Legal & Privacy Brief

Today: GEICO will pay $1.65 million to settle claims it failed to investigate inaccurate credit reports sent to LexisNexis. The Supreme Court dismissed an immigration detention case after New York's governor pardoned the petitioner. Florida banned license plate readers from state highways amid growing backlash against Flock Safety's surveillance network.

Enforcement Actions

$1.65M GEICO Credit Reporting Settlement

GEICO agreed to pay $1.65 million to resolve claims it failed to properly investigate and correct inaccurate insurance information reported to LexisNexis Risk Solutions. The settlement addresses violations of the Fair Credit Reporting Act's requirements for furnishers of consumer information to maintain accurate records and investigate disputes.

• Compliance Action: Review credit reporting procedures for accuracy and dispute resolution processes. Ensure mechanisms exist to investigate consumer challenges to reported information within FCRA timelines.
• Source: Top Class Actions

Highlands Oncology Group Data Breach Settlement

Highlands Oncology Group reached a class action settlement offering up to $4,250 for documented losses, $50 for class members without losses, and three years of medical data monitoring following a data breach affecting patient health information.

• Source: Top Class Actions

Florida DMV Breach Linked to Stolen Police Credentials

The Florida Department of Highway Safety and Motor Vehicles confirmed a data breach after an international cybercriminal organization (ShinyHunters) obtained credentials improperly stored on a Plant City Police Department employee's personal device. The breach was discovered September 4, 2026.

• Compliance Action: Audit law enforcement and government employee access to sensitive databases. Implement policies prohibiting storage of system credentials on personal devices. Review access controls and multi-factor authentication requirements for motor vehicle records systems.
• Source: The Record

Litigation Updates

Hims & Hers Health Website Tracking Class Action

Hims and Hers Health faces a class action alleging the company used web tracking technologies to gather and disclose consumers' sensitive health information to third parties without consent, raising HIPAA and state privacy law claims.

• Compliance Action: Audit third-party tracking pixels and analytics tools on healthcare and telehealth websites. Review Business Associate Agreements and ensure tracking technologies do not transmit protected health information to unauthorized parties.
• Source: Top Class Actions

Venmo Users Sue PayPal Over Financial Data Disclosure

PayPal, operating as Venmo, faces a class action alleging the company shared private user financial transaction data with third parties without obtaining user consent, violating state privacy statutes and the company's own privacy policies.

• Source: Top Class Actions

Ram 2025 Truck Engine Defect Class Action

FCA US faces a class action alleging the company sold 2025 model year Ram 1500 trucks while knowing the vehicles contained a dangerous engine defect, raising product liability and consumer protection claims.

• Source: Top Class Actions

Regulatory Guidance

Florida Bans License Plate Readers on State Highways

Florida's Department of Transportation revoked previous permits for automated license plate reader cameras on state highways and will no longer issue new permits within its jurisdiction. Governor Ron DeSantis stated the use of automated license plate readers has "gotten out of control." The ban applies only to state-level infrastructure; local jurisdictions may continue operating cameras on municipal roads.

• Compliance Action: Law enforcement agencies using Flock Safety or similar ALPR systems in Florida should verify camera locations comply with the new state highway restrictions. Review data retention policies and access logs, as Flock recently implemented mandatory reporting features to prevent officer misuse.
• Sources: TechDirt

California Digital Literacy and Cybersecurity Education Laws (AB 2071, AB 2298)

Governor Newsom signed AB 2071 and AB 2298, requiring California schools to integrate digital wellness into middle and high school health classes and add cybersecurity concepts to recommended curricula. AB 2071 teaches students to identify unhealthy tech habits, protect personal safety, and evaluate digital content including AI-generated media for credibility and bias. AB 2298 adds cybersecurity instruction on safeguarding personal data from online threats.

• Compliance Action: California school districts should update health and technology curricula to incorporate digital literacy, privacy protection, and cybersecurity skills by the laws' effective dates. Review existing programs for compliance gaps.
• Source: EFF Deeplinks

Privacy Developments

Amazon Ring's "Throw Away the Key Encryption" Falls Short of End-to-End Protection

Amazon introduced "Throw Away the Key Encryption" (TAKE) for Ring cameras, claiming improved privacy by deleting encryption keys after 24 hours. EFF analysis found the system allows Ring to access unencrypted video for 24 hours to process features like smart alerts and video search, making it "barely different from encryption at rest where the server holds the keys." Account recovery keys are stored in cameras by default, and law enforcement could compel mass searches across cameras for specific terms, then seize cameras to decrypt account backups and video content.

