Weekly Privacy Roundup: Regulatory Settlements, Supply Chain Exposures, and Third-Party Vendor Risks

Welcome to this week's data privacy roundup from the PrivaScan team. Across the privacy landscape, enforcement bodies and state attorneys general are escalating financial and operational remedies for historic breaches, while software supply chains and third-party vendor dependencies continue to expose organization and user data. Below, we break down the key regulatory developments, breach notices, and security trends that web agencies, software teams, and business owners should keep on their radar.

Regulatory Enforcement & Legal Settlements

State regulators in the US continue to enforce accountability for past data incidents. The Perry Johnson companies have agreed to pay up to $10 million alongside a mandatory corrective action plan following a multi-state investigation by state attorneys general into a 2023 breach. In a separate multi-state action, a medical services provider finalized a settlement across four states regarding a 2023 incident involving sensitive patient records.

Legal fallout from security incidents is also broadening. Plaintiff attorneys are currently investigating potential data breaches at Palm Vascular Centers, while industry analysis indicates a growing legal trend where law firms representing breached organizations are themselves becoming targets of breach-related litigation. Internationally, UN experts emphasized that maintaining independent data protection oversight and ensuring effective access to justice are indispensable components of safeguarding personal privacy rights.

Developer Security & Credential Leakage

Operational misconfigurations and tool-level exposures present immediate risks to data confidentiality. Security researchers revealed that automated coding agents have been saving secrets and credentials to hidden local files, resulting in thousands of sensitive keys inadvertently pushed to public GitHub repositories. In parallel, reports highlight passive leaks like the Artex exposure, demonstrating that unauthorized access often occurs due to exposed repositories or storage buckets rather than sophisticated external breaches.

Third-Party & Supply Chain Breach Impacts

Organizational reliance on business partners and software platforms remains a key vector for data exposure:

• B2B Infrastructure: Certificate authority DigiCert issued notifications regarding a data breach that impacted business customer information.
• Education Sector Vulnerabilities: Arlington ISD reported personnel information affected by a national third-party breach. Similarly, Jefferson County Public Schools (JCPS) announced a potential compromise affecting more than 37,000 current and former employees, while notifications tied to Frontline Education were issued through Cyberscout.

Managing third-party software risks requires full visibility into your digital footprint. Tools like PrivaScan assist teams by automatically scanning for pre-consent trackers, establishing a GDPR Art. 30 compliant data inventory, and identifying unexpected cross-border data flows caused by external scripts.

Consumer, Retail & Financial Sector Incidents

Direct consumer impacts featured prominently in this week's news. Fashion e-commerce platform Revolve suffered a data incident exposing customer-saved payment card numbers and expiration dates. In the fintech sector, Gnosis Pay reported a data breach involving customer personal information, though the company confirmed customer funds remained unaffected.

Platform Governance, Public Sector & Emerging Cyber Threats

Regulatory bodies and law enforcement are addressing complex cyber threats and platform designs:

• Platform Regulations: The European Union formally accused TikTok of employing algorithmic features that lead users into harmful content recommendations.
• AI-Enabled Cybercrime: Federal prosecutors highlighted an advanced scheme where threat actors used AI technology for CEO-spoofing scams, successfully siphoning over $100 million.
• Public Sector Targets: The North American Aerospace Defense Command (NORAD) was targeted by a cyberattack. Local public entities also reported breaches, including the County of Sussex and the Sussex County Prosecutor's Office in New Jersey, where Social Security numbers and personal details were exposed.
• Insider Threats: In law enforcement news, a former FBI agent pleaded guilty to stealing $2.4 million in cryptocurrency connected to nation-state hacking operations.

What This Means for You

This week's updates demonstrate that data privacy compliance extends beyond public-facing cookie banners—it requires ongoing developer hygiene, stringent vendor risk management, and defensive data practices. Organizations using automated coding tools must ensure environment secrets are excluded from public repositories. Simultaneously, relying on third-party service providers requires clear data-mapping and vendor assessment processes to mitigate downstream breach liabilities.

Disclaimer: This roundup is for general informational purposes only and does not constitute formal legal advice. Organizations should consult qualified legal professionals to assess specific compliance requirements under GDPR, KVKK, or regional privacy laws.

Sources

• No need to hack when it’s leaking: Artex edition — DataBreaches.net
• County of Sussex, New Jersey Notice of Data Privacy Incident — DataBreaches.net
• Coding Agents Copy Your Secrets to a Hidden File. Thousands Are on GitHub — DataBreaches.net
• Norad targeted by cyberattack — DataBreaches.net
• Sussex County Prosecutor's Office reports data breach involving Social Security numbers, personal information - WRNJ Radio — WRNJ Radio
• State attorneys general secure up to $10 million and corrective action plan from Perry Johnson companies after 2023 breach — DataBreaches.net
• Arlington ISD personnel information affected by third-party national data breach - Fort Worth Report — Fort Worth Report
• Medical services company settles with 4 states over 2023 hack of sensitive patient records — The Record
• Gnosis Pay data breach exposes customer info; funds unaffected - The Block — The Block
• Certificate authority DigiCert reports data breach involving business customer info — The Record