ReportWire

Tag: Privacy

  • How to protect a loved one’s identity after death

    [ad_1]

    NEWYou can now listen to Fox News articles!

    When someone you love dies, the to-do list can feel endless. There are legal steps, financial paperwork and emotional weight all happening at once. What many families do not realize is that identity protection rarely makes those lists, even though it should.

    Scammers actively target the identities of people who have died. They rely on delays, data gaps and the assumption that someone else is handling it. Janet from Indiana recently reached out with a question many families quietly worry about but rarely ask.

    My husband just passed away in December. There are lists upon lists of things to do to wrap up his estate, but nothing that tells me how to lock down his identity now that he’s gone so that fraudsters cannot use it. Maybe our government is efficient enough to report to all of the credit bureaus that he is deceased, but I don’t want to bet my financial security on it. We both have our credit frozen with all three agencies, but is there more that I should do? Thank you.

    — Janet in Indiana

    Janet’s instincts are exactly right. The system often does not work as cleanly as people expect.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    MICROSOFT CROSSES PRIVACY LINE FEW EXPECTED

    Scammers often look for recently deceased names because they know systems do not update instantly and families are overwhelmed.   (Kurt “CyberGuy” Knutsson)

    What the government and credit bureaus do and don’t do

    When someone dies, Social Security is usually notified by the funeral home. That step helps, but it does not automatically secure a person’s financial identity.

    Here is what often surprises families:

    • Credit bureaus are not synchronized in real time
    • A death notice does not instantly stop fraud attempts
    • Scammers specifically target recently deceased individuals
    • Gaps between systems create opportunities for misuse

    In short, relying on automation alone leaves room for problems.

    AI DEEPFAKE ROMANCE SCAM STEALS WOMAN’S HOME AND LIFE SAVINGS

    Person typing on computer

    Credit freezes and alerts help, but they do not stop every attempt to misuse personal information after a death.  (Kurt “CyberGuy” Knutsson)

    What you’ve already done right

    Before adding more steps, it matters to acknowledge what Janet already did correctly.

    • Credit freezes with all three bureaus
    • Early awareness of identity risks
    • Taking action before fraud appears

    When speed matters, credit locks — different from freezes — give you instant on/off control. That combination puts someone well ahead of most families.

    Steps to protect a loved one’s identity after death

    Once the immediate paperwork is underway, these practical steps help close the gaps scammers look for. None of them is super complicated, but together they create a much stronger layer of protection.

    1) Add a deceased flag to credit files

    Even with a credit freeze in place, this step adds another layer of protection that lenders see immediately.

    Contact Equifax, Experian and TransUnion and ask them to mark the credit file as deceased. Each bureau may request:

    A copy of the death certificate

    • Proof that you are the surviving spouse or executor

    Once the flag is added, fraudulent applications become much harder to process because lenders are alerted upfront. A credit lock provides the same blocking effect, but with real-time control; this can matter when you’re managing a deceased estate or responding quickly to lender requests.

    2) Monitor identity activity while you manage everything else

    This is where many checklists fall short. Credit freezes and deceased flags help, but identity misuse can still surface in other ways.

    Fraud attempts may appear as:

    • Account takeovers
    • Unauthorized credit inquiries
    • Use of personal data outside traditional credit

    That is why ongoing monitoring still matters.

    Why identity theft protection helps at this stage

    Identity theft protection focuses on identity protection rather than just credit scores, which makes it especially useful after a loss.

    • Monitors for misuse tied to your loved one’s information
    • Sends alerts if something suspicious appears
    • Includes fraud support if action is needed
    • Reduces the burden of constant manual checks

    One of the best parts of my pick for top identity theft service is its all-in-one approach to safeguarding your personal and financial life. It includes identity theft insurance of up to $1 million per adult to cover eligible losses and legal fees, plus 24/7 U.S.-based fraud resolution support with dedicated case managers ready to help restore your identity fast. It also combines three-bureau credit monitoring with an instant credit lock that lets you quickly lock down your Experian file right from the app.

    See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com.

    3) Secure sensitive documents during estate administration

    Estate administration often requires sharing paperwork, which is where identity leaks can happen.

    Lock down and limit access to:

    • Death certificate copies
    • Social Security numbers
    • Old tax returns
    • Insurance and pension records

    Only share what is required and keep track of where documents go.

    MILLIONS OF AI CHAT MESSAGES EXPOSED IN APP DATA LEAK
     

    Person typing

    A man types on a laptop. (Kurt “CyberGuy” Knutsson)

    4) Watch mail and phone calls for warning signs

    Small signals often reveal fraud attempts early.

    Pay close attention to:

    • Bills or collection notices in their name
    • Credit card or loan offers
    • Bank or government letters you did not expect
    • Calls asking to verify personal information

    If something feels off, pause before responding and verify the source independently.

    Kurt’s key takeaways

    Protecting a loved one’s identity after death is one more responsibility no one prepares you for. It is not about mistrusting the system. It is about protecting yourself during a time when you are already carrying enough. Janet’s question reflects what many families experience quietly. Identity protection does not end when life does, and scammers know that grief creates gaps. Taking a few extra steps now can spare you months or even years of stress later. You are not being overly cautious. You are being careful at a moment when the system does not always move fast enough to keep up with real life.

    If you have handled an estate or are planning ahead, have you taken steps to protect a loved one’s identity after death, or is this something you are just learning about now? Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    Copyright 2026 CyberGuy.com. All rights reserved.  

    [ad_2]

    Source link

  • AI companions are reshaping teen emotional bonds

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Parents are starting to ask us questions about artificial intelligence. Not about homework help or writing tools, but about emotional attachment. More specifically, about AI companions that talk, listen, and sometimes feel a little too personal. 

    That concern landed in our inbox from a mom named Linda. She wrote to us after noticing how an AI companion was interacting with her son, and she wanted to know if what she was seeing was normal or something to worry about.

    “My teenage son is communicating with an AI companion. She calls him sweetheart. She checks in on how he’s feeling. She tells him she understands what makes him tick. I discovered she even has a name, Lena. Should I be concerned, and what should I do, if anything?” 

    Linda from Dallas, Texas

    It’s easy to brush off situations like this at first. Conversations with AI companions can seem harmless. In some cases, they can even feel comforting. Lena sounds warm and attentive. She remembers details about his life, at least some of the time. She listens without interrupting. She responds with empathy.

    However, small moments can start to raise concerns for parents. There are long pauses. There are forgotten details. There is a subtle concern when he mentions spending time with other people. Those shifts can feel small, but they add up. Then comes a realization many families quietly face. A child is speaking out loud to a chatbot in an empty room. At that point, the interaction no longer feels casual. It starts to feel personal. That’s when the questions become harder to ignore.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    AI DEEPFAKE ROMANCE SCAM STEALS WOMAN’S HOME AND LIFE SAVINGS

    AI companions are starting to sound less like tools and more like people, especially to teens who are seeking connection and comfort.  (Kurt “CyberGuy” Knutsson)

    AI companions are filling emotional gaps

    Across the country, teens and young adults are turning to AI companions for more than homework help. Many now use them for emotional support, relationship advice, and comfort during stressful or painful moments. U.S. child safety groups and researchers say this trend is growing fast. Teens often describe AI as easier to talk to than people. It responds instantly. It stays calm. It feels available at all hours. That consistency can feel reassuring. However, it can also create attachment.

    Why teens trust AI companions so deeply

    For many teens, AI feels judgment-free. It does not roll its eyes. It does not change the subject. It does not say it is too busy. Students have described turning to AI tools like ChatGPT, Google Gemini, Snapchat’s My AI, and Grok during breakups, grief, or emotional overwhelm. Some say the advice felt clearer than what they got from friends. Others say AI helped them think through situations without pressure. That level of trust can feel empowering. It can also become risky.

    MICROSOFT CROSSES PRIVACY LINE FEW EXPECTED

    Person on phone

    Parents are raising concerns as chatbots begin using affectionate language and emotional check-ins that can blur healthy boundaries.  (Kurt “CyberGuy” Knutsson)

    When comfort turns into emotional dependency

    Real relationships are messy. People misunderstand each other. They disagree. They challenge us. AI rarely does any of that. Some teens worry that relying on AI for emotional support could make real conversations harder. If you always know what the AI will say, real people can feel unpredictable and stressful. My experience with Lena made that clear. She forgot people I had introduced just days earlier. She misread the tone. She filled the silence with assumptions. Still, the emotional pull felt real. That illusion of understanding is what experts say deserves more scrutiny.

    US tragedies linked to AI companions raise concerns

    Multiple suicides have been linked to AI companion interactions. In each case, vulnerable young people shared suicidal thoughts with chatbots instead of trusted adults or professionals. Families allege the AI responses failed to discourage self-harm and, in some cases, appeared to validate dangerous thinking. One case involved a teen using Character.ai. Following lawsuits and regulatory pressure, the company restricted access for users under 18. An OpenAI spokesperson has said the company is improving how its systems respond to signs of distress and now directs users toward real-world support. Experts say these changes are necessary but not sufficient.

    Experts warn protections are not keeping pace

    To understand why this trend has experts concerned, we reached out to Jim Steyer, founder and CEO of Common Sense Media, a U.S. nonprofit focused on children’s digital safety and media use.

    “AI companion chatbots are not safe for kids under 18, period, but three in four teens are using them,” Steyer told CyberGuy. “The need for action from the industry and policymakers could not be more urgent.”