• Compliance Action: Organizations deploying Ring or similar IoT security cameras should evaluate whether TAKE provides sufficient privacy protection for their security posture. Consider true end-to-end encryption solutions where cloud provider access to video content is unacceptable.
• Source: EFF Deeplinks

AI-Enhanced Business Email Compromise Scams

Microsoft detected a campaign of over one million fraudulent emails in early August targeting accounts payable departments with AI-generated executive impersonation and fake invoices. The campaign impersonated CEOs and ServiceNow, requesting fraudulent payments of nearly $50,000. Microsoft found indicators "consistent with AI-assisted template development" including extensive HTML comments, structured section labeling, and uniform template construction. 88% of targets are American organizations.

• Compliance Action: Update email security training to address AI-enhanced social engineering. Implement out-of-band verification requirements for payment requests exceeding defined thresholds, regardless of apparent sender authority. Review email authentication controls (SPF, DKIM, DMARC) and consider behavioral analysis tools to detect template-based campaigns.
• Source: The Record

Anthropic Detects Russia-Linked Spies Using Claude AI in Hacking Operations

Anthropic detected and disrupted Midnight Blizzard (APT29, attributed to Russia's Foreign Intelligence Service) using its Claude AI tool in cyber-espionage campaigns targeting over 20 government, intelligence, diplomatic and defense organizations. The group compromised hotel Wi-Fi providers, targeted Ukrainian government and military entities, stole proprietary drone software development kits, and used Claude to reverse-engineer drone vision systems and bypass security detections. Anthropic also observed ShinyHunters affiliates using AI to move from stolen developer tokens to full cloud administrative access in three hours.

• Compliance Action: Review AI acceptable use policies and monitoring for misuse indicators. Organizations in defense, intelligence, and critical infrastructure sectors should assume adversaries are using AI to accelerate reconnaissance, reverse engineering, and detection evasion. Implement behavioral monitoring for rapid privilege escalation patterns consistent with AI-assisted attacks.
• Source: The Record

Policy Changes

Supreme Court Dismisses Immigration Detention Bond Hearing Case (Genalo v. Black)

The Supreme Court dismissed Genalo v. Black, which had been scheduled for October argument on whether noncitizens detained under 8 U.S.C. Section 1226(c) have a right to bond hearings during lengthy detention. The case became moot after New York Governor Kathy Hochul pardoned the petitioner's assault conviction, removing the basis for his mandatory detention. The Solicitor General indicated the Justice Department aims to bring the issue back to the Court in a new petition.

• Source: SCOTUSblog

DHS Reduces Nevada Non-Citizen Voter Claims from 16,000 to 185

DHS initially claimed it found 16,000 noncitizens on Nevada's voter rolls but subsequently acknowledged only 185 voter IDs as "confident" matches requiring manual review, a 99% false positive rate. DHS declined to provide Nevada with supporting data for the 185 alleged matches and continues to claim 14,000 voters need additional review and another 6,000 are "higher confidence" matches pending review, despite the massive discrepancy.

• Compliance Action: State election officials should demand detailed methodology and supporting evidence for any federal voter eligibility challenges before taking action. Document false positive rates and require independent verification before removing voters from rolls.
• Source: TechDirt

Ukrainian Conti Ransomware Member Sentenced to Four Years

Oleksii Lytvynenko, 44, received a four-year U.S. prison sentence for his role as a hacker and developer for the Conti ransomware operation. Conti attacked organizations in 47 U.S. states and 31 countries between 2020 and 2022, extracting over $150 million in ransoms. Forensic evidence showed Lytvynenko continued ransomware operations after Conti's shutdown in 2022.

• Source: The Record

Compliance Takeaways

• Credit Reporting Accuracy: Audit procedures for reporting consumer information to credit bureaus and data brokers like LexisNexis. Implement dispute investigation processes complying with FCRA timelines and accuracy requirements.
• Website Tracking and Health Data: Remove third-party tracking pixels and analytics tools that transmit protected health information or sensitive personal data without explicit consent. Review Business Associate Agreements for HIPAA compliance.
• Credentials on Personal Devices: Prohibit storage of system credentials on personal devices. Implement multi-factor authentication and audit access to sensitive databases, particularly motor vehicle records and law enforcement systems.
• AI-Enhanced Social Engineering: Update payment authorization workflows to require out-of-band verification for requests exceeding defined thresholds. Train staff to recognize AI-generated executive impersonation and template-based campaigns.
• License Plate Reader Compliance: Verify ALPR camera locations comply with Florida's state highway ban. Review data retention policies and access controls following widespread customer cancellations and abuse concerns.