Privacy Rules, Ransomware Penalties and China-Linked Cyber Campaign Lead Security Updates
Summary
A roundup covers new employment-AI rules in Spain, GDPR enforcement after a ransomware breach, a China-linked campaign advisory, privacy guidance, AI risk research and Anthropic’s expanded cybersecurity access program.
Key points
- Spain’s AEPD clarified safeguards for AI in employment, including meaningful human review, transparency, and employer accountability.
- Sweden fined Miljödata SEK 1.8 million after a ransomware attack exposed data affecting about 2.2 million people; investigators cited an unverified vulnerable component and inadequate security monitoring.
- A joint advisory says China-linked actors used scanning, exploitation, credential attacks and legitimate tools to access organizations and steal email and Active Directory data.
- The UK ICO reported privacy improvements by foundation-model developers and opened a consultation on privacy risks from agentic AI.
- Canada updated guidance on consent, alternatives, safeguards and retention for businesses recording customer calls.
- An MIT study found limitations and bias in AI incident databases and cautioned that incident counts alone do not measure AI safety.
- Anthropic expanded its cybersecurity verification program with three access tiers for defense, authorized red-team work and specialized high-risk testing.
Article Details
- Event Type
- Cybersecurity and privacy regulatory actions, guidance, and threat advisory
- Impact
- A ransomware attack on Miljödata affected approximately 2.2 million people; personal data was extracted and portions were published on the dark web. Sweden's IMY fined Miljödata SEK 1.8 million. Poland's UODO fined a website operator PLN 31,507 for failing to cooperate with an investigation. The UK ICO reported data-protection improvements by ten foundation-model developers and opened a consultation on agentic AI. A joint advisory warned that China-linked actors were compromising organizations and stealing sensitive data.
MITRE ATT&CK
T1003.006 · DCSyncThe advisory describes theft of Active Directory information through DCSync-related activity.T1110.001 · Password GuessingEBurst was used for password guessing against Microsoft email interfaces.T1110.003 · Password SprayingEBurst was used for password spraying against Microsoft email interfaces.T1114.002 · Remote Email CollectionThe actors used office-cli to access Microsoft 365 mailboxes and exfiltrate email.T1190 · Exploit Public-Facing ApplicationThe advisory describes exploitation of vulnerable web applications and an internet-facing component.T1219 · Remote Access ToolsThe actors installed SoftEther VPN software to maintain persistent remote access.
Threat Actors
Ethereal PandaThe advisory says the actors enabled by Integrity Technology Group use tactics consistent with activity publicly tracked under this name; it cautions that attribution groupings may not map one-to-one.Flax TyphoonThe advisory says the actors enabled by Integrity Technology Group use tactics consistent with activity publicly tracked under this name; it cautions that attribution groupings may not map one-to-one.Integrity Technology GroupThe advisory describes this China-based company as linked to the Chinese government and as providing tools and infrastructure that support compromises of networks.Red JuliettThe advisory says the actors enabled by Integrity Technology Group use tactics consistent with activity publicly tracked under this name; it cautions that attribution groupings may not map one-to-one.
Vendors
Amazonthe UK Information Commissioner’s Office (ICO) announced that ten major foundation model developers - Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI - had implementedAnthropicInformation Commissioner’s Office (ICO) announced that ten major foundation model developers - Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI - had implemented orAppleCommissioner’s Office (ICO) announced that ten major foundation model developers - Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI - had implemented or committed to dataCohereOffice (ICO) announced that ten major foundation model developers - Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI - had implemented or committed to dataDeepSeekOffice (ICO) announced that ten major foundation model developers - Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI - had implemented or committed to data protectionGoogle(ICO) announced that ten major foundation model developers - Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI - had implemented or committed to data protection improvementsMetaannounced that ten major foundation model developers - Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI - had implemented or committed to data protection improvementsMicrosoftthat ten major foundation model developers - Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI - had implemented or committed to data protection improvements followingMiljödata🇸🇪 Sweden Fines Miljödata Over Known Vulnerability and Monitoring FailuresOpenAImajor foundation model developers - Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI - had implemented or committed to data protection improvements following regulatoryStability AImodel developers - Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI - had implemented or committed to data protection improvements following regulatory supervision. The
Products
