Insights for North, Central, and South America, and the Caribbean.
A ransomware attack on UnitedHealth’s Change Healthcare cripples claims and prescription processing across the US and exposes data on about 193 million people.
Canada’s federally regulated financial institutions must now meet OSFI’s expectations for technology and cyber risk management.
US-listed companies must now disclose material cybersecurity incidents on Form 8-K within four business days of determining materiality.
OpenAI’s board abruptly fired Sam Altman, saying he had not been consistently candid; he was reinstated days later after staff revolted.
Major amendments to New York’s cybersecurity regulation for financial services strengthen governance, MFA and incident reporting.
UK organisations can now transfer personal data to US organisations certified under the UK Extension to the EU–US Data Privacy Framework.
Hackers used reused passwords to access 23andMe accounts and scraped ancestry data on about 6.9 million people.
Most of Quebec’s Law 25 is now in force, including privacy impact assessments, privacy by default and significant new penalties.
A cyber attack on MGM Resorts shut down systems across its US casinos and hotels, costing the company around $100m.
The European Commission has adopted an adequacy decision for the EU–US Data Privacy Framework, three years after Schrems II.
New York City now enforces Local Law 144, requiring bias audits and candidate notices for automated employment decision tools.
The main new requirements of the amended FTC Safeguards Rule now apply to US non-bank financial institutions, including MFA and encryption.