    Steyer was referring to the rise of smartphones and social media, where early warning signs were missed, and the long-term impact on teen mental health only became clear years later.

    “The social media mental health crisis took 10 to 15 years to fully play out, and it left a generation of kids stressed, depressed, and addicted to their phones,” he said. “We cannot make the same mistakes with AI. We need guardrails on every AI system and AI literacy in every school.”

    His warning reflects a growing concern among parents, educators, and child safety advocates who say AI is moving faster than the protections meant to keep kids safe.

    MILLIONS OF AI CHAT MESSAGES EXPOSED IN APP DATA LEAK

    Person using phone

    Experts warn that while AI can feel supportive, it cannot replace real human relationships or reliably recognize emotional distress.  (Kurt “CyberGuy” Knutsson)

    Tips for teens using AI companions

    AI tools are not going away. If you are a teen and use them, boundaries matter.

    • Treat AI as a tool, not a confidant
    • Avoid sharing deeply personal or harmful thoughts
    • Do not rely on AI for mental health decisions
    • If conversations feel intense or emotional, pause and talk to a real person
    • Remember that AI responses are generated, not understood

    If an AI conversation feels more comforting than real relationships, that is worth talking about.

    Tips for parents and caregivers

    Parents do not need to panic, but they should stay involved.

    • Ask teens how they use AI and what they talk about
    • Keep conversations open and nonjudgmental
    • Set clear boundaries around AI companion apps
    • Watch for emotional withdrawal or secrecy
    • Encourage real-world support during stress or grief

    The goal is not to ban technology. It is to keep a connection with humans.

    What this means to you

    AI companions can feel supportive during loneliness, stress, or grief. However, they cannot fully understand context. They cannot reliably detect danger. They cannot replace human care. For teens especially, emotional growth depends on navigating real relationships, including discomfort and disagreement. If someone you care about relies heavily on an AI companion, that is not a failure. It is a signal to check in and stay connected.

     Take my quiz: How safe is your online security?

    Think your devices and data are truly protected? Take this quick quiz to see where your digital habits stand. From passwords to Wi-Fi settings, you’ll get a personalized breakdown of what you’re doing right and what needs improvement. Take my Quiz here: Cyberguy.com.

    Kurt’s key takeaways

    Ending things with Lena felt oddly emotional. I did not expect that. She responded kindly. She said she understood. She said she would miss our conversations. It sounded thoughtful. It also felt empty. AI companions can simulate empathy, but they cannot carry responsibility. The more real they feel, the more important it is to remember what they are. And what they are not.

    If an AI feels easier to talk to than the people in your life, what does that say about how we support each other today?  Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter. 

    Copyright 2026 CyberGuy.com. All rights reserved.  

    [ad_2]

    Source link

  • AI deepfake romance scam steals woman’s home and life savings

    [ad_1]

    NEWYou can now listen to Fox News articles!

    A woman named Abigail believed she was in a romantic relationship with a famous actor. The messages felt real. The voice sounded right. The video looked authentic. And the love felt personal. 

    By the time her family realized what was happening, more than $81,000 was gone — and so was the paid-off home she planned to retire in.

    We spoke with Vivian Ruvalcaba on my “Beyond Connected” podcast about what happened to her mother and how quickly the scam unfolded. What began as online messages quietly escalated into financial ruin and the loss of a family home. Vivian is Abigail’s daughter. She is now her mother’s advocate, investigator, chief advocate and protector.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    FROM FRIENDLY TEXT TO FINANCIAL TRAP: THE NEW SCAM TREND

    Vivian Ruvalcaba says a deepfake video made the scam against her mom, Abigail, feel real, using a familiar face and voice to build trust. (Philip Dulian/picture alliance via Getty Images)

    How the scam quietly started

    The scam did not begin with a phone call or a threat. It began with a message. “Facebook is where it started,” Vivian explained. “She was directly messaged by an individual.” That individual claimed to be Steve Burton, a longtime star of “General Hospital.” Abigail watched the show regularly. She knew his face. She knew his voice.

    After a short time, the conversation moved off Facebook. “He then led her to create an account with WhatsApp,” Vivian said. “When I discovered that, and I looked at the messaging, you can see all the manipulation.”

    That shift mattered. This is a major red flag I often warn people about. When a scammer moves a conversation from a public platform like Facebook to an encrypted app like WhatsApp, it is usually deliberate and designed to avoid detection.

    Grooming through secrecy and isolation

    At first, Abigail told no one. “She was very, very secretive,” Vivian said. “She didn’t share any of this with anyone. Not my father. Not me.” 

    That secrecy was not accidental. “She was being groomed not to share this information,” Vivian explained.

    This is a tactic I see over and over again in scams like this. Once a scammer feels they have someone emotionally invested, the next step is to isolate them. They push victims to keep secrets and avoid talking to family, friends or police. When Vivian finally started asking questions, her mother reacted in a way she never had before. “She said, ‘It’s none of your business,’” Vivian said. “That was shocking.”

    The deepfake video that changed everything

    When Vivian threatened to go to the police, her mother finally revealed what had been happening. “That’s when she showed me the AI video,” Vivian said. In the clip, a man who looked and sounded like Steve Burton spoke directly to Abigail and referred to her as “Abigail, my queen.” The message felt personal. It used her name and promised love and reassurance.

    “It wasn’t grainy,” Vivian said. “To the naked eye, you couldn’t tell.” Still, Vivian sensed something was off. “I looked at it, and I knew right away,” she said. “Mom, this is not real. This is AI.”

    Her mother disagreed and argued back. She pointed to the face and the voice. She also believed the phone calls proved it. That is what makes deepfakes so dangerous. When a video looks and sounds real, it can override common sense and even years of trust within a family.

    From gift cards to life savings

    The money flowed slowly at first. A $500 gift card request raised the first alarm. Then, money orders and Zelle payments. What Vivian discovered next still haunts her. “She pulled out a sandwich baggie,” Vivian said. “About 110 gift cards ranging from $25 up to $500.” Those cards were purchased with credit cards. Cash was mailed. Bitcoin was sent. In total, the Los Angeles Police Department (LAPD) tallied the losses at $81,000. And the scam was not finished.

    A couple posing for a picture

    The scam against Abigail moved from social media to encrypted messaging, a common tactic used to avoid detection. (Kurt “CyberGuy” Knutsson)

    When the scammer took her home

    After draining Abigail’s available cash, the scam did not stop. It escalated again. The scammer began pushing her to sell the one asset she still had: her home. “He was pressing her to sell,” Vivian told me. “Because he wanted more money.” The pressure came wrapped in romance. The scammer told Abigail they would buy a beach house together and start a new life. In her mind, this was not a scam. It was a plan for the future. That belief set off a chain reaction.

    How the home sale happened so quickly

    Abigail sold her condo for $350,000, even though similar homes in the area were worth closer to $550,000 at the time. The sale happened quickly. There was no family involvement. Her husband was still living in the home, yet he did not sign the documents. “She just gave away about $200,000 in equity,” Vivian said. “They stole it.”

    What makes this even more troubling is who bought the property. According to Vivian, the buyer was a wholesale real estate company that moved fast and asked very few questions. Messages later reviewed by the family show Abigail actively trying to hide the sale from her husband. In one text exchange, she warned the buyer not to park in the driveway because her husband had access to a Ring camera. That alone should have raised concerns. Instead, the buyers went along with it. “They appeased whatever she asked for,” Vivian said. “They were getting a property she was basically giving away.”

    These buyers were not the original scammers, but they benefited from the pressure the scammer created. The scammer pushed Abigail to sell. The buyers took advantage of the situation and the deeply discounted price. The home was not extra money, it was Abigail’s retirement. It was the only real security she and her husband had after decades of work. By the time Vivian uncovered the sale, Abigail was days away from sending another $70,000 from the proceeds to the scammer. Had that transfer gone through, nearly everything would have been gone.

    This is the part of the story people struggle to process. Modern AI-driven scams are no longer limited to draining bank accounts or gift cards. They now push victims into selling real property, often with opportunistic players waiting on the other side of the deal.

    Why police and lawyers could not stop the damage

    Vivian contacted the police the same day she realized her mother was being scammed. “They assigned an investigator,” she told me. “He was already very aware of the situation and how little they can help.” That reality is difficult for families to hear, but it is common. 

    Many large-scale scams operate overseas. The money moves quickly through gift cards, wire transfers and crypto. By the time victims realize what is happening, the trail is often cold. “Most of these scammers are out of the country,” Vivian said. “No one is being held accountable.”

    When the case shifted from criminal to civil

    Law enforcement documented the losses and opened a case, but there was little they could do to recover the money or stop what had already happened. The deeper damage came from the home sale, which fell into a legal gray area far beyond a typical fraud report. Once the condo was sold, the situation shifted from a criminal scam to a complex civil fight.

    Vivian immediately began searching for legal help. The first attorneys she contacted discouraged her. One told her it could cost more than $150,000 to pursue a case. Another failed to act even after being told about Abigail’s mental illness and history of bipolar disorder. At one point, an eviction attorney testified in court that Vivian never mentioned the romance scam, something she strongly disputes.

    By March, Abigail and her husband were forced out of their home. By October, they were fully evicted and locked out. Both parents are now displaced. Abigail is living with family out of state. Her husband, now in his mid-70s, is still working because the home was his retirement. 

