Get tomorrow's brief in your inbox
Today: The Department of Justice and U.K. National Crime Agency formalized coordination to dismantle Southeast Asian scam compounds stealing $12 billion annually from Americans. RFK Jr. pushed states to share medical records for vaccine investigations despite scientific consensus vaccines do not cause autism. The U.S. and G7 cybersecurity agencies warned organizations to begin migrating to post-quantum cryptography now to defend against harvest-now-decrypt-later attacks.
U.S. and U.K. Sign Memorandum to Coordinate Scam Center Takedowns
The Department of Justice and U.K. National Crime Agency signed a memorandum of understanding on September 4 to conduct parallel investigations and share intelligence on Chinese organized crime syndicates operating cyber scam compounds in Myanmar, Cambodia, and Laos. The Scam Center Strike Force, which has over 150 personnel including FBI and IRS agents, secured its largest success to date by disrupting Prince Group and seizing approximately $15 billion in bitcoin linked to CEO Chen Zhi. Cyber-enabled fraud accounted for 85% of all FBI-reported losses in 2025, totaling over $12 billion from Americans, though the figure likely undercounts unreported incidents.
State Department Offers $10 Million Reward for Iranian IRGC Cyber Commander
The State Department on September 4 posted a $10 million reward for information on Amir Yaryab, who allegedly leads the Islamic Revolutionary Guard Corps Cyber-Electronic Command. Yaryab directs multiple Iranian hacking groups including CyberAv3ngers, Shahid Hemmat, and Shahid Shushtari, which have targeted critical infrastructure including water utilities, defense contractors, energy systems, and telecommunications providers in the U.S., Europe, and the Middle East. Since late July 2026, Iranian hackers have breached more than 100 water utilities across at least 12 U.S. states, and the Justice Department has accused Iran of compromising employee email accounts at the Department of Labor, Federal Energy Regulatory Commission, and multiple UN organizations.
$5.25 Million Americold Data Breach Settlement
Americold agreed to pay $5.25 million to resolve class action claims that it failed to prevent two data breaches in 2020 and 2023.
Harvard Reaches $53 Million Settlement Over Medical School Morgue Theft
A proposed $53 million settlement would resolve more than a dozen consolidated lawsuits accusing Harvard of failing to protect remains donated to its Anatomical Gift Program.
Social Media Lawsuit Dropped After ChatGPT Discovery Reveals Get-Rich-Quick Motive
A teenager identified as RKC dropped his lawsuit against Meta, TikTok, Snap, and YouTube days before trial after discovery revealed he asked ChatGPT what his father meant by saying the case would make him a million dollars. Meta obtained ChatGPT transcripts showing the teen's father told him "I'm will get a settlement worth of 1million dollar. If that doesn't make me happy what does." Snap, TikTok, and YouTube settled before trial. The case highlights concerns that some plaintiffs are exploiting children for contingency-fee paydays rather than addressing genuine harm.
FragranceNet Class Action Over Unsolicited Text Messages
A new class action claims FragranceNet sent unsolicited text messages to consumers' phone numbers registered on the National Do-Not-Call Registry, alleging violations of the Telephone Consumer Protection Act.
G7 and CISA Urge Organizations to Prepare for Quantum Cyber Threats
The G7 Cyber Security Working Group and CISA on September 4 released a joint advisory urging governments and companies to begin migrating to post-quantum cryptography now, warning that attackers can already steal encrypted information and store it for decryption once quantum computers become available. The harvest-now-decrypt-later threat is particularly relevant for data requiring long-term secrecy including government records, personal information, and corporate trade secrets. The advisory recommends identifying systems containing sensitive information and critical assets, prioritizing them for migration, and incorporating quantum-resistant technology into routine upgrades rather than wholesale system replacement. Waiting could result in competitive disadvantage or exclusion from government contracts.
Russian Data Centers Face New Security Requirements Amid Drone Threats
Russian President Vladimir Putin signed a decree in late August allowing the government to temporarily seize critical infrastructure if operators fail to adequately protect facilities from drone attacks. The decree covers energy, telecommunications, transportation, utilities, and data centers hosting government, banking, and major service provider systems. Some Russian data centers have already begun strengthening defenses around external engineering equipment. Industry experts warned the requirements will significantly increase capital expenditures, ultimately raising costs for end users.
