The Facts

International · Company incident notice

Hugging Face reported unauthorized access to Spaces and suspected that some stored secrets could have been accessed. It revoked affected tokens, advised rotating keys, and reported the incident to authorities.

United Kingdom · joint investigation with Canada · Regulatory fine

Following the 2023 cyberattack, the ICO found inadequate safeguards for UK users’ information. The joint investigation with Canada examined weaknesses allowing attackers using reused credentials to access sensitive data.

France · Regulatory fine

The CNIL sanctioned Clearview AI for collecting facial images without a lawful basis and for failures concerning people’s rights. It ordered an end to unlawful processing and deletion of the relevant data concerning people in France.

United States · FTC consent order

The FTC alleged that Avast collected and sold browsing information through Jumpshot despite privacy promises. The finalized order prohibits selling or licensing browsing data for advertising and requires deletion of certain data and derived products.

United States · FTC consent order

The FTC alleged that BetterHelp disclosed identifiers and health questionnaire information to advertising platforms despite privacy promises. Its final order bans sharing health information for advertising and requires stronger privacy safeguards.

United States · Court-approved settlement

The FTC sued Ring over excessive employee access to videos and security failures enabling account takeovers. The settlement required deletion of certain videos and stronger safeguards. The FTC’s refund page documents further payments in July 2026.

Canada · federal, Québec, British Columbia, Alberta · Joint investigation findings

Four privacy authorities found that the app collected detailed location information even when it was not open, with misleading consent. Tracking stopped in 2020. The company accepted recommendations to delete remaining data and improve its privacy program.

International service · Company incident notice

Vercel reported that an attacker used a compromised Context.ai account to access internal systems. A limited subset of customers was affected. The bulletin describes exposure of environment variables not marked as sensitive and remediation steps.

International service · Company investigation update

Mercor attributes its March incident to the LiteLLM supply-chain compromise. In June, the company reported that sensitive information concerned a very limited subset of experts and that its investigation found no employee data affected. These are the company’s findings.

International service · Company response to a vulnerability report

After a researcher’s report, McKinsey confirmed that a vulnerability in Lilli had been fixed. The company says its investigation found no evidence that the researcher or another unauthorized party accessed client data. A vulnerability alone does not establish a mass leak.

United States · Southern District of New York · Civil litigation · procedural order

Authors have brought copyright claims concerning AI training. The federal court’s published order in consolidated case 25-md-3143 addresses discovery issues. Such an order is not a final judgment that all alleged infringements occurred.

France · Regulatory fines

After the October 2024 attack, the CNIL found inadequate security and shortcomings in breach notifications. Compromised data concerned approximately 24 million subscriber contracts; contracts should not be confused with distinct people.

United States · District of Minnesota · Civil litigation · court order

The February 2024 cyberattack led to consolidated litigation. A December 2025 federal order records the defendants’ estimate of 192.7 million affected people. The figure is attributed to that estimate; the order does not mean the litigation or compensation process was completed.

Ireland · European Economic Area · Regulatory fine

Ireland’s Data Protection Commission found infringements concerning transfers of EEA users’ data to China and the information provided to users. Its decision imposed corrective measures alongside a financial penalty.

Australia · Regulator’s preliminary inquiries concluded

The 2025 incident affected approximately five million Australians through an overseas contact-centre supplier. In July 2026, the OAIC concluded preliminary inquiries without evidence indicating a likely privacy-law breach by Qantas, and did not open a full investigation.

France · Regulatory fine

The CNIL sanctioned Google over advertisements inserted between Gmail messages without prior consent and cookies placed during account creation. This case concerns those specific consent practices.

Ireland · European Union · Regulatory fine

The DPC found infringements of lawfulness, fairness and transparency in processing personal data for behavioural analysis and targeted advertising. This decision concerns those practices, not a finding that LinkedIn illegally scraped millions of profiles.

Ireland · European Union · Regulatory fines

The DPC’s decisions concern a 2018 vulnerability allowing unauthorized access to approximately 29 million Facebook accounts worldwide. They address breach notification and data protection by design. This is a different case from Cambridge Analytica.

United States · Texas · Civil settlement

Texas sued Meta over facial geometry captured through Facebook’s photo-tagging system, alleging violations of state biometric privacy law. The parties reached a settlement recorded in an agreed final judgment.

Ireland · European Union · Regulatory fine

The DPC examined information given to users and non-users about processing personal data, including sharing within the Facebook group. It found transparency infringements. This decision does not establish a backdoor in message encryption.