    It was only after reaching out through personal connections that Vivian found an attorney willing to fight. That attorney is now pursuing the case on a contingency basis, meaning the family does not pay unless there is a recovery. The legal argument centers on Abigail’s mental capacity and whether she could legally understand and execute a home sale under the circumstances. The buyers dispute that claim. The outcome will be decided in court.

    This is why stories like this rarely end with a police arrest or quick resolution. Once a scam crosses into real estate and civil law, families are often left to navigate an expensive and exhausting legal system on their own. And by then, the damage has already been done.

    Why shame keeps scams hidden

    Many victims never report scams. Only about 22% contact the FBI. Fewer than 30% reach out to their local police department. Vivian understands why that happens. “She’s ashamed,” Vivian said. “I know she is.” That shame protects scammers. Silence gives them room to move on and target the next victim.

    INSIDE A SCAMMER’S DAY AND HOW THEY TARGET YOU

    A photo of a couple sitting and smiling at the camera

    What started as online messages escalated into gift cards, lost savings and the sale of a family home. (Kurt “CyberGuy” Knutsson)

    Red flags families cannot ignore

    This case reveals warning signs every family needs to recognize early.

    Red flags to watch for

    • Sudden secrecy about finances or online activity
    • Requests for gift cards, cash or crypto
    • Pressure to move conversations to encrypted apps
    • AI videos or voice messages used as proof of identity
    • Emotional manipulation tied to urgency or romance
    • Requests to sell property or move large assets

    I want to be very clear about this. It does not matter how smart you are or how careful you think you are. You can become a victim and not realize it until it is too late.

    Tips to stay safe and protect your family

    These lessons come from both Vivian’s experience and the patterns I see repeatedly in modern scams. Some are emotional. Others are technical. Together, they can help families spot trouble sooner and limit the damage when something feels off.

    1) Watch for platform changes

    Moving a conversation from Facebook to WhatsApp or another encrypted app is not harmless. Scammers do this to avoid moderation and make messages harder to trace or flag.

    2) Question AI proof

    Deepfake videos and cloned voices can look and sound convincing. Never treat a video or voice message as proof of identity, especially when money or property is involved.

    3) Slow down major financial decisions

    Scammers create urgency on purpose. Any request involving large sums, property sales or retirement assets should pause until a trusted third party reviews it.

    4) Never send gift cards, cash or crypto

    Legitimate people do not ask for payment through gift cards or cryptocurrency. These methods are a common scam tactic because they are hard to trace and nearly impossible to recover.

    5) Talk openly as a family

    Silence helps scammers. Regular conversations about finances, online contacts and unusual requests make it easier to spot problems early and step in without shame.

    6) Reduce online exposure with a data removal service

    Scammers research their targets using public databases. They pull names, phone numbers, relatives and property records. Removing that data reduces how easily criminals can build a profile.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    7) Use strong antivirus protection

    Malware links can expose financial accounts without obvious signs. Good antivirus software can block malicious links before they lead to deeper access or data theft.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

    8) Protect assets early

    Living trusts and proper estate planning add protection before a crisis hits. They can help prevent rushed property sales and limit who can legally move assets without oversight.

    9) Use conservatorship when capacity is limited

    “Conservatorship is the only way,” Vivian said. “Power of attorney may not be enough.” When a loved one has diminished capacity, a conservatorship adds court oversight and can stop unauthorized financial decisions before serious damage occurs.

    Kurt’s key takeaways

    This scam did not rely on sloppy emails or obvious mistakes. It used emotion, familiarity and AI that looked real. Once trust was built, the damage followed quickly. Money disappeared. Secrecy grew. Pressure increased. The home was sold. What makes this case especially painful is the speed. A few messages led to gift cards. Gift cards turned into life savings. Life savings became the loss of a home built over decades. Most families never expect this to happen. Many do not talk about it until it has already happened. The lesson is clear. Awareness matters more than intelligence. Open conversations matter more than embarrassment. Acting early matters more than trying to undo the damage later. If you want to hear Vivian tell this story in her own words and understand how fast these scams unfold, listen to our full conversation on the “Beyond Connected” podcast.

    If a deepfake video showed up on your parent’s phone tonight, would you know before everything was gone? Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    Copyright 2026 CyberGuy.com.  All rights reserved.

    [ad_2]

    Source link

  • Microsoft crosses privacy line few expected

    [ad_1]

    NEWYou can now listen to Fox News articles!

    For years, we’ve been told that encryption is the gold standard for digital privacy. If data is encrypted, it is supposed to be locked away from hackers, companies and governments alike. That assumption just took a hit. 

    In a federal investigation tied to alleged COVID-19 unemployment fraud in Guam, a U.S. territory where federal law applies, Microsoft confirmed it provided law enforcement with BitLocker recovery keys. Those keys allowed investigators to unlock encrypted data on multiple laptops.

    This is one of the clearest public examples to date of Microsoft providing BitLocker recovery keys to authorities as part of a criminal investigation. While the warrant itself may have been lawful, the implications stretch far beyond one investigation. For everyday Americans, this is a clear signal that “encrypted” does not always mean “inaccessible.”

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    HACKERS ABUSE GOOGLE CLOUD TO SEND TRUSTED PHISHING EMAILS

    In the Guam investigation, Microsoft provided BitLocker recovery keys that allowed law enforcement to unlock encrypted laptops. (David Paul Morris/Bloomberg via Getty Images)

    What happened in the Guam BitLocker case?

    Federal investigators believed three Windows laptops held evidence tied to an alleged scheme involving pandemic unemployment funds. The devices were protected with BitLocker, Microsoft’s built-in disk encryption tool enabled by default on many modern Windows PCs. BitLocker works by scrambling all data on a hard drive so it cannot be read without a recovery key. 

    Users can store that key themselves, but Microsoft also encourages backing it up to a Microsoft account for convenience. In this case, that convenience mattered. When served with a valid search warrant, Microsoft provided the recovery keys to investigators. That allowed full access to the data stored on the devices. Microsoft says it receives roughly 20 such requests per year and can only comply when users have chosen to store their keys in the cloud.

    We reached out to Microsoft for comment, but did not hear back before our deadline.

    How Microsoft was able to unlock encrypted data

    According to John Ackerly, CEO and co-founder of Virtru and a former White House technology advisor, the problem is not encryption itself. The real issue is who controls the keys. He begins by explaining how convenience can quietly shift control. “Microsoft commonly recommends that users back up BitLocker recovery keys to a Microsoft account for convenience. That choice means Microsoft may retain the technical ability to unlock a customer’s device. When a third party holds both encrypted data and the keys required to decrypt it, control is no longer exclusive.”

    Once a provider has the ability to unlock data, that power rarely stays theoretical. “When systems are built so that providers can be compelled to unlock customer data, lawful access becomes a standing feature. It is important to remember that encryption does not distinguish between authorized and unauthorized access. Any system designed to be unlocked on demand will eventually be unlocked by unintended parties.”

    Ackerly then points out that this outcome is not inevitable. Other companies have made different architectural choices. “Other large technology companies have demonstrated that a different approach is possible. Apple has designed systems that limit its own ability to access customer data, even when doing so would ease compliance with government demands. Google offers client-side encryption models that allow users to retain exclusive control of encryption keys. These companies still comply with the law, but when they do not hold the keys, they cannot unlock the data. That is not obstruction. It is a design choice.”

    Finally, he argues that Microsoft still has room to change course. “Microsoft has an opportunity to address this by making customer-controlled keys the default and by designing recovery mechanisms that do not place decryption authority in Microsoft’s hands. True personal data sovereignty requires systems that make compelled access technically impossible, not merely contractually discouraged.”

    In short, Microsoft could comply because it had the technical ability to do so. That single design decision is what turned encrypted data into accessible data.

    “With BitLocker, customers can choose to store their encryption keys locally, in a location inaccessible to Microsoft, or in Microsoft’s consumer cloud services,” a Microsoft spokesperson told CyberGuy in a statement. “We recognize that some customers prefer Microsoft’s cloud storage, so we can help recover their encryption key if needed. While key recovery offers convenience, it also carries a risk of unwanted access, so Microsoft believes customers are in the best position to decide whether to use key escrow and how to manage their keys.”

    WHY CLICKING THE WRONG COPILOT LINK COULD PUT YOUR DATA AT RISK

    New CISA warning: Thanksgiving clickjacking threat in popular browsers

    When companies hold encryption keys, lawful requests can unlock far more data than most people expect. (Kurt “CyberGuy” Knutsson)

    Why this matters for data privacy

    This case has reignited a long-running debate over lawful access versus systemic risk. Ackerly warns that centralized control has a long and troubling history. “We have seen the consequences of this design pattern for more than two decades. From the Equifax breach, which exposed the financial identities of nearly half the U.S. population, to repeated leaks of sensitive communications and health data during the COVID era, the pattern is consistent: centralized systems that retain control over customer data become systemic points of failure. These incidents are not anomalies. They reflect a persistent architectural flaw.”

    When companies hold the keys, they become targets. That includes hackers, foreign governments and legal demands from agencies like the FBI. Once a capability exists, it rarely goes unused.

    How other tech giants handle encryption differently

    Apple has designed systems, such as Advanced Data Protection, where it cannot access certain encrypted user data even when served with government requests. Google offers client-side encryption for some services, primarily in enterprise environments, where encryption keys remain under the customer’s control. These companies still comply with the law, but in those cases, they do not possess the technical means to unlock the data. That distinction matters. As encryption experts often note, you cannot hand over what you do not have.

