PrivaScan Weekly Privacy Roundup: EU Regulatory Shifts, High-Volume Breaches, and Third-Party Risk

Welcome to this week's data privacy roundup from PrivaScan. Organizations face a rapidly changing environment driven by regulatory updates in Europe, growing scrutiny around political microtargeting, and a continuous wave of third-party and sector-specific data breaches. Below is a summary of the most significant privacy and security news from the past week.

EU Regulatory Developments & GDPR Enforcement

• EU Council Agrees on Simplified Reporting Rules: The Council of the European Union has agreed on a position aimed at simplifying data protection, privacy, and cybersecurity reporting obligations across member states.
• German DPA Rules Political Microtargeting Illegal: Following a complaint by privacy organization noyb, a German Data Protection Authority found microtargeting practices used by major political parties to be unlawful under the GDPR.
• EU Member States Approve AI Data Access Rules: Privacy advocacy group noyb reports that EU member states have approved measures allowing AI companies expanded access to data for training purposes, characterized by critics as "digital expropriation."

High-Volume & Sensitive Data Breaches

• Capcom Breach Impacts 11.7 Million Records: Video game publisher Capcom suffered a massive breach exposing an estimated 11.7 million user records.
• Healthcare and Public Sector Incidents: Several healthcare and public entities reported incidents, including Quest Diagnostics (potential data theft following a lab service attack), Ridgeway Pharmacy (affecting 259,000 individuals), Northern Light Health, and BASS Medical Group. Additionally, the U.S. Pentagon is facing a lawsuit stemming from a breach affecting over 3 million individuals.
• Child Data and Student Records Exposed: Welsh firms suffered a breach exposing children's personal data after basic security failures involving simple credentials like "Password1" and "Test 2." Elsewhere, breaches affected California student records, the SafeVoice Nevada reporting system, and a Toronto crime tips organization, which froze operations following its breach.

Infrastructure, Vulnerabilities & Third-Party Risk

• Third-Party Domino Effect: A report from risk consultancy Kroll highlights the growing impact of vendor ecosystem risks heading into 2026, emphasizing how third-party breaches create chain-reaction incidents.
• MFA Bypass Flaw Exploited: Ransomware operators (Qilin and INC) have been actively exploiting a flaw in Palo Alto Networks systems to bypass multi-factor authentication (MFA).
• Hardware & Web Infrastructure Security: The FCC banned two devices containing Huawei-linked surveillance chips, while the UK proposed 14-year prison sentences for undersea cable sabotage. Meanwhile, security researchers are monitoring increased exploitation attempts targeting a PHP vulnerability.

What This Means for Your Organization

Managing compliance requires strict oversight of system configurations, access credentials, and external service providers. As demonstrated by recent vendor breaches and basic security failures, simple vulnerabilities and poor credential management can lead to catastrophic data loss. To maintain alignment with GDPR requirements, organizations should consistently audit their web infrastructure, monitor external scripts, and keep detailed data inventories.

Integrating automated scanning tools—such as PrivaScan’s solutions for pre-consent tracker detection, cross-border data transfer monitoring, and GDPR Article 30 data mapping—can help development and compliance teams identify risks before they trigger regulatory action or breach notifications.

Disclaimer: This article provides general regulatory information and context. It does not constitute legal advice.

Sources

• FCC bans two devices with surveillance chips linked to Huawei — The Record
• BASS Medical Group Data Breach Reported; Lawsuit Possible - ClassAction.org — ClassAction.org
• UK proposes 14-year prison terms for undersea cable sabotage — The Record
• Quest Diagnostics warns of potential data theft after attack on lab service system — The Record
• AI: EU Member States approve “digital expropriation” for AI companies — noyb
• Capcom data breach exposes 11.7 million account records - Help Net Security — Help Net Security
• 11 Million Impacted by Capcom Data Breach - SecurityWeek — SecurityWeek
• Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits — The Record
• Pentagon sued over data breach affecting more than 3 million people - Federal News Network — Federal News Network
• Northern Light Health lab manager suffers data breach - WABI — WABI