354 articles · page 5 of 18
Week of 24 March 2025
Why the Signal group chat was a channel design failure before it was a leak
A journalist in a senior officials’ chat made the headlines. For agencies at every level, the durable failure was a sanctioned channel that could not set content boundaries, verify participants and keep the record at the same time.
Week of 17 March 2025
23andMe’s bankruptcy turned a privacy policy into a term of sale
Once 23andMe entered Chapter 11, its privacy promises stopped being a disclosure and turned into a condition that courts, states and bidders had to price. Anyone holding or sharing health-adjacent data should write contracts with that ending in mind.
Week of 10 March 2025
Medusa showed that a clinic’s remote-support software is its ransomware attack surface
The March 2025 Medusa advisory read like a catalog of the remote-access and management products hospitals and clinics depend on. Defending against it means governing those tools at three points: entry, movement and evasion.
Week of 3 March 2025
HHS’s end of voluntary comment periods hit grantees hardest and Medicare providers least
By rescinding the Richardson Waiver, HHS stopped offering notice and comment where the law did not require it. The loss of warning fell unevenly: heavily on grant recipients, moderately on contractors, and lightly on Medicare providers, whose statute still requires comment.
Week of 24 February 2025
The House budget vote signaled Medicaid churn, a cost hospitals pay at the front desk
The February 2025 budget resolution started the path to the year’s Medicaid changes. Beyond lost revenue, more frequent eligibility checks and work requirements would raise the cost of knowing who is covered, at registration, in enrollment support and in the revenue cycle.
Week of 17 February 2025
Bybit’s signers approved what their screens showed, which was not what they signed
The largest crypto theft on record defeated multi-signature approval without breaking it, by altering the interface the signers trusted. Banks approving payments through software face the same risk at four points: how the interface is built, what approvers see, how payments are verified, and recovery.
Week of 10 February 2025
With the CFPB paused, banks lost the outside signals their customer programs relied on
The February 2025 stop-work order did not change consumer law. It removed three things the Bureau had supplied to firms almost for free: exam deadlines that forced fixes, published findings about peers, and federal follow-up on complaints. Firms had to replace each themselves.
Week of 3 February 2025
In the Treasury payment access dispute, “read-only” was a claim until the records proved it
Setting the politics aside, the fight over new access to Treasury’s payment systems played out in sworn filings about who had which permissions. It showed that privileged access governance rests on four separate controls, and that each must be provable, not just stated.
Week of 27 January 2025
DeepSeek arrived in three forms in one week, and each needed a different control
Within days, the same DeepSeek model reached organizations as a consumer app, a developer API and open weights on U.S. clouds. Blanket bans treated them as one risk. They were three: shadow use, data jurisdiction and model behavior, each owned by a different team.
Week of 20 January 2025
Revoking the AI executive order could not revoke the AI inventory, because Congress had written it
On inauguration day the 2023 AI executive order was revoked, and replacement guidance was weeks away. Agency AI programs could sort their work by legal footing: what rested only on the order, what rested on OMB memoranda awaiting revision, and what statute required regardless.
Week of 13 January 2025
DORA’s register of information made every bank a data supplier to EU oversight of its vendors
DORA’s register of ICT third-party arrangements looked like paperwork. It was a dataset supervisors would aggregate to find concentration and designate critical providers, so its quality rested on three data problems most vendor programs had never solved: identity, dependency and depth.
Week of 6 January 2025
Under FDA’s change-control model, the AI device a hospital validates will not stay the one it runs
FDA’s January 2025 draft on AI-enabled devices, read with its December change-control guidance, assumed devices keep changing after purchase. Hospitals face three kinds of post-purchase change, pre-authorized updates, updates needing new review, and shifts in their own environment, and each needs a different control.
Week of 30 December 2024
Treasury’s breach ran through a remote-support key the agency never held
Attackers reached Treasury workstations with a stolen key that secured a vendor’s cloud remote support service. Remote support is privileged access by another name, and governing it takes four controls along the path from vendor to endpoint, most of which agencies only partly had.
Week of 23 December 2024
The HIPAA Security Rule proposal’s hardest line was a 72-hour restore
HHS’s proposed overhaul turned flexible safeguards into specific requirements. Sorted by difficulty, most were controls hospitals already had or evidence they could build. Recovery within 72 hours was different: it needed clinical sequencing, tested capacity and money few systems had budgeted.
Week of 16 December 2024
CISA’s encryption advice and the SEC’s recordkeeping cases asked for the same channel
After the Salt Typhoon telecom intrusions, CISA told targeted people to use end-to-end encrypted messaging, just as off-channel penalties weighed on broker-dealers. The two demands conflict only on channels the firm does not control. An approved channel must be encrypted, captured and usable.
Week of 9 December 2024
In the RIBridges breach, Rhode Island owned the outage and its vendor owned the evidence
When attackers breached the vendor-run RIBridges benefits system, the state carried public accountability while the vendor held the systems, logs and forensic work. Contracts for such systems must settle visibility, decision rights, costs and exit before an incident, not during one.
Week of 2 December 2024
The CFPB’s data broker proposal exposed a provenance gap that AI programs inherit
The proposal to treat many data brokers as consumer reporting agencies was withdrawn within six months. Its underlying question, where personal data came from and what it may be used for, applies to data entering, leaving and being repurposed inside every AI program.
Week of 25 November 2024
Blue Yonder put process-running vendors at the top of the risk register
The Blue Yonder ransomware attack disrupted staff scheduling and pay at major retailers. Vendor risk programs built around data protection miss suppliers whose failure stops work, and classifying vendors by what their failure costs changes diligence, contracts and contingency spending.
Week of 18 November 2024
The CFPB reached for payment apps while the customer’s money sat at partner banks
The larger-participant rule gave federal examiners access to big payment apps and lasted under six months. With Synapse’s collapse fresh, the more durable exposure sat elsewhere: in the law apps already owed and in the banks holding their customers’ funds.
Week of 11 November 2024
FinCEN’s deepfake alert was a job-design problem for three groups of staff
FinCEN’s November 2024 alert read like a list of red flags for compliance teams. Its harder implication was for the people whose jobs let them act on recognition: onboarding reviewers, service agents and payment operators each needed new decision rights, incentives and escalation paths.