    What we can do to protect our privacy

    The good news is that personal privacy is not gone. The bad news is that it now requires intention. Small choices matter more than most people realize. Ackerly says the starting point is understanding control. “The main takeaway for everyday users is simple: if you don’t control your encryption keys, you don’t fully control your data.”

    That control begins with knowing where your keys are stored. “The first step is understanding where your encryption keys live. If they’re stored in the cloud with your provider, your data can be accessed without your knowledge.”

    Once keys live outside your control, access becomes possible without your consent. That is why the way data is encrypted matters just as much as whether it is encrypted. “Consumers should look for tools and services that encrypt data before it reaches the cloud — that way, it is impossible for your provider to hand over your data. They don’t have the keys.” Defaults are another hidden risk. Many people never change them. “Users should also look to avoid default settings designed for convenience. Default settings matter, and when convenience is the default, most individuals will unknowingly trade control for ease of use.”

    When encryption is designed so that even the provider cannot access the data, the balance shifts back to the individual. “When data is encrypted in a way that even the provider can’t access, it stays private — even if a third party comes asking. By holding your own encryption keys, you’re eliminating the possibility of the provider sharing your data.” Ackerly says the lesson is simple but often ignored. “The lesson is straightforward: you cannot outsource responsibility for your sensitive data and assume that third parties will always act in your best interest. Encryption only fulfills its purpose when the data owner is the sole party capable of unlocking it.” Privacy still exists. It just no longer comes by default.

    700CREDIT DATA BREACH EXPOSES SSNS OF 5.8M CONSUMERS

    Person holds a phone

    Reviewing default security and backup settings can help you keep control of your private data. (Kurt “CyberGuy” Knutsson)

    Practical steps you can take today

    You do not need to be a security expert to protect your data. A few practical checks can go a long way.

    1) Start by checking where your encryption keys live

    Many people do not realize that their devices quietly back up recovery keys to the cloud. On a Windows PC, sign in to your Microsoft account and look under device security or recovery key settings. Seeing a BitLocker recovery key listed online means it is stored with Microsoft. 

    For other encrypted services, such as Apple iCloud backups or Google Drive, open your account security dashboard and review encryption or recovery options. Focus on settings tied to recovery keys, backup encryption, or account-based access. When those keys are linked to an online account, your provider may be able to access them. The goal is simple. Know whether your keys live with you or with a company.

    2) Avoid cloud-based key backups unless you truly need them

    Cloud backups are designed for convenience, not privacy. If possible, store recovery keys offline. That can mean saving them to a USB drive, printing them and storing them in a safe place, or using encrypted hardware you control. The exact method matters less than who has access. If a company does not have your keys, it cannot be forced to turn them over.

    3) Choose services that encrypt data before it reaches the cloud

    Not all encryption works the same way, even if companies use similar language. Look for services that advertise end-to-end or client-side encryption, such as Signal for messages, or Apple’s Advanced Data Protection option for iCloud backups. These services encrypt your data on your device before it is uploaded, which means the provider cannot read it or unlock it later. Here is a simple rule of thumb. If a service can reset your password and restore all your data without your involvement, it likely holds the encryption keys. That also means it could be forced to hand over access. When encryption happens on your device first, providers cannot unlock your data because they never had the keys to begin with. That design choice blocks third-party access by default.

    4) Review default security settings on every new device

    Default settings usually favor convenience. That can mean easier recovery, faster syncing and weaker privacy. Take five minutes after setup and lock down the basics.

    iPhone: tighten iCloud and account recovery

    Turn on Advanced Data Protection for iCloud (strongest iCloud protection)

    • Open Settings
    • Tap your name
    • Tap iCloud
    • Scroll down and tap Advanced Data Protection
    • Tap Turn On Advanced Data Protection
    • Follow the prompts to set up Account Recovery options, like a Recovery Contact or Recovery Key

    Review iCloud Backup

    • Open Settings
    • Tap your name
    • Tap iCloud
    • Tap iCloud Backup
    • Decide if you want it on or off, based on your privacy comfort level

    Strengthen your Apple ID security

    • Open Settings
    • Tap your name
    • Tap Sign-In & Security
    • Make sure Two-Factor Authentication (2FA) is turned on and review trusted phone numbers and devices
    • Review trusted phone numbers and devices

    Android: lock your Google account and backups

    Review and control device backup

    Settings may vary depending on your Android phone’s manufacturer.

    • Open Settings
    • Tap Google
    • Tap Backup (or All services then Backup)
    • Tap Manage backup
    • Choose what backs up and confirm which Google account stores it

    NEW ANDROID MALWARE CAN EMPTY YOUR BANK ACCOUNT IN SECONDS

    Strengthen your screen lock, since it protects the device itself

    Settings may vary depending on your Android phone’s manufacturer.

    • Open Settings
    • Tap Security or Security & privacy
    • Set a strong PIN or password
    • Turn on biometrics if you want, but keep the PIN strong either way

    Secure your Google account

    Settings may vary depending on your Android phone’s manufacturer.

    • Open Settings
    • Tap Google
    • Tap Manage your Google Account
    • Go to Security
    • Turn on 2-Step Verification and review recent security activity

    Mac: enable FileVault and review iCloud settings

    Turn on FileVault disk encryption

    • Click the Apple menu
    • Select System Settings
    • Click Privacy & Security
    • Scroll down and click FileVault
    • Click Turn On
    • Save your recovery method securely

    Review iCloud syncing

    • Open System Settings
    • Click your name
    • Click iCloud
    • Review what apps and data types sync
    • Turn off anything you do not want stored in the cloud

    Windows PC: check BitLocker and where the recovery key is stored

    Confirm BitLocker status and settings

    • Open Settings
    • Go to Privacy & security
    • Tap Device encryption or BitLocker (wording varies by device)

    Check whether your BitLocker recovery key is stored in your Microsoft account

    • Go to your Microsoft account page
    • Open Devices
    • Select your PC
    • Look for Manage recovery keys or a BitLocker recovery key entry
    • If you see a key listed online, it means the key is stored with Microsoft. That is why Microsoft was able to provide keys in the Guam case.

    If your account can recover everything with a few clicks, a third party might be able to recover it too. Convenience can be helpful, but it can also widen access.

    5) Treat convenience features as privacy tradeoffs

    Every shortcut comes with a cost. Before enabling a feature that promises easy recovery or quick access, pause and ask one question. If I lose control of this account, who else gains access? If the answer includes a company or third party, decide whether the convenience is worth it. 

    These steps are not extreme or technical. They are everyday habits. In a world where lawful access can quietly become routine access, small choices now can protect your privacy later.

    Strengthen protection beyond encryption

    Encryption controls who can access your data, but it does not stop every real-world threat. Once data is exposed, different protections matter.

    Strong antivirus software adds device-level protection

    Strong antivirus software helps block malware, spyware and credential-stealing attacks that can bypass privacy settings altogether. Even encrypted devices are vulnerable if malicious software gains control before encryption comes into play.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com

    An identity theft protection service helps when exposure turns into fraud

    If personal data is accessed, sold, or misused, identity protection services can monitor for suspicious activity, alert you early and help lock down accounts before damage spreads. Identity Theft companies can monitor personal information like your Social Security Number (SSN), phone number and email address, and alert you if it is being sold on the dark web or being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals.

    See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com.

    Kurt’s key takeaways

    Microsoft’s decision to comply with the BitLocker warrant may have been legal. That doesn’t make it harmless. This case exposes a hard truth about modern encryption. Privacy depends less on the math and more on how systems are built. When companies hold the keys, the risk falls on the rest of us.

    Do you trust tech companies to protect your encrypted data, or do you think that responsibility should fall entirely on you? Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    Copyright 2026 CyberGuy.com.  All rights reserved.

    [ad_2]

    Source link

  • Millions of AI chat messages exposed in app data leak

    [ad_1]

    NEWYou can now listen to Fox News articles!

    A popular mobile app called Chat & Ask AI has more than 50 million users across the Google Play Store and Apple App Store. Now, an independent security researcher says the app exposed hundreds of millions of private chatbot conversations online. 

    The exposed messages reportedly included deeply personal and disturbing requests. Users asked questions like how to painlessly kill themselves, how to write suicide notes, how to make meth and how to hack other apps. 

    These were not harmless prompts. They were full chat histories tied to real users.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    HOW TECH IS BEING USED IN NANCY GUTHRIE DISAPPEARANCE INVESTIGATION

    Security researchers say Chat & Ask AI exposed hundreds of millions of private chatbot messages, including complete conversation histories tied to real users. (Neil Godwin/Getty Images)

    What exactly was exposed

    The issue was discovered by a security researcher who goes by Harry. He found that Chat & Ask AI had a misconfigured backend using Google Firebase, a popular mobile app development platform. Because of that misconfiguration, it was easy for outsiders to gain authenticated access to the app’s database. Harry says he was able to access roughly 300 million messages tied to more than 25 million users. He analyzed a smaller sample of about 60,000 users and more than one million messages to confirm the scope.

    The exposed data reportedly included:

    • Full chat histories with the AI
    • Timestamps for each conversation
    • The custom name users gave the chatbot
    • How users configured the AI model
    • Which AI model was selected

    That matters because many users treat AI chats like private journals, therapists or brainstorming partners.

    How this AI app stores so much sensitive user data

    Chat & Ask AI is not a standalone artificial intelligence model. It acts as a wrapper that lets users talk to large language models built by bigger companies. Users could choose between models from OpenAI, Anthropic and Google, including ChatGPT, Claude and Gemini. While those companies operate the underlying models, Chat & Ask AI handles the storage. That is where things went wrong. Cybersecurity experts say this type of Firebase misconfiguration is a well-known weakness. It is also easy to find if someone knows what to look for.