RFK Jr. Seeks State Medical Records for Vaccine-Autism Investigation
Health and Human Services Secretary Robert F. Kennedy Jr. has since spring 2025 sought federal access to Americans' medical records to investigate whether vaccines cause autism, despite decades of scientific research showing they do not. According to KFF Health News, HHS has been courting state health information exchanges to access detailed, identifiable patient data. HIPAA permits release of health information without patient consent for roughly a dozen categories including public health reporting, law enforcement, research, and essential government functions. Once data leaves the HIPAA-covered system, HIPAA protections fall away. Prescription drug monitoring programs, which every state operates, can be accessed by federal law enforcement with self-issued administrative subpoenas requiring no judicial approval. These programs have expanded beyond opioids into dragnet surveillance sharing health data across state lines, exposing patients seeking reproductive or gender-affirming healthcare to surveillance far from home.
U.K. Account-Hack Losses Surge 417% as New Reporting System Exposes Hidden Cases
The City of London Police reported that victims lost £6.3 million ($8.5 million) to hacked email and social media accounts in the year ending March 31, up 417% from £1.2 million the prior year. The number of victims reporting financial loss rose from 226 to 2,325, an increase of 929%. The increases coincide with the rollout of Report Fraud, which replaced the widely criticized Action Fraud system in January. Police said 92% of account-hacking reports involving financial loss were recorded in the second half of the financial year, directly overlapping with the new platform launch. The jump reflects more incidents being identified and recorded rather than necessarily matching a real-world increase in offenses. Report Fraud recorded 64,608 cyber-dependent crime reports during 2025-26, up 34%, with account hacking accounting for 44,355 reports.
ChatGPT Conversations Swept Into Discovery in Litigation
Federal courts are treating ChatGPT conversations as discoverable evidence in litigation. In the RKC v. Meta case, a teenager's ChatGPT query asking what his father meant by promising a million-dollar settlement became evidence that undermined the lawsuit's credibility, leading to the case being dropped days before trial.
Trump Administration Moves to Strip Tax Exemption from Schools Considering Race
The IRS and Treasury Department on September 4 announced plans to eliminate tax-exempt status for any private school that discriminates on the basis of race, color, or national or ethnic origin in administration of educational, admissions, scholarship, athletic, or other policies. The move escalates the Trump administration's efforts to prevent schools from considering race in admissions and other campus life areas.
Supreme Court Hears Challenge to State AR-15 Bans in December
The Supreme Court will hear consolidated challenges to AR-15 and semiautomatic rifle bans on December 2 in Viramontes v. Cook County and Grant v. Higgins. The cases challenge bans in Cook County, Illinois and Connecticut enacted after the 2012 Sandy Hook shooting. Lower courts upheld both bans against Second Amendment challenges.
Begin post-quantum cryptography migration now. Inventory systems containing data requiring protection beyond 10 years. Prioritize asymmetric keys, certificates, and sensitive government or healthcare data for migration to quantum-resistant algorithms. The G7 and CISA warn harvest-now-decrypt-later attacks are already occurring.
Review medical data-sharing agreements. Healthcare providers should document legal basis for any releases to federal agencies through state health information exchanges and prescription monitoring programs. Evaluate whether state privacy laws provide additional protections beyond HIPAA.
Implement physical security for critical infrastructure. Water utilities, energy systems, and telecommunications providers should review access controls on operational technology, implement network segmentation, and audit employee accounts for Iranian intrusion indicators following DOJ warnings of attacks on 100+ water utilities across 12 states.
Treat AI chatbot conversations as discoverable. Implement data retention policies covering ChatGPT and other AI assistant interactions. Train employees not to use chatbots for sensitive business or litigation matters.
Monitor transaction patterns for scam indicators. Financial institutions should enhance monitoring for romance and investment fraud tied to Southeast Asian scam operations, particularly cryptocurrency flows through Chinese front companies, following DOJ-U.K. coordination announcement.