AENA fined €10m for GDPR breach over facial recognition pilot
AENA, Spain's state-owned airport manager, was fined just over €10 million by the Spanish data protection agency for breaching the GDPR. During a pilot project of a new facial recognition system, AENA failed to submit a data protection impact assessment that complied with GDPR requirements. The company has one month from notification to lodge an appeal for reconsideration.
- Company involved
- AENA
6 source articles · read the reporting →
Paper Werewolf uses AI-generated decoys and XLLs to target Russian organizations
The threat group Paper Werewolf (aka GOFFEE) is conducting a cyberespionage campaign targeting Russian defense and high-technology organizations. The campaign uses AI-generated decoy documents, such as invitations and official letters, to trick recipients into opening malicious Excel XLL add-ins that deliver a backdoor called EchoGather. The backdoor collects system information and communicates with a command-and-control server. The campaign is ongoing and was first detected in late October 2025.
- Company involved
- Paper Werewolf
- AI system involved
- EchoGather
2 source articles · read the reporting →
ChatGPT 4o image generator used to create fake receipts
ChatGPT's new image generator, part of the 4o model, can generate realistic fake restaurant receipts. Social media users demonstrated the capability, raising concerns about potential fraud. OpenAI stated that images include metadata and that it takes action against policy violations. The company defended the feature as allowing creative freedom.
- Company involved
- OpenAI
- AI system involved
- ChatGPT 4o image generator
5 source articles · read the reporting →
Mumbai businessman loses Rs 80,000 in AI voice cloning scam
A 68-year-old businessman from Powai, Mumbai, was defrauded of Rs 80,000 after receiving a call from scammers posing as the Indian Embassy in Dubai. The fraudsters used AI voice cloning to mimic his son's voice, claiming he was arrested and needed bail money. The victim transferred the money via GPay before realising it was a scam when the call was disconnected. The Kanjurmarg police have registered a case and are investigating.
2 source articles · read the reporting →
Brian May Deepfake Scam: Fake TikTok Video Offers Non-Existent VIP Tickets
A deepfake video of Brian May circulated on TikTok, falsely offering discounted backstage VIP tickets for $800. The scam was spotted by a fan, and May warned his followers, saying he felt 'violated' and that people could be fooled. May has alerted his team and hopes to stop the scam. No victims have been reported in this specific incident, but similar scams have cost fans thousands.
2 source articles · read the reporting →
MAA, JBG to pay DC $9.3M total to settle RealPage case - Multifamily Dive
The system set rent prices for tenants, causing them to pay higher rents.
- Company involved
- MAA (Mid-America Apartments) and JBG Smith
- AI system involved
- RealPage Revenue Management Software
1 source article · read the reporting →
Greek Data Protection Authority fines Ministry of Migration and Asylum for AI surveillance systems
The Hellenic Data Protection Authority (HDPA) imposed an administrative fine of €175,000 on the Ministry of Migration and Asylum (MMA) for GDPR violations related to the 'Centaur' and 'Hyperion' programmes. These systems use AI behavioral analytics, CCTV, drones, and biometric data to monitor and control access to reception facilities for asylum seekers on Greek islands. The HDPA found that the MMA failed to conduct proper Data Protection Impact Assessments and did not cooperate with the authority. The MMA has been ordered to comply with GDPR within three months.
- Company involved
- Ministry of Migration and Asylum
- AI system involved
- Centaur and Hyperion programmes
10 source articles · read the reporting →
SEC charges YouPlus and CEO with defrauding investors
The SEC charged machine-learning startup YouPlus and its CEO Shaukat Shamim with defrauding investors. Shamim allegedly made false statements about the company's revenue and customer numbers, including providing falsified bank statements. The scheme unravelled when Shamim confessed to investors that the company had earned less than $500,000 and had only four paying customers since 2013. The SEC is seeking permanent injunctions, civil penalties, and an officer-and-director bar.