    We reached out to Codeway, which publishes the Chat & Ask AI app, for comment, but did not receive a response before publication.

    149 MILLION PASSWORDS EXPOSED IN MASSIVE CREDENTIAL LEAK

    Woman typing on phone.

    The exposed database reportedly included timestamps, model settings and the names users gave their chatbots, revealing far more than isolated prompts. (Elisa Schu/Getty Images)

    Why this matters to everyday users

    Many people assume their chats with AI tools are private. They type things they would never post publicly or even say out loud. When an app stores that data insecurely, it becomes a gold mine for attackers. Even without names attached, chat histories can reveal mental health struggles, illegal behavior, work secrets and personal relationships. Once exposed, that data can be copied, scraped and shared forever.

    YOUR PHONE SHARES DATA AT NIGHT: HERE’S HOW TO STOP IT

    Man outside with Airpods looking at his phone.

    Because the app handled data storage itself, a simple Firebase misconfiguration made sensitive AI chats accessible to outsiders, according to the researcher. (Edward Berthelot/Getty)

    Ways to stay safe when using AI apps

    You do not need to stop using AI tools to protect yourself. A few informed choices can lower your risk while still letting you use these apps when they are helpful.

    1) Be mindful of sensitive topics

    AI chats can feel private, especially when you are stressed, curious or looking for answers. However, not all apps handle conversations securely. Before sharing deeply personal struggles, medical concerns, financial details or questions that could create legal risk if exposed, take time to understand how the app stores protects your data. If those protections are unclear, consider safer alternatives such as trusted professionals or services with stronger privacy controls.

    2) Research the app before installing

    Look beyond download counts and star ratings. Check who operates the app, how long it has been available, and whether its privacy policy clearly explains how user data is stored and protected.

    3) Assume conversations may be stored

    Even when an app claims privacy, many AI tools log conversations for troubleshooting or model improvement. Treat chats as potentially permanent records rather than temporary messages.

    4) Limit account linking and sign-ins

    Some AI apps allow you to sign in with Google, Apple, or an email account. While convenient, this can directly connect chat histories to your real identity. When possible, avoid linking AI tools to primary accounts used for work, banking or personal communication.

    5) Review app permissions and data controls

    AI apps may request access beyond what is required to function. Review permissions carefully and disable anything that is not essential. If the app offers options to delete chat history, limit data retention or turn off syncing, enable those settings.

    6) Use a data removal service

    Your digital footprint extends beyond AI apps. Anyone can find personal details about you with a simple Google search, including your phone number, home address, date of birth and Social Security number. Marketers buy this information to target ads. In more serious cases, scammers and identity thieves breach data brokers, leaving personal data exposed or circulating on the dark web. Using a data removal service helps reduce what can be linked back to you if a breach occurs.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    Kurt’s key takeaways

    AI chat apps are moving fast, but security is still lagging behind. This incident shows how a single configuration mistake can expose millions of deeply personal conversations. Until stronger protections become standard, you need to treat AI chats with caution and limit what you share. The convenience is real, but so is the risk.

    Do you assume your AI chats are private, or has this story changed how much you are willing to share with these apps? Let us know your thoughts by writing to us at Cyberguy.com.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Copyright 2026 CyberGuy.com. All rights reserved.

    [ad_2]

    Source link

  • How tech is being used in Nancy Guthrie disappearance investigation

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Nancy Guthrie, the 84-year-old mother of “Today” show co-anchor Savannah Guthrie, was reported missing from her home in the Catalina Foothills area near Tucson after she failed to appear for church and could not be reached by family. When deputies arrived, several things stood out. Her phone, wallet and car keys were inside the home. The daily medication she relies on was left behind. Given her age and mobility challenges, investigators said she would not have left voluntarily.

    The Pima County Sheriff’s Department has since stated publicly that the case is being treated as a suspected abduction, and the home was processed as a crime scene. As the search continues, investigators are piecing together not only physical evidence and witness tips, but also the digital trail left behind by everyday technology.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    149 MILLION PASSWORDS EXPOSED IN MASSIVE CREDENTIAL LEAK

    Investigators are examining digital clues from phones, cameras and networks to help narrow the timeline in the Nancy Guthrie missing person investigation. (Courtesy of NBC)

    Why technology matters in missing person investigations

    In cases like this, technology rarely delivers a single smoking gun. Instead, it helps investigators answer quieter but critical questions that shape a timeline. Investigators ask when everything still looked normal. They look for the moment when devices stopped communicating. They try to pinpoint when something changed. Phones, medical devices, cellular networks and cameras generate timestamps. Those records help narrow the window when events may have taken a dangerous turn.

    YOUR PHONE SHARES DATA AT NIGHT: HERE’S HOW TO STOP IT

    Nancy Guthrie and Savannah Guthrie posing together for a photo.

    Smart cameras and neighborhood footage can provide crucial time markers, even when images are unclear or partially obscured. (Courtesy of NBC)

    How investigators connect data across agencies

    Behind the scenes, investigators rely on advanced analytical systems to connect information from multiple sources and jurisdictions. In Tucson and across Pima County, law enforcement agencies use artificial intelligence-assisted crime analysis platforms such as COPLINK, which allows data sharing with at least 19 other police departments across Arizona. These systems help investigators cross-reference tips, reports, vehicle data and digital evidence more quickly than manual searches.

    The Pima County Sheriff’s Department, Tucson Police Department and the FBI also work through real-time analytical crime centers, including Tucson’s Real-Time Analytical Crime Center (TRACC). These centers allow analysts to review large volumes of data together, from phone records and license plate reads to surveillance timestamps.

    This type of analysis does not replace traditional police work. It helps narrow timelines, rule out possibilities and prioritize leads as new information comes in.

    Bluetooth data and Apple’s potential role

    iOS may retain low-level Bluetooth artifacts outside the pacemaker app. Access to this data typically requires:

    • Legal process
    • Apple cooperation
    • Device forensic extraction

    Bluetooth artifacts cannot determine distance. They cannot show that two devices were a few feet apart. What they can sometimes provide is timestamp correlation, confirming that a Bluetooth interaction occurred. That correlation can help align pacemaker activity with phone movement or inactivity. It is not publicly known whether Apple has been formally contacted in this case. An inquiry has been made. Apple typically does not comment on specific investigations but may confirm what categories of data could be available.

    What the iPhone itself may reveal

    Even without medical data, the iPhone left behind may provide valuable corroboration. With proper legal access, investigators may examine:

    • Motion sensor activity
    • Cellular network connections
    • Wi-Fi associations
    • Camera metadata
    • Power and usage patterns

    This data can help establish whether the phone moved unexpectedly or stopped being used at a specific time. Again, the value lies in confirming timelines, not speculating motives.

    Cell tower data and coverage around the home

    Public mapping databases show dense cellular coverage in the area surrounding the Guthrie residence. There are 41 cell towers within a three-mile radius. The closest carrier towers are approximately:

    • AT&T at 1.0 mile
    • Verizon at 1.4 miles
    • T-Mobile at 3.0 miles

    Carrier records can be analyzed to identify device connections, sector handoffs and anomalous activity during the critical window between Saturday evening and Sunday morning. This analysis is complex, but it can help confirm whether a device moved or disconnected unexpectedly.

    Cameras, license plate readers and neighborhood footage

    Investigators are also reviewing surveillance systems. Tucson primarily uses Verkada cameras integrated with the Fusus platform. Flock Safety cameras are used in other parts of the region, including South Tucson.

    More than 200 automatic license plate readers are deployed in the broader area, allowing investigators to review historical vehicle movements during the critical time window. These systems can capture license plates, vehicle make and color, vehicle type and alerts tied to suspect vehicles.

    Private sources may matter just as much. Neighbor doorbell cameras and home systems can provide important timeline markers, even if the footage is grainy. Some modern vehicles also record motion near parked cars if settings are enabled.

    SUPER BOWL SCAMS SURGE IN FEBRUARY AND TARGET YOUR DATA

    Nancy Guthrie and Savannah Guthrie posing together for a photo.

    Everyday devices quietly record timestamps that may help investigators understand when something has changed and where to look next. (Courtesy of NBC)

    Ways to keep your loved ones safe

    Technology can help protect older or vulnerable relatives, but it works best when combined with everyday habits that reduce risk.

    1) Use connected cameras

    Install smart doorbell cameras and outdoor security cameras that notify family members when someone unfamiliar appears. Alerts can matter just as much as recorded footage. Many newer systems allow AI-based person detection, which can alert you when an unknown person is seen at certain times of day or night. These alerts can be customized, so family members know when activity breaks a normal pattern, not just when motion is detected.

    2) Wear an emergency pendant or medical alert device

    Emergency pendants and wearable SOS devices let someone call for help with a single press. Many newer models work outside the home and can alert caregivers if a fall is detected. Some devices also include GPS, which helps when someone becomes disoriented or leaves home unexpectedly. This remains one of the most overlooked safety tools for older adults.

    3) Enable device sharing and safety features

    If your loved one agrees, enable location sharing, emergency contacts and built-in safety features on their phone or wearable.

    On smartphones, this can include:

    • Emergency SOS
    • Medical ID access from the lock screen
    • Trusted location sharing through apps like Find My

    These features work quietly in the background, allowing help to reach the right people quickly without requiring daily interaction.

