Staying private, secure and free online: the tools, tactics and threats that actually matter.
A DHS data breach has exposed data on more than 41,000 Homeland Security staff, including CBP, ICE and CISA personnel, after the hacktivist group Department of Peace handed the trove to DDoSecrets, which published it as 'Icepick' on 28 October 2026. Here is what was leaked, who is behind it, how the data was obtained, and why it is not the Pentagon SSN breach.
Pentagon DMDC data breach: about 3 million service members, veterans and families exposed, Social Security numbers among the unencrypted data. Here is what to do.
An OpenAI engineer has been charged after a covert recorder was found hidden behind a TV in an executive conference room. Prosecutors are calling it a national-security matter. Here is the timeline of what allegedly happened, what the device was, and why an AI company getting bugged from the inside is a story worth watching.
Courts, immigration agents, hacker cons, pubs and cinemas have all moved against camera-equipped AI glasses in 2026, while regulators in Europe and the government in Australia weigh bans. Here is who has restricted Meta's Ray-Ban glasses, why, and whether they are legal to wear in public.
The Trezor data breach came through a shipping partner, ShipMonk, not Trezor's own systems, so your wallet and funds are safe. It exposed the personal details of around 80,000 customers, most with a home address and phone number. A phishing wave has already started; here is what leaked and how to stay ahead of the scams.
A dataset said to hold roughly 32.8 million records tied to Vogue, The New Yorker, GQ, WIRED and other Conde Nast titles was listed on a cybercrime forum for $15,000. It is alleged, not confirmed, the count is records not people, and it reportedly contains no passwords or card numbers. Here is what is actually being claimed, what a researcher checked, and why it still matters.
IDScan.net, an identity-verification company that holds what it says are more than 150 million driver's-licence records, has confirmed that an unauthorised party may have accessed or copied customer data on its cloud. The FBI is investigating. Sellers on a dark-web site advertised 153 million-plus documents, a figure the company has not confirmed. Here is what is known, what is only alleged, and what you can actually do.
Researchers say retail LG smart TVs logged microphone audio with the screen off and quietly scanned the home network to fingerprint nearby devices. Here is what the investigation actually showed, what is still unproven, and the settings that reduce what your smart TV collects.
An amended complaint against Meta and Luxottica adds a proposed class for bystanders it says were recorded by Ray-Ban smart glasses without consent, on top of the original false-advertising claims from buyers. Everything is an unproven allegation, and Meta says captured media stays on your device unless you share it. Here is what the case actually claims.
A little-known medical-data vendor, Aesto Health, has disclosed a breach affecting 9,540,683 people, the second-largest confirmed US healthcare breach of 2026 so far by HHS-reported totals. The intrusion happened in December 2025; the public disclosure is what is new now. Here is the timeline, why patients who never heard of Aesto are affected, and the standard steps to take.
On 25 August, Pennsylvania's attorney general sued Snap, accusing Snapchat of addictive design for minors and hiding how much adult content is on the app. It is one state's complaint that opens a case, not a ruling or a fine. Snap says the claims misrepresent its platform.
The US Justice Department said on 21 August that TikTok and ByteDance will pay up to $400 million to resolve a 2024 lawsuit accusing them of letting under-13s make accounts and collecting kids' data without consent, breaching COPPA. The deal adds age checks and requires no admission of wrongdoing.
Between 13 and 16 August, SafePal, Trezor's shipping partner ShipMonk, and Israel's Bits of Gold each disclosed breaches, exposing about a quarter-million customers' names, phones and shipping addresses. No wallets were drained, but the leaked addresses fuel targeted phishing and, for large holders, the physical 'wrench attacks' researchers say are rising.
Opening statements in the 29-state case against Meta began on 18 August in Oakland. After months of only Meta's $1.4 trillion worst-case figure, the states signalled they could seek around $200 billion, about three years of its profit. Meta calls the claims unsubstantiated; nothing is decided yet.
A cyberattack on MyDr, whose software is used by more than 12,000 Polish medical facilities, may have exposed the personal and medical data of nearly 19 million people, one of the country's largest ever incidents. Here is what officials have confirmed, what is still only claimed, and why one vendor breach reaches so many.
A coalition of 29 US states has taken Meta to federal court in California, with opening statements set for 18 August. Four states lead a case alleging the company engineered Instagram and Facebook to hook young users and played down the risks. Meta strongly denies the claims, which an advisory jury will weigh.
'Chat Control,' the EU push to scan private messages for child-abuse material, comes in two versions: a voluntary one survived a July vote, and a far-reaching mandatory one returns for a decisive autumn negotiation. At its heart is a hard question: can you scan everyone's messages without breaking the encryption that protects them?
Flock Safety's license-plate readers scan billions of cars a month into one searchable database used by thousands of police departments. In 2026 it emerged that federal immigration agents were tapping it without a contract or, critics say, a warrant. Here is how the network works, and why cities are now revolting against it.
From 3 August 2026, Google began using the IP addresses of users in the UK, EEA and Switzerland to identify their devices for ad targeting. A quiet but significant reversal: Google once said this tracking was wrong because, unlike a cookie, you cannot clear it. Here is what changed and what you can do.
Roughly half of US states and the UK now demand you prove your age, often with a government ID or a face scan, to reach legal content. Sign-ups for VPNs that sidestep the checks have surged. Here is what changed, why privacy experts are alarmed, and whether any of it actually works.
For a year and a half the British government has been trying to force its way into end-to-end-encrypted iCloud data. Apple is now challenging a second, quieter version of that order, and UK users have already lost their strongest protection in the process. Here is the honest state of the most important encryption fight in the world.
We ran the major providers as our only connection for six weeks and measured what matters: sustained speed, leak safety, and whether the no-log audits hold up. NordVPN won overall, Proton VPN is the value and free pick, Mullvad is the one for real anonymity.
The single most useful security tool you can install costs nothing, and the best one is open-source. Here are the free password managers worth trusting, the paid ones you can skip, and the big name to avoid outright.
A VPN does two genuinely useful things and gets sold as if it does ten. Here is the honest version: what it really hides, why it does not make you anonymous, and the tracking it cannot touch.
We ran the major VPNs against Netflix, Disney+ and BBC iPlayer to see which actually unblock, hold 4K without buffering, and keep working when the streaming services fight back. NordVPN won overall; ExpressVPN is the most consistent unblocker.