Issue #16 | October 2026, Week 5
October 27, 2026From a 12-year-old test account to a $25B Meta verdict, regulators are hammering companies over sloppy data hygiene. A massive global wave of fines hits banks, telcos, and gene labs for leaking everything from kids’ records to DNA.
ICO reprimands two organizations after a ransomware attack exposed children’s data
- Jurisdiction
- United Kingdom
- Infringer Legal Name
- Ogi Networks Limited; Data Cymru
- Infringer Domicile
- United Kingdom
- Alleged Violation
- A data breach
- Enforcement Action
- A reprimand
- Case Status
- An administrative action
The UK’s Information Commissioner’s Office (ICO) has reprimanded Ogi Networks Limited (ONL) and Data Cymru following a ransomware attack that exposed the personal information of 3,300 people, most of whom were children.
The attack took place on 1 November 2024 and encrypted 182.7GB of data, with 42GB stolen from Data Cymru’s systems. The information was linked to two projects supporting children and families.
The investigation found that the attackers exploited a test account called ‘Test2’, which had existed for more than 12 years. The account was protected by the password “Password1.”
The regulator found that ONL failed to maintain appropriate security measures and carry out regular checks of its systems. Data Cymru was also found to have failed to properly manage its relationship with ONL, review user accounts regularly and ensure the test account was removed or secured.
Both organizations have since taken steps to improve their security. ONL introduced regular account reviews and stronger access controls, including multi-factor authentication. The two organizations also signed a legally compliant data processing contract. Data Cymru introduced periodic account reviews and strengthened its access controls.
Frontier to pay $625,000 over a data breach impacting 59,000 Connecticut residents
- Jurisdiction
- United States
- Infringer Legal Name
- Frontier Communications
- Infringer Domicile
- United States
- Alleged Violation
- A data breach
- Enforcement Action
- A $625,000 fine
- Case Status
- An administrative action
Verizon-owned Frontier Communications has agreed to pay $625,000 to settle a data breach that exposed the personal information of 58,841 Connecticut residents in 2024.
The breach was discovered in April 2024, when hackers gained access to Frontier’s internal IT systems using stolen login details belonging to employees and vendors. An investigation found that the attackers had stolen unencrypted personal information, including Social Security numbers. The data was later offered for sale on the Dark Web.
An investigation also found weaknesses in Frontier’s security, including poor access controls, limited monitoring, and problems with encryption and employee training.
As part of the settlement with the Connecticut Attorney General’s Office, Frontier must pay the fine and improve its security measures, including stronger password rules, multi-factor authentication, employee training, and better systems to detect and prevent attacks.
Separately, Frontier agreed to a $5.64 million settlement in a related class-action lawsuit in Texas. The agreement covers around 750,000 people across the United States and includes two years of free credit monitoring.
23andMe successor settles with California for $6M
- Jurisdiction
- United States
- Infringer Legal Name
- Chrome Holding Co
- Infringer Domicile
- United States
- Alleged Violation
- A data breach
- Enforcement Action
- A $6 million settlement
- Case Status
- An administrative action
Chrome Holding Co, formerly known as 23andMe has agreed to pay the state of California $6 million over allegations of poor cybersecurity that contributed to a major data breach in 2023. The breach exposed sensitive personal and genetic information belonging to nearly 7 million people.
The settlement also ensures that affected customers can still request their data to be deleted and their genetic samples destroyed. The agreement is awaiting approval by a US bankruptcy court.
In March 2025, 23andMe filed for bankruptcy and sold customer genetic data and saliva samples to the nonprofit TTAM Research Institute, founded by a former CEO. California officials challenged the sale, arguing that customers should give explicit consent before their genetic information is transferred.
Meta ordered to pay $25 billion in a New Mexico privacy case
- Jurisdiction
- United States
- Infringer Legal Name
- Meta
- Infringer Domicile
- United States
- Alleged Violation
- Data privacy violation
- Enforcement Action
- A $25 billion fine
- Case Status
- An administrative action
Meta has been ordered to pay a $25 billion penalty in New Mexico following a data privacy case linked to the Cambridge Analytica scandal.
A jury in Santa Fe found the company liable in September 2026 for misleading New Mexico residents about how it collects and protects personal data and prevents harmful content from spreading on its platforms.
The jury identified more than 43 million violations of the state's unfair practices law. Each violation could carry a civil penalty of up to $5,000.
According to a court filing, the state was awarded $219.5 billion before the penalty was reduced to $25 billion.
South Africa fines two organizations for exposing personal info
- Jurisdiction
- South Africa
- Infringer Legal Name
- Multiple entities
- Infringer Domicile
- South Africa
- Alleged Violation
- Data breach
- Enforcement Action
- A fine of R1 million; a fine of R500,000, respectively
- Case Status
- An administrative action
The Information Regulator of South Africa has fined First National Bank (FNB) R1 million (€53,750) for failing to protect customers’ personal information.
The bank has 30 days to pay the fine after the regulator found that it had breached several provisions of the Protection of Personal Information Act (POPIA).
The investigation was launched following a security incident related to FNB’s digital home loan application platform that exposed customers’ personal information, including bank account numbers.
The regulator found weaknesses in the bank’s security systems and its handling of repeated security incidents, as well as protecting and storing customers’ information.
According to the regulator, FNB breached sections 5, 8, 12, 14, 15 and 19 of POPIA. The bank was also found to have committed an offense under section 105 for failing to implement measures to prevent illegal access to personal information.
In a separate case, the regulator fined Central Johannesburg TVET College R500,000 (€26,875) for sharing personal information with third parties without a lawful reason.
Disclaimer: The information in this blog is provided from open and governmental sources. We respectfully remind our readers about the presumption of innocence. The information herein is provided for educational purposes only and does not constitute legal opinion or advice.