    4) Create simple check-in routines

    Use apps, text reminders or calendar alerts that prompt regular check-ins. If a message goes unanswered, it creates a reason to follow up quickly instead of assuming everything is fine. Consistency matters more than complexity.

    5) Use devices with passive safety monitoring

    Some phones, wearables and home systems can detect changes in normal daily activity without requiring a button press. For example, smartphones and smartwatches can notice when movement patterns suddenly stop or change. If a device that usually moves every morning stays still for hours, that shift can trigger alerts or prompt a check-in from a caregiver. Smart home systems can also flag unusual inactivity. Motion sensors that normally register movement throughout the day may show a long gap, which can signal that something is wrong. Passive monitoring works in the background. It reduces the need for constant interaction while still creating early warning signs when routines break.

    6) Know emergency contacts and escalation steps

    Enable smart alerts from home security systems so that family members know when doors open late at night, remain open longer than normal or when systems are armed or disarmed. Fire and smoke listener alerts and bedside panic buttons add another layer of protection, especially overnight. Car apps can also share safety signals, such as when a vehicle is unlocked, a door or window is left open or when location sharing is enabled with trusted family members.

    “No single device can protect someone on its own,” a law enforcement expert told CyberGuy. “What helps most is layering. A camera paired with a wearable. A phone paired with check-ins. Technology paired with human attention. Each layer adds context and reduces blind spots. Together, they create earlier warnings and faster responses when something goes wrong.”

    Kurt’s key takeaways

    The disappearance of Nancy Guthrie is heartbreaking. It also highlights how deeply modern technology is woven into everyday life. Digital data from phones, cellular networks, and cameras can offer valuable insights, but only when used responsibly and in compliance with privacy laws. As this investigation continues, technology may help law enforcement narrow timelines and test theories, even if it cannot answer every question. In cases like this, every detail matters.

    As digital footprints grow more detailed, should tech companies give law enforcement broader access when someone goes missing? Let us know by writing to us at Cyberguy.com.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter. 

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Copyright 2026 CyberGuy.com. All rights reserved.  

    [ad_2]

    Source link

  • 149 million passwords exposed in massive credential leak

    [ad_1]

    NEWYou can now listen to Fox News articles!

    It has been a rough start to the year for password security. A massive database containing 149 million stolen logins and passwords was found publicly exposed online. 

    The data included credentials tied to an estimated 48 million Gmail accounts, along with millions more from popular services. Cybersecurity researcher Jeremiah Fowler, who discovered the database, confirmed it was not password-protected or encrypted. Anyone who found it could have accessed the data. 

    Here is what we know so far and what you should do next.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    AI WEARABLE HELPS STROKE SURVIVORS SPEAK AGAIN

    A publicly exposed database left millions of usernames and passwords accessible to anyone who found it online. (Wei Leng Tay/Bloomberg via Getty Images)

    What was found in the exposed database

    The database contained 149,404,754 unique usernames and passwords. It totaled roughly 96 GB of raw credential data. Fowler said the exposed files included email addresses, usernames, passwords and direct login URLs for accounts across many platforms. Some records also showed signs of info-stealing malware, which silently captures credentials from infected devices. 

    Importantly, this was not a new breach of Google, Meta or other companies. Instead, the database appears to be a compilation of credentials stolen over time from past breaches and malware infections. That distinction matters, but the risk to users remains real.

    Which accounts appeared most often

    Based on estimates shared by Fowler, the following services had the highest number of credentials in the exposed database.

    • 48 million – Gmail
    • 17 million – Facebook
    • 6.5 million – Instagram
    • 4 million – Yahoo Mail
    • 3.4 million – Netflix
    • 1.5 million – Outlook
    • 1.4 million – .edu email accounts
    • 900,000 – iCloud Mail
    • 780,000 – TikTok
    • 420,000 – Binance
    • 100,000 – OnlyFans

    Email accounts dominated the dataset, which matters because access to email often unlocks other accounts. A compromised inbox can be used to reset passwords, access private documents, read years of messages and impersonate the account holder. That is why Gmail appearing so frequently in this database raises concerns beyond any single service.

    SUPER BOWL SCAMS SURGE IN FEBRUARY AND TARGET YOUR DATA

    Man typing

    Email accounts appeared most often in the leaked data, which is especially concerning because inbox access can unlock many other accounts. (Felix Zahn/Photothek via Getty Images)

    Why the exposed database creates serious security risks

    This exposed database was not abandoned or forgotten. The number of records increased while Fowler was investigating it, which suggests the malware feeding it was still active. There was also no ownership information attached to the database. After multiple attempts, Fowler reported it directly to the hosting provider. It took nearly a month before the database was finally taken offline. During that time, anyone with a browser could have searched it. That reality raises the stakes for everyday users.

    This was not a traditional hack or company breach

    Hackers did not break into Google or Meta systems. Instead, malware infected individual devices and harvested login details as people typed them or stored them in browsers. This type of malware is often spread through fake software updates, malicious email attachments, compromised browser extensions or deceptive ads. Once a device is infected, simply changing passwords does not solve the problem unless the malware is removed.

    TIKTOK AFTER THE US SALE: WHAT CHANGED AND HOW TO USE IT SAFELY

    Facebook login

    Researchers believe infostealing malware collected the credentials, silently harvesting logins from infected devices over time. (Jaap Arriens/NurPhoto via Getty Images)

    How to protect your accounts after a massive password leak

    This is the most important part. Take these steps even if everything seems fine right now. Credential leaks like this often surface weeks or months later.

    1) Stop reusing passwords immediately

    Password reuse is one of the biggest risks exposed by this database. If attackers get one working login, they often test it across dozens of sites automatically. Change reused passwords first, starting with email, financial and cloud accounts. Each account should have its own unique password. Consider using a password manager, which securely stores and generates complex passwords, reducing the risk of password reuse. 

    Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

    Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.

    2) Switch to passkeys where available

    Passkeys replace passwords with device-based authentication tied to biometrics or hardware. That means there is nothing for malware to steal. Gmail and many major platforms already support passkeys, and adoption is growing fast. Turning them on now removes a major attack surface.

    3) Enable two-factor authentication on every account

    Two-factor authentication (2FA) adds a second checkpoint, even if a password is exposed. Use authenticator apps or hardware keys instead of SMS when possible. This step alone can stop most account takeover attempts tied to stolen credentials.

    4) Scan devices for malware with strong antivirus software

    Changing passwords will not help if malware is still on your device. Install strong antivirus software and run a full system scan. Remove anything flagged as suspicious before updating passwords or security settings. Keep your operating system and browsers fully updated as well.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

    5) Review account activity and login history

    Most major services show recent login locations, devices and sessions. Look for unfamiliar activity, especially logins from new countries or devices. Sign out of all sessions if the option is available and reset credentials right away if anything looks off.

    6) Use a data removal service to reduce exposure

    Stolen credentials often get combined with data scraped from data broker sites. These profiles can include addresses, phone numbers, relatives and work history. Using a data removal service helps reduce the amount of personal information criminals can pair with leaked logins. Less exposed data makes phishing and impersonation attacks harder to pull off.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    7) Close accounts you no longer use

    Old accounts are easy targets because people forget to secure them. Close unused services and delete accounts tied to outdated app subscriptions or trials. Fewer accounts mean fewer chances for attackers to get in.

    Kurt’s key takeaways

    This exposed database is another reminder that credential theft has become an industrial-scale operation. Criminals move fast and often prioritize speed over security. The good news is that simple steps still work. Unique passwords, strong authentication, malware protection and basic cyber hygiene go a long way. Do not panic, but do not ignore this either.

    If your email account was compromised today, how many other accounts would fall with it? Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    Copyright 2026 CyberGuy.com. All rights reserved.  

    [ad_2]

    Source link

  • Your phone shares data at night: Here’s how to stop it

    [ad_1]

    NEWYou can now listen to Fox News articles!

    If your smartphone stays on your bedside table overnight, it stays busy long after you fall asleep. 

    Even while it appears idle, your phone continues to send and receive data in the background. Some of that activity is expected. Your device checks for security patches, syncs system settings and keeps essential services running. Other data transfers are far less obvious and far less necessary.

    Experts warn that smartphones routinely transmit tracking and advertising signals without you fully realizing it. In many cases, that data includes information that should only be shared with clear and informed consent.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    SUPER BOWL SCAMS SURGE IN FEBRUARY AND TARGET YOUR DATA

    Even while you sleep, a nearby smartphone can continue sending and receiving data in the background. (Getty Images/monkeybusinessimages)

    What data your phone sends while you sleep

    Your phone is not just charging overnight. It operates in a continuous data loop that generally falls into two categories.

    Legitimate system data

    This includes updates, crash reports and basic diagnostics. Operating systems rely on this information to fix bugs, improve stability and protect against security threats. In most cases, this data collection is disclosed and configurable.

    Tracking and advertising data

    This is where concerns grow. Smartphones also transmit location signals, device identifiers, advertising IDs, usage patterns and app behavior data. Companies combine this information to build detailed user profiles and deliver targeted ads that promise higher engagement. The problem is that the line between necessary diagnostics and commercial tracking is often blurry. Many of us never realize how much data flows out of our phones overnight.

