The security & privacy stories our desk judged worth your time, written so anyone can follow them.
About 2,000 Hong Kong Airlines customers got scam calls after a data breach. Anyone who deals with the airline or two linked shops should be on guard.
Read more: Hong Kong Airlines data breach leads to scam calls for 2,000 customersCriminals hid fake Claude download pages on claude.ai and promoted them with Google ads. Following the steps installs malware that steals passwords and crypto.
Read more: Fake Claude download pages on the real Claude site spread malwareA Windows data thief called Aokigahara copies login files for AI apps like ChatGPT Desktop, Claude and Cursor, and a password reset alone may not lock thieves out.
Read more: New Windows malware steals logins for ChatGPT, Claude and CursorAARP tested more than 30 medical alert devices with staged falls. Medical Guardian came out on top, and fall detection usually costs about $10 more a month.
Read more: Medical alert devices with fall detection: what AARP's tests foundThe FCC has set November 25 for new robocall and text opt-out rules. Businesses that contact customers have under a month to get ready.
Read more: New rules on stopping robocalls and texts start November 25A student lost ₹6,450 chasing a ₹799 kurti from an Instagram ad. Police say the trail led to a network moving more than ₹30 crore, and seven people are arrested.
Read more: A $10 online dress order led police to a $3.6 million fraud ringChargebacks911 says it will cover certain merchant losses when AI shopping agents make purchases, a sign that AI-made orders are becoming a real business risk.
Read more: A payments firm now backs merchants when AI shopping agents buyA 93-year-old in Japan spotted a fake police call, told her son and real officers, and a 47-year-old man was arrested at her door. Here is the lesson.
Read more: A 93-year-old in Japan helps police catch a fake police scammerVodafone says 98.35% of 25 million scam calls reaching its customers came from one wholesale network, and it wants the industry to stop scammers sooner.
Read more: Vodafone says nearly all its scam calls trace back to one phone networkA Louisiana woman lost more than $10,000 to an impostor using AI videos of Jon Bon Jovi. A video that looks real no longer proves anyone is who they say.
Read more: Woman loses $10,000 to fake Jon Bon Jovi made with AI videosShopify now lets AI shopping assistants complete checkout on its stores, though the buyer still approves the order. Store owners should check how they handle it.
Read more: Shopify lets AI shopping assistants finish checkout for youFoundation and Keystone, two crypto hardware wallet makers, lost customer data that should have been deleted. Owners should expect convincing scam emails.
Read more: Two more crypto wallet makers hit by hackers, customer data exposedApple's iOS 27.2 and iPadOS 27.2 fix more than 160 security flaws, including one that could leak your real Hide My Email address.
Read more: Apple's latest iPhone update fixes over 160 security holesSouth Korean police say one hacker used an AI toolkit to breach more than 90 organizations and steal 8.2 million records, a sign that big attacks are getting easier.
Read more: Police say AI tools let one hacker break into 90 South Korean groupsRetail Insider reports American Express is moving past payments to influence which stores you pick, so card perks may soon point you somewhere.
Read more: American Express wants to steer where you shop, not just how you payA Lancaster County police department says a suspected phone scam is circulating, and a rushed call for money or personal details can cost you your savings.
Read more: Lancaster County police warn of a suspected phone scamFederal officials warn of a scheme that threatens arrest or a phone shutoff to rush people into acting. Here is why a call like that should make you pause.
Read more: Feds warn of scam that threatens arrest or phone shutoffA hidden script has been planted in 953 online stores, mostly on Magento, and it shows nothing to security scanners. Store owners should check their sites now.
Read more: Hidden code has infected 953 online stores, mostly on MagentoDenver Health Medical Plan says a vendor's access key sat on a public website for over a year, putting records of 238,083 members within reach.
Read more: A health plan's vendor left a key online for a year, exposing 238K membersA UK monitoring service says it found 511 lookalike sites copying brands like Sky, Amazon and HSBC in one day. Fake alerts are the common thread.
Read more: 511 fake websites copying UK brands like Sky, Amazon and HSBC spotted in a dayA flaw in Brotli, a compression tool used by Node.js, .NET and Python apps, can let attackers take over software. Fixes are out and attack code is public.
Read more: Serious flaw in a common web tool forces emergency software fixesA Kroll report finds most people caught in data breaches were exposed through a vendor, not the company they dealt with. Here is what that means for your data.
Read more: Most people hit by data breaches were exposed through a vendorPuerto Rico's banks have started a public campaign to help customers spot fraud that uses AI to copy voices and write convincing fake bank messages.
Read more: Puerto Rico banks launch a campaign against AI-powered fraudTwo critical PHP flaws drew millions of attack attempts after going public. No break-in is confirmed, but the patch window is short.
Read more: Serious flaws in PHP, used by much of the web, are under attack
