Legal & Privacy Brief - September 24, 2026

Today: The FBI is investigating a ShinyHunters breach of its jobs portal affecting current agents and applicants. Healthcare companies Modernizing Medicine and Amwell have agreed to settlements totaling $5 million over data breach and privacy violations. Missouri's congressional redistricting battle returns to the Supreme Court for the third time as the state seeks to implement a map favoring Republicans in November elections.

Enforcement Actions

Modernizing Medicine Data Breach Settlement

Modernizing Medicine Inc. (ModMed) agreed to a $2.99 million class action settlement over a data breach. Class members can receive up to $5,000 in compensation for compromised personal health information stored in the company's electronic medical records system.

• Compliance Action: Healthcare organizations using third-party electronic health record systems should review vendor security assessments and verify breach notification procedures are current under HIPAA requirements.
• Source: Top Class Actions

Amwell/LiveHealth Online Data Sharing Settlement

American Well Corp., operator of LiveHealth Online, agreed to a $2.03 million class action settlement to resolve claims it violated privacy laws by disclosing medical information to third parties without proper consent. The settlement addresses unauthorized sharing of protected health information with vendors and analytics partners.

• Compliance Action: Telehealth providers must audit all third-party data sharing arrangements to ensure business associate agreements are in place and patient consent mechanisms comply with state privacy laws beyond HIPAA.
• Source: Top Class Actions

Ryuk Ransomware Operator Sentenced

Armenian national Karen Vardanyan, 35, was sentenced to two years in federal prison after pleading guilty to conspiracy and fraud charges related to Ryuk ransomware operations. Vardanyan personally extorted over $1.2 million from victims and was part of a group that launched over 2,400 ransomware attacks worldwide, including against hospitals during the COVID-19 pandemic. The DOJ stated the group received at least $15 million in ransoms. Vardanyan will pay $1,219,106 in restitution and serve three years supervised release after extradition from Ukraine.

• Compliance Action: Organizations should review ransomware incident response plans and ensure offline backups are maintained. Healthcare entities should verify cybersecurity insurance covers ransomware scenarios and ransom payment decisions.
• Source: The Record

Litigation Updates

FBI Jobs Portal Breach Investigation

The FBI is investigating a breach of FBIjobs.gov by the ShinyHunters cybercriminal group, which defaced the website and claimed to have stolen information on current and former FBI employees and job applicants. ShinyHunters provided samples of 5,000 stolen FBI agent records to media outlets, which confirmed their legitimacy. The group threatened to leak information on every FBI agent unless the agency removes a May 2026 public service announcement disputing ShinyHunters' past claims. As of September 24, the FBI special agent application portal remains unavailable.

• Compliance Action: Federal contractors and agencies should immediately review application portals for vulnerabilities and implement multi-factor authentication on all personnel data systems. HR systems containing law enforcement personnel data require enhanced access controls.
• Source: The Record

Flock License Plate Reader Misuse Class Action

A new class action lawsuit alleges Flock's automated license plate readers are being misused by police officers to track individuals for personal reasons rather than legitimate law enforcement purposes. The complaint challenges Flock's security controls and oversight mechanisms that allegedly enable rogue officer tracking without proper audit trails or accountability.

• Compliance Action: Government agencies using automated license plate reader systems should audit access logs for unauthorized queries and implement role-based access controls with supervisory review requirements.
• Source: Top Class Actions

OpenAI ChatGPT Privacy Class Action

OpenAI faces a proposed class action alleging it failed to disclose that outside contractors may review ChatGPT users' conversations for model development purposes. The complaint contends this undisclosed human review violates user privacy expectations and potentially state wiretapping laws.

• Compliance Action: AI platform operators must review privacy policies to ensure clear disclosure of human review processes, contractor access to user data, and opt-out mechanisms. Update terms of service to specify data retention and model training practices.
• Source: Top Class Actions

Savage X Fenty Membership Fee Class Action

A class action lawsuit alleges Savage X Fenty charges consumers junk fees and causes membership credits to expire after 12 months without proper disclosure. The complaint challenges the lingerie brand's subscription practices and fee structures as deceptive under state consumer protection laws.

