Get tomorrow's brief in your inbox
Today: The Supreme Court allowed the Trump administration to proceed with mail-in voting restrictions in 23 states, finding the challenges premature. Crossroads Trading reached a $600,000 data breach settlement, and the Treasury Department sanctioned Iranian cyber actors for critical infrastructure attacks targeting U.S. government agencies. Federal banking regulators established new procedures requiring examiner approval before collecting highly sensitive information from supervised institutions.
$600K Crossroads Trading Data Breach Class Action Settlement
Crossroads Trading agreed to a $600,000 class action settlement resolving claims from a 2025 data breach that compromised employee and customer information. The settlement provides relief to affected individuals whose personal data was exposed during the breach.
U.S. Sanctions Iranian Cyber Actors for Critical Infrastructure Attacks
The Treasury Department sanctioned at least six Iranian nationals associated with the Ministry of Intelligence and Security (MOIS) for conducting cyberattacks on U.S. critical infrastructure since 2023. Four of the sanctioned individuals were indicted for breaching employee email accounts at the Department of Labor, Federal Energy Regulatory Commission, and United Nations organizations. The group targeted energy companies, defense contractors, healthcare institutions, financial institutions, and local, state, and federal government offices across the United States, including a summer 2024 compromise of multiple government offices. Members are also accused of financially motivated cyber theft and cryptocurrency theft.
Indian National Arrested for $7.5 Million Elder Scam Operation
Jay Sunilbharthi Goswami, 21, was arrested and charged with wire fraud and money laundering for serving as a money mule in a scam operation that stole $7.5 million from at least nine elderly victims in New York and New Jersey. Goswami, a Jersey City resident on a student visa, allegedly collected cash and gold bars from victims in their 70s and 80s who were told by India-based scammers posing as law enforcement that they needed to empty their bank accounts. Goswami earned approximately $90,000 from the scheme and faces 20 years in prison. He was initially arrested in December 2025, released, and continued working with the scammers before fleeing to Canada in August 2026, where he was arrested awaiting extradition.
$4.45M Detroit Water Rates Class Action Settlement
Detroit reached a $4.45 million class action settlement with customers who paid allegedly unfair water rates. The settlement provides relief to eligible customers affected by the disputed rate structure.
Glenmark Faces Class Action Over Contaminated Carvedilol
Glenmark Pharmaceuticals faces a new class action alleging the company sold Carvedilol heart medication contaminated with nitrosamine impurities and manufactured outside current federal quality standards. The lawsuit claims the pharmaceutical manufacturer violated FDA manufacturing requirements.
TikTok Class Action Alleges TCPA Violations for Unwanted Marketing Texts
A new class action lawsuit alleges TikTok violated the Telephone Consumer Protection Act by continuing to send unwanted marketing text messages to customers even after they opted out. The complaint alleges the company failed to honor opt-out requests and continued sending spam texts in violation of federal law.
Meta Faces Bellwether Trial Over Alleged Harm to Children
A bellwether trial is underway involving claims from Kentucky, California, Colorado, and New Jersey that Meta's social media platforms harm children's mental health and were intentionally designed to be addictive. The high-stakes trial could establish precedent for state enforcement actions against social media companies under consumer protection and child safety laws.
Thermos Lawsuit Investigation for Recalled Lid Injuries
Consumers injured when the stopper or lid of a recalled Thermos food jar suddenly ejected may qualify to pursue product liability claims. The investigation focuses on whether defective lid design caused pressure-related injuries.
Supreme Court Allows Trump Mail-In Voting Order to Proceed
The Supreme Court in a 10-page unsigned opinion vacated an injunction blocking implementation of a Trump administration executive order imposing restrictions on mail-in voting in 23 states and the District of Columbia. The majority held the states' challenge was not ripe because the order had not yet been implemented, meaning states had not suffered injury allowing their lawsuit to proceed. The order instructs the Department of Homeland Security to create lists of adult U.S. citizens and send them to states 60 days before federal elections, directs the Attorney General to prioritize investigation and prosecution of state and local officials who issue ballots to ineligible voters, and requires states to provide the U.S. Postal Service with voter lists while prohibiting USPS from mailing ballots to voters not on enrolled voter lists. Justice Ketanji Brown Jackson dissented, accusing the majority of missing the government's objective to "foment chaos ahead of the November elections." A separate injunction prohibiting USPS from implementing one provision nationwide remains in effect.
USPS Publishes Finalized Plan to Restrict Mail Ballots
The U.S. Postal Service published regulations that would restrict mail voting by refusing to deliver mail ballots in states that do not share voter data with the federal agency. The Postal Service stated it would not implement the rule for the 2026 election unless the Supreme Court rules in the administration's favor on the pending challenge to Trump's mail-in voting executive order.