Active Directoryaccess and disguise command-and-control traffic. The FBI also observed theft of email databases and Active Directory information, including credentials, group membership and trust relationships through DCSync-relatedClaude Mythos 5.1The program covers Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1, and future models. Its purpose is to allow security teams to use advanced AI capabilities for vulnerability discovery, incident response, andClaude Opus 5.5The program covers Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1, and future models. Its purpose is to allow security teams to use advanced AI capabilities for vulnerability discovery, incident response, andClaude Sonnet 5.5The program covers Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1, and future models. Its purpose is to allow security teams to use advanced AI capabilities for vulnerability discovery, incident response, andMicrosoft 365 Apps for EnterpriseECP, PowerShell, Autodiscover and ActiveSync. The actors also use office-cli to automate access to Microsoft 365 mailboxes and exfiltrate email through legitimate access mechanisms, which can make the activityMicrosoft ExchangeThe advisory describes use of EBurst to conduct password spraying and password guessing against Microsoft Exchange interfaces, including OWA, EWS, ECP, PowerShell, Autodiscover and ActiveSync. The actors also useSoftEther VPNAfter compromise, the actors have installed legitimate SoftEther VPN software to maintain persistent remote access and disguise command-and-control traffic. The FBI also observed theft of email databases and Active
Tools
EBurstMicrosoft email environments are a particular focus. The advisory describes use of EBurst to conduct password spraying and password guessing against Microsoft Exchange interfaces, including OWA, EWS, ECP, PowerShell,MicroScanidentify exposed services and vulnerable web applications, together with a Python-based platform called MicroScan containing more than 1,300 penetration-testing scripts. Initial access techniques include exploitationoffice-cliinterfaces, including OWA, EWS, ECP, PowerShell, Autodiscover and ActiveSync. The actors also use office-cli to automate access to Microsoft 365 mailboxes and exfiltrate email through legitimate access
Countries
AustraliaNSA, the UK National Cyber Security Centre, the Canadian Centre for Cyber Security, and agencies from Australia, Japan, New Zealand and Spain issued a joint cybersecurity advisory on activity linked to China-basedCanada🇨🇦 Canada’s Privacy Commissioner Updates Guidance on Recording Customer CallsChinaUS and Allies Warn of China-Linked Campaign Targeting Sensitive DataJapanUK National Cyber Security Centre, the Canadian Centre for Cyber Security, and agencies from Australia, Japan, New Zealand and Spain issued a joint cybersecurity advisory on activity linked to China-based IntegrityNew ZealandCyber Security Centre, the Canadian Centre for Cyber Security, and agencies from Australia, Japan, New Zealand and Spain issued a joint cybersecurity advisory on activity linked to China-based Integrity TechnologyPoland🇵🇱 Poland Fines Website Sole Proprietor Operator for Failure to CooperateSpain🇪🇸 Spain Tightens Rules for Algorithmic Systems in EmploymentSweden🇸🇪 Sweden Fines Miljödata Over Known Vulnerability and Monitoring FailuresUnited Kingdom🇬🇧UK ICO Secures AI Developer Commitments and Opens Consultation on Agentic AIUnited StatesUS and Allies Warn of China-Linked Campaign Targeting Sensitive Data
Industries
AviationSpecialized Access: Reserved for a limited group of verified organizations authorized to test high-risk systems, including power grids, telecommunications networks, financial infrastructure, and aviation systems.critical manufacturingThe activity has affected organizations worldwide, including US government services, critical manufacturing, healthcare and public health, information technology, law enforcement, education and religious organizations,Educationcritical manufacturing, healthcare and public health, information technology, law enforcement, education and religious organizations, as well as targets in Southeast Asia, Africa and North America. TheEmployment and human resourcesFinancial ServicesGovernmentadvisory on activity linked to China-based Integrity Technology Group. The advisory says China government-linked threat actors are combining automated scanning, large-scale botnets and hands-on exploitation toHealthcare and public healthaffected organizations worldwide, including US government services, critical manufacturing, healthcare and public health, information technology, law enforcement, education and religious organizations, as well asInformation Technologyincluding US government services, critical manufacturing, healthcare and public health, information technology, law enforcement, education and religious organizations, as well as targets in Southeast Asia,Law enforcementgovernment services, critical manufacturing, healthcare and public health, information technology, law enforcement, education and religious organizations, as well as targets in Southeast Asia, Africa and Northreligious organizationshealthcare and public health, information technology, law enforcement, education and religious organizations, as well as targets in Southeast Asia, Africa and North America. The advisory is based onTelecommunicationsSpecialized Access: Reserved for a limited group of verified organizations authorized to test high-risk systems, including power grids, telecommunications networks, financial infrastructure, and aviation systems.