- Company involved
- YouPlus
- AI system involved
- YouPlus machine-learning tool
1 source article · read the reporting →
Pensioner loses 80,000 pounds to deepfake Martin Lewis investment scam
The deepfake video deceived a pensioner into investing in a fraudulent scheme and taking out loans.
1 source article · read the reporting →
Kmart's facial recognition system for refund fraud found unlawful by Privacy Commissioner
Kmart Australia deployed facial recognition technology in 28 stores from June 2020 to July 2022, capturing biometric data of every customer entering the stores and those at returns counters to detect refund fraud. The system collected sensitive information without notifying customers or obtaining their consent. The Australian Privacy Commissioner found that Kmart breached the Privacy Act, as the exemption for unlawful activity did not justify the indiscriminate and disproportionate collection of biometric data from thousands of individuals. Kmart has ceased using the system and cooperated with the investigation.
- Company involved
- Kmart Australia Limited
7 source articles · read the reporting →
Deepfake scam articles impersonate Maltese ministers after budget day
After Malta's budget day on 27 October 2025, a series of scam articles featuring deepfake videos of ministers, including Economy Minister Silvio Schembri, appeared on social media. The articles, falsely branded as Times of Malta, promoted a fraudulent AI-powered trading platform called NethertoxAGENT, claiming a €215 investment would yield €850 weekly. The scam used fake testimonials and logos of reputable businesses to appear credible. Authorities have not reported any arrests for this specific scam, but a similar deepfake scam previously led to a woman losing her life savings and a money laundering charge against a Ukrainian national.
3 source articles · read the reporting →
Meta fails to block hate speech ads in Kenya test
Global Witness and Foxglove submitted test ads containing violent hate speech in English and Swahili to Facebook. The ads were approved for publication, demonstrating that Meta's content moderation systems failed to detect the hate speech. The groups had previously conducted similar tests in Myanmar and Ethiopia with the same result. Meta did not respond to the groups' outreach.
- Company involved
- Meta
- AI system involved
- Facebook's content moderation system
2 source articles · read the reporting →
US Secret Service bought access to cellphone location data
The US Secret Service signed a contract to access Locate X, a service that aggregates location data from phone apps and allows law enforcement to track devices without a warrant. The contract with Babel Street was worth about $36,000 and ran from 2017 to 2018. A former employee said the Secret Service used Locate X in 2018 to seize illegal credit card skimmers at petrol stations. Lawmakers and civil liberties advocates criticised the practice, and Senator Ron Wyden introduced a bill to ban such purchases.
- Company involved
- United States Secret Service
- AI system involved
- Locate X
1 source article · read the reporting →
Warner Bros. Sues Midjourney for Copyright Infringement
Warner Bros. has filed a lawsuit against Midjourney, alleging that the AI image generation platform willfully creates infringing images and videos of its copyrighted characters, including Superman, Batman, and Bugs Bunny. The lawsuit claims that Midjourney removed guardrails that blocked users from creating infringing videos. The suit seeks statutory damages and an injunction to stop the infringement.
- Company involved
- Midjourney
- AI system involved
- Midjourney
5 source articles · read the reporting →
Hacker steals Muah.ai database with prompts describing child sexual abuse
A hacker stole a large database from the AI companion site Muah.ai, containing users' interactions with their chatbots. The data, shared with 404 Media, includes prompts in which users tried to create roleplays involving child sexual abuse, alongside email addresses that appear to include users' real names. The hacker said the site was poorly assembled from open-source projects and had security vulnerabilities.
- Company involved
- Muah.ai
- AI system involved
- Muah.ai
5 source articles · read the reporting →
$335,000 and counting: Another WA local government settles Flock lawsuit - Cascadia Daily
The system captured images of vehicles and license plates, and the county failed to release them to a public records requester.