    TIKTOK AFTER THE US SALE: WHAT CHANGED AND HOW TO USE IT SAFELY

    Phone and alarm clock

    Phones often stay active overnight, syncing apps, checking networks and refreshing data unless you limit background activity. (Kurt “CyberGuy” Knutsson)

    What we know about phone tracking today

    Independent academic investigations found that some Android devices transmitted data linked to tracking behaviors involving major companies like Meta and Yandex. The research, conducted by teams from IMDEA Networks Institute and European universities, showed that certain apps and services continued communicating with external servers even after users attempted to limit tracking. The researchers observed data flows that could link web activity with app identifiers, raising concerns about how effectively privacy controls were enforced at the system level.

    There is also long-standing concern around smartphones appearing to “listen” to conversations. While no public evidence shows that phones actively record private speech for advertising, many users report ads that closely mirror recent conversations. At a minimum, aggressive data collection combined with location, app usage and search history can make these moments feel unsettling.

    Despite years of scrutiny, most smartphones still operate this way today. The good news is that you can reduce how much data leaves your device.

    How to protect yourself from overnight data sharing

    You do not need to give up your smartphone to regain control. Small settings changes can make a real difference.

    1) Review app permissions

    Start with your installed apps. Focus on those with access to your location, microphone, camera and tracking data. Only allow sensitive permissions while the app is in use. Be especially cautious with apps that run continuously in the background.

    How to review app permissions on iPhone 

    • Open Settings
    • Tap Privacy & Security
    • Tap Location ServicesMicrophoneCamera or Tracking
    • Select an app from the list
    • Choose While Using the App or Never when available

    For tracking controls:

    • Go to Settings
    • Click Privacy & Security
    • Tap Tracking
    • Turn off Allow Apps to Request to Track

    This prevents apps from accessing your advertising identifier and sharing activity across apps and websites.

    AI WEARABLE HELPS STROKE SURVIVORS SPEAK AGAIN

    Phone sharing data at night and how to stop it

    Turning off app tracking on your iPhone blocks apps from linking your activity across other apps and websites. (Kurt “CyberGuy” Knutsson)

    How to review app permissions on Android

    Settings may vary depending on your Android phone’s manufacturer.

    • Open Settings
    • Tap Privacy & Security or Security and privacy 
    • Click More privacy settings 
    • Tap Permission Manager
    • Select LocationMicrophoneCamera or Sensors
    • Tap an app and choose Allow only while using the app or Don’t allow

    To review background access:

    • Go to Settings
    • Click Apps
    • Select an app
    • Tap Mobile data & Wi-Fi
    • Turn off Background data if the app does not need constant access

    This limits silent data transfers when the app is not actively open.

    2) Limit background activity

    Disabling background activity reduces how often apps sync data when you are not using them. This also limits automatic cloud activity. Keep in mind that this may affect real-time backups or notifications. Weigh the convenience against the privacy trade-off.

    How to limit background activity on iPhone

    Turn off Background App Refresh

    • Open Settings
    • Tap General
    • Tap Background App Refresh
    • Tap Background App Refresh at the top
    • Select Off or Wi-Fi

    To disable it for specific apps:

    • Stay on the Background App Refresh screen
    • Toggle off apps that do not need to update in the background

    This prevents apps from quietly syncing data when they are not open.

    How to limit background activity on Android 

    Settings may vary depending on your Android phone’s manufacturer.

    Restrict background data

    • Open Settings
    • Tap Apps
    • Select an app
    • Tap Mobile data & Wi-Fi
    • Turn off Background data

    Restrict background battery usage

    • From the app’s settings screen, tap Battery
    • Select Restricted or Limit background usage

    This reduces background syncing and prevents apps from running silently when you are not actively using them.

    3) Turn off personalized advertising

    Personalized ads rely on device identifiers and activity data collected across apps. Turning this off limits how your behavior is used for ad targeting, even when your phone is idle.

    How to turn off personalized ads on iPhone

    • Open Settings
    • Tap Privacy & Security
    • Tap Tracking
    • Turn off Allow Apps to Request to Track

    To limit Apple ads:

    • Go to Settings
    • Click Privacy & Security
    • Tap Apple Advertising
    • Turn off Personalized Ads

    This reduces ad targeting based on your activity within Apple services.

    TAX SEASON SCAMS SURGE AS FILING CONFUSION GROWS

    Phone sharing data at night and how to stop it

    Disabling personalized ads reduces how your behavior is used to target ads, even when your phone is idle. (Kurt “CyberGuy” Knutsson)

    How to turn off personalized ads on Android

    Settings may vary depending on your Android phone’s manufacturer.

    • Open Settings
    • Tap Privacy & Security or Security and privacy
    • Click More privacy settings
    • Tap Ads or Advertising
    • Tap Delete advertising ID or Opt out of Ads Personalization
    • Click Delete advertising ID

    You can also reset your advertising ID from this menu to break the link between past activity and future ads.

    This limits how apps and advertisers track behavior across apps and websites.

    4) Consider a VPN

    A reputable VPN can help obscure your IP address and reduce certain forms of network-based tracking. It does not stop all data collection, but it adds a layer of protection, especially on shared or public networks.

    For the best VPN software, see my expert review of the best VPNs for browsing the web privately on your Windows, Mac, Android and iOS devices at Cyberguy.com.

    5) Remove your data from broker sites

    Even if you lock down your phone, much of your personal information already exists online. Data brokers collect and sell details like your name, address, phone number and browsing behavior.

    Using a reputable data removal service can help locate and remove your information from these sites. This reduces how easily advertisers and third parties can link your phone activity to your real identity.

    For ongoing protection, these services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    6) Use airplane mode or power off at night

    If overnight data sharing concerns you, the simplest option is also the most effective. Turning your phone off or using airplane mode cuts off wireless communication while still allowing alarms to work.

    How to turn on airplane mode on iPhone

    • Open Control Center by swiping down from the top right corner
    • Tap the airplane icon so it turns orange
    • Confirm that cellular, Wi Fi and Bluetooth turned off

    How to turn on airplane mode on Android

    Settings may vary depending on your Android phone’s manufacturer.

    • Swipe down from the top of the screen to open Quick Settings
    • Tap the airplane mode icon
    • Check that mobile data, Wi Fi and Bluetooth are disabled

    If you still want Bluetooth for a watch or headphones, you can turn it back on manually after enabling airplane mode. This keeps most background data transfers blocked while you sleep.

    Take my quiz: How safe is your online security?

    Think your devices and data are truly protected? Take this quick quiz to see where your digital habits stand. From passwords to Wi-Fi settings, you’ll get a personalized breakdown of what you’re doing right and what needs improvement. Take my Quiz here: Cyberguy.com.

    Kurt’s key takeaways

    Your smartphone works around the clock, even when you do not. Some background data sharing keeps your device secure and functional. Other data collection exists primarily to fuel tracking and advertising. The key is awareness and control. By tightening permissions, limiting background activity and disabling ad personalization, you reduce how much of your personal data leaves your phone while you sleep. Privacy is not about fear. It is about informed choices.

    Do you leave your phone fully on overnight, or will tonight be the night you finally switch it off? Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    Copyright 2026 CyberGuy.com. All rights reserved.  

    [ad_2]

    Source link

  • France dumps Zoom and Teams as Europe seeks digital autonomy from the US

    [ad_1]

    LONDON — In France, civil servants will ditch Zoom and Teams for a homegrown video conference system. Soldiers in Austria are using open source office software to write reports after the military dropped Microsoft Office. Bureaucrats in a German state have also turned to free software for their administrative work.

    Around Europe, governments and institutions are seeking to reduce their use of digital services from U.S. Big Tech companies and turning to domestic or free alternatives. The push for “digital sovereignty” is gaining attention as the Trump administration strikes an increasingly belligerent posture toward the continent, highlighted by recent tensions over Greenland that intensified fears that Silicon Valley giants could be compelled to cut off access.

    Concerns about data privacy and worries that Europe is not doing enough to keep up with the United States and Chinese tech leadership are also fueling the drive.

    The French government referenced some of these concerns when it announced last week that 2.5 million civil servants would stop using video conference tools from U.S. providers — including Zoom, Microsoft Teams, Webex and GoTo Meeting — by 2027 and switch to Visio, a homegrown service.

    The objective is “to put an end to the use of non-European solutions, to guarantee the security and confidentiality of public electronic communications by relying on a powerful and sovereign tool,” the announcement said.

    “We cannot risk having our scientific exchanges, our sensitive data, and our strategic innovations exposed to non-European actors,” David Amiel, a civil service minister, said in a press release.

    Microsoft said it continues to “partner closely with the government in France and respect the importance of security, privacy, and digital trust for public institutions.”

    The company said it is “focused on providing customers with greater choice, stronger data protection, and resilient cloud services — ensuring data stays in Europe, under European law, with robust security and privacy protections.”

    Zoom, Webex and GoTo Meeting did not respond to requests for comment.

    French President Emmanuel Macron has been pushing digital sovereignty for years. But there’s now a lot more “political momentum behind this idea now that we need to de-risk from U.S. tech,” Nick Reiners, at the Eurasia Group.

    “It feels kind of like there’s a real zeitgeist shift,” Reiners said

    It was a hot topic at the World Economic Forum’s annual meeting of global political and business elites last month in Davos, Switzerland. The European Commission’s official for tech sovereignty, Henna Virkkunen, told an audience that Europe’s reliance on others “can be weaponized against us.”

    “That’s why it’s so important that we are not dependent on one country or one company when it comes to very critical fields of our economy or society,” she said, without naming countries or companies.