Federal Banking Agencies Announce Coordinated Approach to Handling Highly Sensitive Information
The Federal Reserve Board, FDIC, and OCC issued a joint statement establishing new procedures for handling highly sensitive information during bank examinations. The framework allows supervised institutions to identify information they consider highly sensitive and request alternatives to regulators taking custody of that data, including on-site review, digital review from the bank's systems, or appropriately redacted documents. If an examiner determines highly sensitive information must be obtained for the supervisory record, that determination requires approval through the supervisory chain. The agencies also committed to notify affected banks of potential or confirmed material compromise of confidential supervisory information within 72 hours of discovery. The joint statement identifies four categories of potentially highly sensitive information: cybersecurity assessments and network diagrams, succession and transition plans, board and employee materials, and sensitive audit, compliance, and internal investigation records.
FBI and NSA Warn of Attacks Targeting Operational Technology
The FBI and National Security Agency warned that unnamed hackers are targeting programmable logic controllers widely used by the energy, water, and agricultural industries. The warning follows reports that Iranian actors shut down a small British power plant for four days, the first known successful operational technology attack on energy infrastructure attributed to Iran.
New Zealand to Pursue Social Media Ban for Children Under 16
New Zealand Prime Minister Christopher Luxon announced plans to introduce legislation barring children under 16 from social media platforms and imposing penalties of up to 10% of a platform's global revenue for violations. The bill would require high-risk platforms including Instagram, TikTok, Snapchat, and Facebook to take "reasonable steps" to verify users are over 16 using facial age estimation, digital ID services, formal IDs, or existing account information. Platforms would be required to monitor risks they pose to children and report on mitigation efforts. The legislation would also create an online safety regulator within the Department of Internal Affairs to enforce compliance. The bill faces opposition and its passage is uncertain.
Social Media Ban Advocates Warn Against Rushed Implementation
Brazil's online safety commissioner and other experts expressed skepticism about social media bans for children, questioning whether they are effective or enforceable. Brazil's Lorena Giuberti Coutinho stated bans appear "quite hard to impose" and questioned whether global momentum would persist, noting "the incentives for teenagers to continue on social media are quite strong because this is where they communicate." France's Constitutional Council blocked Emmanuel Macron's proposed ban. Growing concerns focus on whether bans go too far and whether there are smarter approaches to protecting children online, particularly given evidence that many children easily circumvent bans and those who relied on platforms for community support are harmed by blanket restrictions.
DOJ Maneuver on Unconfirmed U.S. Attorneys Nears Supreme Court Review
The Supreme Court may soon review a Department of Justice practice of installing acting U.S. attorneys without Senate approval by appointing someone as an interim U.S. attorney, then moving them into a different role while allowing them to continue performing U.S. attorney duties after the interim appointment ends. Two appeals court panels ruled last week that DOJ cannot sidestep confirmation by changing someone's title or handing them top prosecutor duties. The rulings affirmed that Sigal Chattah and John Sarcone III were properly disqualified from serving as acting heads of U.S. attorney offices in Nevada and the Northern District of New York. The Justice Department plans to appeal to the Supreme Court.
OLC Opinion on Posse Comitatus Act Criticized as Dangerous
The Department of Justice Office of Legal Counsel issued an opinion stating military personnel can arrest individuals after they leave a national defense area. Legal scholars criticized the opinion for ignoring recent precedent on the Posse Comitatus Act, misinterpreting requirements for off-base arrests and acceptable military purposes. The analysis notably omits citations to recent case law and OLC's long-standing practice of applying three established tests to proposed military activity, instead relying on a 1978 memo predating modern precedent.
ICE Awarded $20 Million No-Bid Contract for Electric Shock Gloves
Immigration and Customs Enforcement awarded a $20 million no-bid contract to outfit federal immigration officers with gloves capable of delivering electric shocks. Border Czar Tom Homan defended the deployment as providing officers with an alternative to lethal force when individuals are not compliant. The manufacturer's owner's manual references "Agitated Chaotic Event (ACE)" and includes references to excited delirium, a condition not recognized by the American Medical Association. Critics argue the equipment represents escalating violence in immigration enforcement as agencies have reduced training requirements while expanding arrest operations beyond traditional border patrol functions.
Federal contractors and critical infrastructure operators: Review email security controls and implement multi-factor authentication in response to Treasury Department sanctions against Iranian actors who compromised Department of Labor, FERC, and UN employee accounts. Verify network segmentation prevents lateral movement from email systems to operational environments.
Financial institutions: Enhance elder fraud monitoring by flagging unusual cash withdrawals or gold purchases by elderly customers, particularly when customers cite law enforcement directives. Update staff training on intervention protocols for social engineering scams following the $7.5 million money mule case.
Supervised banks and financial institutions: Establish internal procedures for identifying highly sensitive information in examination requests and designating regulatory contacts for escalation, following the Federal Reserve, FDIC, and OCC joint statement establishing the 72-hour breach notification requirement and heightened information protection framework.
Energy, water, and agricultural operators: Verify programmable logic controllers are segmented from IT networks, not internet-accessible, and updated with vendor security patches following FBI/NSA warnings about operational technology attacks and the Iranian power plant shutdown.
Marketing and consumer-facing platforms: Audit opt-out processing systems to ensure TCPA compliance and immediate suppression across all marketing channels following the TikTok class action alleging continued messaging after opt-out requests.