: Dartmouth College agreed to pay $750,000 to settle a class action lawsuit arising from a massive 2025 data breach involving Oracle’s E-Business Suite software, which the college used for payroll, human resources, accounting, and other administrative functions. The lawsuit alleged that Dartmouth failed to adequately protect the personal information of more than 96,000 individuals, including Social Security numbers and bank account information, after a cyberattack linked to the Clop ransomware group exploited a previously unknown zero-day vulnerability in Oracle’s software. Under the proposed settlement, affected individuals may either claim up to $5,000 for documented losses related to the breach or receive an estimated $75 cash payment without documentation, and they are also eligible for two years of credit-monitoring services. Dartmouth denied any wrongdoing and stated that the settlement does not constitute an admission of liability. A final court hearing on the settlement is scheduled for November 2026.  

Industry Updates:

• Qilin Leaks Law Enforcement Files Stolen from the ATF: A cybercriminal group believed to be operating out of Russia published files that appear to have been stolen from the Justice Department’s Bureau of Alcohol, Tobacco, Firearms and Explosives. The ransomware gang Qilin had earlier taken credit for the breach and began posting the data to its dark web leak site that Monday. A review by CNN and independent researcher Ron Fabela found material on subjects of past ATF investigations, analyses of their phone communications, and files tied to specific agents and prominent cases involving armed robbery, arson, explosives and homicide, with a significant share linked to the Houston Field Division. The agency had disclosed the intrusion the prior week as a “major” incident requiring notice to Congress. 
• NIST Finalizes Identity and Access Token Security Guidance: On Sept. 15th, the National Institute of Standards and Technology (NIST), in collaboration with the Cybersecurity and Infrastructure Security Agency, finalized NIST IR 8587, “Protecting Tokens and Assertions from Forgery, Theft, and Misuse,” which addresses security risks affecting identity and access tokens in cloud environments and digital identity systems.
  Identity and access tokens authenticate users and authorize access to email, cloud applications, and enterprise systems. They underpin modern cloud services, single sign-on, and zero trust architectures by allowing access without repeated authentication. If compromised, however, they can give threat actors the same access as legitimate users. NIST highlights a recent incident in which attackers used forged tokens tied to a stolen signing key to access federal agency email systems and steal more than 60,000 emails from one agency.
  The guidance applies to cloud service providers and their customers and sets out principles and implementation considerations to reduce token forgery, theft, misuse, and unauthorized access. 
  NIST IR 8587 reflects growing regulatory and industry attention to identity-based attacks and token security. Organizations using cloud authentication, single sign-on, or federated identity services should review their token management practices to guard against theft, forgery, and misuse. The NIST guidance provides a benchmark for strengthening identity security controls across public- and private-sector environments.
• Aesto Health Data Breach Exposes Information of 9.5 Million Individuals: Aesto Health, a healthcare technology company that provides data migration, electronic health record exchange, and legacy data archiving services, reported that a cyberattack affected more than 9.5 million individuals. The incident involved unauthorized access to portions of Aesto’s Amazon Web Services environment between Dec. 2nd and Dec. 18th, 2025. Following a forensic investigation, Aesto determined that an attacker may have acquired protected health information and personally identifiable information, including names, dates of birth, Social Security numbers, driver’s license numbers, financial account information, medical information, health insurance information, and taxpayer identification numbers. The company reported 9,540,683 affected individuals to the U.S. Department of Health and Human Services. At least two dozen healthcare provider clients were affected by the incident.  
• WeChat Vulnerability Used, AI, to Allow Zero-Click Access: After finding a vulnerability in the popular communications platform, WeChat, research group, Calif, developed WeWorm, a zero-click worm that exploited a memory-corruption vulnerability in WeChat’s VoIP system to spread between iOS and Android devices. By simply calling a contact, an attacker could take over the victim’s WeChat account without the victim answering or interacting with the phone, then use that compromised account to target additional contacts. Calif says its AI-assisted team discovered the vulnerability and developed working exploits and a cross-platform worm in a matter of weeks, highlighting how AI can accelerate sophisticated offensive-security research. WeChat was notified in July 2026 and subsequently mitigated the vulnerability through software and server-side fixes; Calif argues that the episode demonstrates both the risks posed by AI-enabled attackers and the potential for AI to help defenders discover and fix vulnerabilities more quickly. 
• FBI Confirms Investigation of fbijobs.gov Compromise: The FBI is investigating claims by hacking group ShinyHunters that it compromised the FBIJobs.gov portal and obtained sensitive personal information belonging to FBI employees and job applicants. The FBI has not determined whether the breach originated within its own systems or through a third-party provider and said it is working to mitigate potential risks. ShinyHunters claims to possess data on thousands of agents and applicants, though those claims have not been independently verified. The group also said it was offended by statements in a May FBI advisory describing ShinyHunters as a cybercriminal organization that uses real or exaggerated claims of access to sensitive information to pressure victims for payment and may falsely claim to possess compromising information. ShinyHunters demanded that the FBI retract those statements.  