Source: Top Class Actions

Latvia Hacker Arrest for Extortion Campaign

Latvian police arrested a 23-year-old man suspected of hacking at least two companies, including electronics repair company TSC, by exploiting website vulnerabilities to steal personal data and extort payment. The suspect used automated tools to scan for security weaknesses and anonymous email accounts to demand ransom. Stolen information included customer names, contact details, device passcodes, bank account numbers, and building access codes. The suspect faces up to five years in prison.

Source: The Record

Regulatory Guidance

UK Ofcom Pornhub Age Verification Investigation

The UK communications regulator Ofcom announced an investigation into Pornhub parent company Aylo over concerns the firm is not complying with the Online Safety Act's age verification requirements. Ofcom believes Aylo may not have conducted sufficient due diligence before deploying a new age assurance method in May 2026 that relies on Apple device-level age checks. The investigation will examine whether Aylo's safeguards are "highly effective" as required by law. If found non-compliant, Ofcom can impose fines up to £18 million ($23.8 million) or 10% of qualifying worldwide revenue.

• Compliance Action: Adult content providers operating in the UK must document age verification effectiveness testing before deployment. U.S. states with similar age verification laws (Louisiana, Arkansas, Utah, Mississippi, Virginia) may adopt comparable enforcement approaches.
• Source: The Record

Privacy Developments

Intelligence Community Election Security Assessment

U.S. intelligence agencies completed a classified assessment finding no evidence of successful foreign interference in the 2024 presidential election, according to multiple sources. The report concluded Russia, Iran, and China each ran influence campaigns, with Moscow's efforts being the most significant. The assessment found foreign actors foregone technically challenging efforts to hack election infrastructure or tamper directly with votes, favoring influence campaigns instead. A public version is expected to be released soon.

Source: The Record

Policy Changes

Missouri Congressional Redistricting Supreme Court Case

Missouri's congressional redistricting battle returned to the Supreme Court for the third time as opponents of a 2025 map favoring Republicans asked the justices to block an 8th Circuit decision directing the state to use the new map in November 2026 elections. The dispute involves conflicts between state and federal court rulings, standing questions, and voter confusion claims. Missouri argued that denying a stay would provide stability after five court-ordered map changes. Justice Brett Kavanaugh directed responses by 2 p.m. EDT on September 25.

Source: SCOTUSblog | SCOTUSblog

Trump Immigration Detention Cases Return to Supreme Court

The Trump administration filed two new Supreme Court petitions on September 21 after the court dismissed the scheduled October case Genalo v. Black as moot. The new petition Genalo v. D.C. asks whether noncitizens detained under Section 1226(c) of the Immigration and Nationality Act have a Fifth Amendment due process right to bond hearings during extended detention. A second petition addresses district court authority over challenges to detention validity when claims also implicate removal grounds outside district court jurisdiction. The administration requested the court add these cases to the 2026-27 oral argument docket.

Source: SCOTUSblog | SCOTUSblog

Compliance Takeaways

• Healthcare data breach settlements: Organizations using third-party EHR systems and telehealth platforms must audit vendor security controls and data sharing arrangements. Ensure business associate agreements are current and patient consent mechanisms comply with state privacy laws beyond HIPAA.
• Age verification enforcement: Adult content providers and platforms serving minors must document age verification effectiveness testing before deployment. UK Ofcom enforcement signals increasing regulatory scrutiny of age assurance methods globally.
• Government application portal security: Federal contractors and agencies should immediately review application portals for vulnerabilities and implement multi-factor authentication on all personnel data systems, especially those containing law enforcement or security clearance information.
• AI platform privacy disclosures: AI platform operators must review privacy policies to ensure clear disclosure of human review processes, contractor access to user data, and opt-out mechanisms. Update terms of service to specify data retention and model training practices.
• Ransomware incident response: Review ransomware incident response plans and ensure offline backups are maintained. Healthcare entities should verify cybersecurity insurance covers ransomware scenarios and ransom payment decisions, given continued prosecutions of ransomware operators.