- Company involved
- Snohomish County
- AI system involved
- Flock Safety cameras
1 source article · read the reporting →
Steak 'n Shake sued over facial recognition kiosks under BIPA
A class action lawsuit alleges that Steak 'n Shake illegally collects facial biometrics from customers using PopID-powered self-ordering kiosks without proper consent. Plaintiff Michael Massel claims the restaurant chain failed to provide notice and obtain written consent as required by Illinois' Biometric Information Privacy Act (BIPA). The suit seeks damages of up to $5,000 per violation for anyone whose biometric data was collected in Illinois in the past five years.
- Company involved
- Steak 'n Shake
- AI system involved
- PopID biometric kiosks
6 source articles · read the reporting →
Mumsnet takes legal action against OpenAI for scraping content
Mumsnet, a UK parenting forum, has initiated legal action against OpenAI for scraping its content without permission. The company alleges that OpenAI used over six billion words from Mumsnet to train its ChatGPT model, breaching its terms of use. Mumsnet approached OpenAI to license the content but was refused. The case is ongoing.
- Company involved
- OpenAI
- AI system involved
- ChatGPT
6 source articles · read the reporting →
Moonwell loses $1.78M after AI-generated code from Claude Opus 4.6 causes oracle pricing error
DeFi lending protocol Moonwell lost $1.78 million after an oracle pricing error in smart contract code partially written by Anthropic's Claude Opus 4.6 model. The error valued cbETH at approximately $1.12 per token instead of its actual market price of nearly $2,200, triggering instant liquidations. Moonwell contained the issue by reducing the cbETH borrow cap, but users suffered catastrophic losses. The incident has sparked debate about the risks of AI-generated code in smart contracts.
- Company involved
- Moonwell
- AI system involved
- Claude Opus 4.6
4 source articles · read the reporting →
Italian bank (Fideuram / Intesa Sanpaolo) loses about 95 million euro to AI voice-clone scam
The AI-generated voice deceived the chairman into authorizing transfers of about 95 million euros.
1 source article · read the reporting →
Spanish data regulator orders Worldcoin to stop processing biometric data in Spain
The Spanish Data Protection Agency (AEPD) has ordered a precautionary measure against Tools for Humanity Corporation, the company behind Worldcoin, to cease collection and processing of personal data in Spain. The AEPD received complaints alleging insufficient information, collection of data from minors, and inability to withdraw consent. The regulator acted under GDPR Article 66.1 to prevent potentially irreparable harm to individuals' data protection rights.
- Company involved
- Tools for Humanity Corporation
- AI system involved
- Worldcoin
8 source articles · read the reporting →
Meta accused of exploiting content moderators in Ghana
Meta moved its Facebook content moderation operations to Ghana after laying off moderators in Kenya. Workers in Accra report poor working conditions, low pay, and psychological harm from reviewing traumatic content. Foxglove is investigating and planning a legal challenge.
- Company involved
- Meta
- AI system involved
- Facebook content moderation system
3 source articles · read the reporting →
Mr Craig Hadley wrongly accused of fraud at Sports Direct shop using Facewatch facial recognition.
Mr Craig Hadley was wrongly accused of being a fraudster at a Rotherham Sports Direct shop using facial recognition technology supplied by Facewatch. The system flagged him as a known fraudster, but the alert was later attributed to human error. Big Brother Watch, a privacy campaign group, has raised concerns about the lack of due process in such systems.
- Company involved
- Sports Direct
- AI system involved
- Facewatch
2 source articles · read the reporting →
Portuguese regulator suspends Worldcoin's biometric data collection
Portugal's data protection authority, CNPD, has ordered Worldcoin Foundation to suspend collection of iris, eye and facial biometric data in Portugal for 90 days. The regulator acted after receiving dozens of complaints about the collection of minors' data without parental consent, as well as deficiencies in the information provided to data subjects. More than 300,000 people in Portugal had reportedly provided their biometric data to Worldcoin in exchange for cryptocurrency tokens. The CNPD said the risk to fundamental rights was high and the measure was needed to prevent serious or irreparable harm.
- Company involved
- Worldcoin Foundation
- AI system involved
- Orb
5 source articles · read the reporting →