Regulatory:

• TikTok Reaches a Settlement with Alabama Regarding Teen Usage: Attorney General Steve Marshall announced that Alabama reached a settlement with TikTok that will provide the state with at least $100 million, with the possibility of receiving up to $300 million if certain conditions are met. The settlement resolves Alabama’s lawsuit alleging that TikTok designed addictive platform features, exposed young users to mental health risks, and misled the public about the safety of its app. In addition to the financial payment, TikTok agreed to implement a series of child-safety measures, including a two-hour daily usage limit for minors, mandatory breaks during extended use, restrictions on overnight access, stronger age-verification requirements, enhanced parental controls, limits on adult interactions with teen accounts, a ban on cosmetic filters for teen users, and a default non-personalized content feed for minors. The agreement was reached just before Alabama was scheduled to become the first state to take TikTok to trial over these allegations, and state officials described the settlement as a significant step toward increasing protections for children and holding social media companies accountable for youth safety. 
• HHS OCR Reaches $700,000 HIPAA Settlement with Ambry Genetics Following Phishing Attack Affecting 225,000 Individuals: On Sept. 17th, HHS’ Office for Civil Rights announced a $700,000 settlement with Ambry Genetics Corporation following a HIPAA Security Rule investigation tied to a 2020 phishing attack that compromised an employee email account and potentially exposed the protected health information of 225,370 individuals. The information involved included names, addresses, dates of birth, identification numbers, financial information, diagnoses, lab results, medications, and treatment information. OCR identified potential compliance failures, including an inadequate risk analysis, insufficient procedures for terminating workforce access to electronic PHI, and failure to use unique user identification in systems containing ePHI. Under a two-year corrective action plan, Ambry must conduct a comprehensive risk analysis, implement a risk management plan, revise Security Rule policies and procedures, strengthen user identification controls, and provide workforce training.  

International Updates:

• South Korea Raises Data Breach Fines to 10% of Revenue: South Korea has raised the stakes for companies that mishandle personal data. Under revisions to the Personal Information Protection Act that took effect Sept. 11th, a company that intentionally or through gross negligence leaks the data of 10 million or more people can be fined up to 10 percent of total revenue, up from the prior cap of 3 percent of sales. The maximum applies to repeat intentional or grossly negligent violations within three years, or to breaches that follow a failure to comply with a corrective order. The rules also reward preparation, allowing reductions of up to 40 percent for sustained investment in privacy budgets, staff and equipment, and a separate reduction of up to 40 percent for early detection, prompt notification and containment.  
• Irish Regulator Fines Google €403 Million Over Location Data Practices: Ireland’s Data Protection Commission has fined Google €403 million (roughly $463 million US) after finding that the company violated the EU’s General Data Protection Regulation through its handling of location data. The investigation focused on Google’s “Web & App Activity,” “Location History,” and “Location Accuracy” features between 2018 and 2020. Although Google maintains that the case concerns historical policies and that it has substantially improved its location-data controls since 2019, the regulator ordered the company to bring its practices into compliance within six months. The penalty is the fourth-largest imposed by the Irish regulator, which has levied more than €4 billion in GDPR fines and is currently conducting three other investigations involving Google. 
• Rogue AI Attack by OpenAI Breaches Australian Medicare Statistics Portal: Australian Prime Minister Anthony Albanese recently addressed an incident in which an OpenAI AI agent gained unauthorized access to Australia’s public-facing Medicare statistics portal in June 2026. The agent had been conducting research into public medical spending but, after encountering access restrictions, found ways around them and accessed both public and non-public files, while reportedly also writing files to an internal server. At the time of the press conference, there was no evidence that personal Medicare information had been accessed or that the broader Services Australia network had been compromised, although a forensic investigation was still underway. Albanese criticized OpenAI for taking until Sept. 10th to notify the Australian Government and said the company acknowledged that its protocols had not been adequate. In response, the government established a taskforce to investigate the incident, consider potential law-enforcement and legislative responses, and use the findings to inform Australia’s planned AI standards, emphasizing the need for safeguards that keep humans in control of AI systems. 
• TikTok Accepts £12.7 Million Children’s Privacy Fine: TikTok has withdrawn its appeals and accepted a £12.7 million fine imposed by the U.K. Information Commissioner’s Office (ICO) for violations involving children’s personal data. The ICO found that TikTok allowed as many as 1.4 million U.K. children under the age of 13 to use its platform in 2020, despite its own rules prohibiting children under 13 from creating accounts. The regulator also found that TikTok failed to obtain parental consent for the use of their data and did not adequately identify and remove underage users. TikTok’s withdrawal of its appeals also allows the ICO to move forward with a separate investigation into the company’s use of children’s personal information in its recommendation systems.  

State Actions:

• Delaware Expands Privacy Law Requirements: On Sept. 2nd, Delaware enacted H.B. 380, significantly amending the Delaware Personal Data Privacy Act (DPDPA), with the changes taking effect on Jan. 1st, 2027. The amendments lower the law’s applicability thresholds, expanding coverage to additional small and mid-sized businesses. The law also imposes stricter requirements for the processing and sale of “sensitive data,” requiring such processing to be reasonably necessary and proportionate to disclosed purposes and limiting sales of sensitive data to circumstances where such disclosures are strictly necessary to provide requested products or services. In addition, HB 380 requires controllers to conduct reasonable due diligence of processors and third parties, implement specified contractual protections for data sharing arrangements, and respond to new consumer requests regarding disclosures of personal data to third parties. Organizations that process personal data of Delaware residents should evaluate whether the amended DPDPA applies to their operations and review their data governance, vendor management, contracting, and consumer rights processes before the Jan. 1st, 2027, effective date.  

This publication is intended for general informational purposes only and does not constitute legal advice or a solicitation to provide legal services. The information in this publication is not intended to create, and receipt of it does not constitute, a lawyer-client relationship. Readers should not act upon this information without seeking professional legal counsel. The views and opinions expressed herein represent those of the individual author only and are not necessarily the views of Clark Hill PLC. Although we attempt to ensure that postings on our website are complete, accurate, and up to date, we assume no responsibility for their completeness, accuracy, or timeliness.