Issue
Security failures can turn routine data collection into lasting harm. Public findings help distinguish documented control failures from speculative risk.
A Facebook design flaw allowed attackers to obtain access tokens affecting about 29 million accounts. The regulator found failures in breach notification, documentation and data protection by design.
Read recordMeta notified the regulator that some social-media user passwords had been stored in plaintext on internal systems. The inquiry assessed notification, documentation and security obligations.
Read recordThe board reviewed the 2023 compromise of Microsoft Exchange Online and described operational and strategic security decisions that allowed the intrusion to succeed and remain undetected.
Read recordThe FTC alleged that Ring gave employees and contractors broad access to customers’ videos and failed to implement basic security measures, enabling account takeovers and harassment.
Read recordA government-commissioned data protection impact assessment documented risks in diagnostic data sent by enterprise versions of Office and proposed measures for public-sector use.
Read record