CISA says hackers targeted more than 100 US water systems
26 Aug 2026
CISA confirms attacks on over 100 internet-exposed US water and wastewater systems in July 2026, which US officials believe were likely Iranian.
Americas
Insights for North, Central, and South America, and the Caribbean.
California data brokers must begin processing DROP deletion requests
1 Aug 2026
Registered California data brokers must now retrieve and act on consumer deletion requests submitted through the state’s DROP platform.
Canada’s Critical Cyber Systems Protection Act receives Royal Assent
15 Jun 2026
Canada’s Critical Cyber Systems Protection Act creates mandatory cyber security programmes and incident reporting for federally regulated critical sectors.
TAKE IT DOWN Act platform removal duties take effect in the US
19 May 2026
Covered platforms must now remove reported non-consensual intimate imagery, including AI deepfakes, within 48 hours of a valid request.
Hackers steal data from Canvas learning platform used by thousands of schools
1 May 2026
ShinyHunters claims a breach of Instructure’s Canvas platform, affecting nearly 9,000 schools and universities, then defaces login pages during exams.
Amended COPPA Rule compliance deadline arrives in the US
22 Apr 2026
Online services directed at US children under 13 must now comply with the amended COPPA Rule, including written security programmes and retention policies.
Iran-linked hackers wipe devices at medical technology firm Stryker
11 Mar 2026
A pro-Iran group claims a destructive attack on Stryker that wiped tens of thousands of company devices and disrupted operations worldwide.
US 42 CFR Part 2 compliance deadline arrives
16 Feb 2026
US rules on substance use disorder treatment records now align more closely with HIPAA, adding breach notification and civil penalties.
New California rules on cybersecurity audits, risk assessments, and automated decisions take effect
1 Jan 2026
New CCPA regulations on cybersecurity audits, risk assessments and automated decision-making technology come into force in California.
Texas and Illinois AI laws take effect
1 Jan 2026
The Texas Responsible AI Governance Act and Illinois’ AI-in-employment law both come into force, adding to US state AI regulation.
Amended SEC Regulation S-P compliance deadline arrives for larger firms
3 Dec 2025
Larger US broker-dealers, investment advisers and funds must now have incident response programmes and notify affected customers within 30 days.
CMMC requirements begin appearing in US defence contracts
10 Nov 2025
The DFARS rule implementing CMMC takes effect, allowing US Department of Defense contracts to require CMMC status as a condition of award.