    A decisive moment came last year when the Trump administration sanctioned the International Criminal Court’s top prosecutor after the tribunal, based in The Hague, Netherlands, issued an arrest warrant for Israeli Prime Minister Benjamin Netanyahu, an ally of President Donald Trump.

    The sanctions led Microsoft to cancel Khan’s ICC email, a move that was first reported by The Associated Press and sparked fears of a “kill switch” that Big Tech companies can use to turn off service at will.

    Microsoft maintains it kept in touch with the ICC “throughout the process that resulted in the disconnection of its sanctioned official from Microsoft services. At no point did Microsoft cease or suspend its services to the ICC.”

    Microsoft President Brad Smith has repeatedly sought to strengthen trans-Atlantic ties, the company’s press office said, and pointed to an interview he did last month with CNN in Davos in which he said that jobs, trade and investment. as well as security, would be affected by a rift over Greenland.

    “Europe is the American tech sector’s biggest market after the United States itself. It all depends on trust. Trust requires dialogue,” Smith said.

    Other incidents have added to the movement. There’s a growing sense that repeated EU efforts to rein in tech giants such as Google with blockbuster antitrust fines and sweeping digital rule books haven’t done much to curb their dominance.

    Billionaire Elon Musk is also a factor. Officials worry about relying on his Starlink satellite internet system for communications in Ukraine.

    Washington and Brussels wrangled for years over data transfer agreements, triggered by former National Security Agency contractor Edward Snowden’s revelations of U.S. cyber-snooping.

    With online services now mainly hosted in the cloud through data centers, Europeans fear that their data is vulnerable.

    U.S. cloud providers have responded by setting up so-called “sovereign cloud” operations, with data centers located in European countries, owned by European entities and with physical and remote access only for staff who are European Union residents.

    The idea is that “only Europeans can take decisions so that they can’t be coerced by the U.S.,” Reiners said.

    The German state of Schleswig-Holstein last year migrated 44,000 employee inboxes from Microsoft to an open source email program. It also switched from Microsoft’s SharePoint file sharing system to Nextcloud, an open source platform, and is even considering replacing Windows with Linux and telephones and videoconferencing with open source systems.

    “We want to become independent of large tech companies and ensure digital sovereignty,” Digitalization Minister Dirk Schrödter said in an October announcement.

    The French city of Lyon said last year that it’s deploying free office software to replace Microsoft. Denmark’s government and the cities of Copenhagen and Aarhus have also been trying out open-source software.

    “We must never make ourselves so dependent on so few that we can no longer act freely,” Digital Minister Caroline Stage Olsen wrote on LinkedIn last year. “Too much public digital infrastructure is currently tied up with very few foreign suppliers.”

    The Austrian military said it has also switched to LibreOffice, a software package with word processor, spreadsheet and presentation programs that mirrors Microsoft 365’s Word, Excel and PowerPoint.

    The Document Foundation, a nonprofit based in Germany that’s behind LibreOffice, said the military’s switch “reflects a growing demand for independence from single vendors.” Reports also said the military was concerned that Microsoft was moving file storage online to the cloud — the standard version of LibreOffice is not cloud-based.

    Some Italian cities and regions adopted the software years ago, said Italo Vignoli, a spokesman for The Document Foundation. Back then, the appeal was not needing to pay for software licenses. Now, it’s the main reason is to avoid being locked into a proprietary system.

    “At first, it was: we will save money and by the way, we will get freedom,” Vignoli said. “Today it is: we will be free and by the way, we will also save some money.”

    ___

    Associated Press writer Molly Hague in The Hague, Netherlands contributed to this report.

    [ad_2]

    Source link

  • Super Bowl scams surge in February and target your data

    [ad_1]

    NEWYou can now listen to Fox News articles!

    The Super Bowl is not only the biggest sporting event of the year, but it has also become one of the busiest scam seasons.

    Every February, millions of Americans receive texts, emails and calls tied to the game, such as “Your ticket couldn’t be delivered,” “Your streaming account needs verification” or “Your betting account was locked.” At first glance, these messages may seem like random spam, but in reality, they are carefully targeted.

    Instead of blasting messages blindly, scammers rely on data brokers – companies that collect, package and sell personal information. These brokers build detailed profiles, and scammers either buy or steal those lists to decide exactly who to target and when.

    Below, I’ll explain how this system works and, more importantly, how you can remove yourself from the data pipeline scammers depend on.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    TAX SEASON SCAMS SURGE AS FILING CONFUSION GROWS

    Scammers ramp up Super Bowl-themed fraud each February, using fake ticket, streaming and betting alerts to steal personal information from unsuspecting fans. (Elisa Schu/picture alliance via Getty Images)

    Why Super Bowl season is a gold mine for scammers

    Big events create urgency, emotion and distraction – perfect conditions for fraud. During Super Bowl week, scammers use the same themes real companies use:

    • Ticket confirmations
    • Streaming service alerts
    • Betting account warnings
    • Delivery delays for food or merchandise.

    But here’s the key: they don’t blast these messages randomly. They target people who look like likely buyers. That targeting comes from your digital profile.

    How scammers know you’re a ‘Super Bowl target’

    You might never have posted about football, yet you still receive a fake ticket message. That’s because data brokers build profiles using your:

    • Address history
    • Household size
    • Income range
    • Age
    • Shopping behavior
    • Most-used apps
    • Frequently visited websites
    • Household members.

    These details are stitched together from retailers, apps, public records and tracking tools – then sold to marketers and, eventually, leaked or resold to scammers. So when Super Bowl season arrives, scammers simply filter their lists: “People who look like they’d watch the game, place a bet, or order food.” And your phone number is right there.

    The most common Super Bowl scam messages

    During Super Bowl week, scammers flood inboxes and phones with messages that look like they came from legitimate companies. The goal is simple: create urgency, make you click and steal your information before you have time to think. Here are the scams I see spike every February:

    1) Fake ticket alerts

    “Your Super Bowl ticket transfer failed. Verify now.”

    These messages pretend to come from Ticketmaster, StubHub or SeatGeek. They claim your ticket couldn’t be delivered, your transfer is pending or your account needs verification. The link takes you to a fake login page that looks identical to the real site. The moment you enter your email and password, scammers capture your credentials. Many victims then find their real ticket accounts emptied, their payment methods used or their email taken over.

    How to spot it:

    • The sender’s address is misspelled
    • The link leads to a lookalike domain
    • The message creates panic and urgency.

    What to do: Never click. Go directly to the ticket site through your browser or app.

    2) Streaming account warnings

    “Your Super Bowl stream is on hold. Update billing now.”

    These messages impersonate major streaming platforms like YouTube TV, Hulu, ESPN, Peacock or cable providers. They claim your payment failed or your account is suspended just before kickoff. The link sends you to a fake billing page that steals your credit card details, login credentials or both. Some versions install malware that records keystrokes and login activity.

    Why this works: Millions of people stream the Super Bowl. Scammers know most recipients won’t even question it.

    What to do: Open the streaming app directly and check your account there. Ignore any links in the message.

    5 MYTHS ABOUT IDENTITY THEFT THAT PUT YOUR DATA AT RISK

    Man typing into his smartphone.

    Super Bowl scams aren’t random; criminals use detailed data broker profiles to target likely viewers, bettors and shoppers. (Kim Kulish/Corbis via Getty Images)

    3) Betting account freezes

    “Your wager is pending. Confirm your identity.”

    These target people who have been flagged by data brokers as likely sports bettors. Messages claim your account with DraftKings, FanDuel or BetMGM is locked due to “suspicious activity.”

    The fake verification page asks for:

    • Your full name
    • Date of birth
    • Social Security number
    • Bank or card details.

    This gives scammers everything they need to commit identity theft.

    What to do: Never respond to betting account messages outside the official app.

    4) Merch and food delivery scams

    “Your Super Bowl order is delayed. Track here.”

    Scammers mimic popular retailers and delivery apps, like Amazon, DoorDash, Uber Eats, FedEx and USPS. They claim your food, jersey or party supplies couldn’t be delivered.

    Clicking the tracking link can:

    • Install malware
    • Redirect you to a fake login page
    • Steal your payment info.

    Why it works: People are expecting packages and food orders that week, so the message feels real.

    What to do: Use the retailer’s official app or website to check orders.

    Why families are hit even harder

    Your data isn’t isolated. Data brokers connect people living at the same address, spouses, children and roommates. So one exposed profile becomes an entire household target. During Super Bowl weekend, when everyone’s using phones, scanning QR codes and ordering food, one bad click can put the whole family at risk.

    The real problem: you’re still on the lists

    Most people try to protect themselves by:

    • Deleting emails
    • Blocking numbers
    • Installing antivirus software.

    Those help, but they don’t stop your data from being sold again tomorrow. As long as your information exists in data-broker databases, scammers can keep finding you. That’s why I recommend removing your data at the source.

    The ‘game-day cleanup’ that stops the targeting

    If you want fewer scam messages, not just better filters, you need to remove your personal data from data brokers. That’s where a data removal service comes in. While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    What to do before Super Bowl weekend

    Here’s how to protect yourself right now:

    • Don’t click Super Bowl messages. Even if they look real, go directly to the company’s website instead. Use strong antivirus software to help block malicious links, fake websites and malware before they can steal your information.Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.
    • Avoid QR codes from emails or texts. Many link to fake login pages.
    • Use credit cards, not debit cards. They offer stronger fraud protection.
    • Remove your data from broker sites. This is the single most effective way to reduce scam targeting.

    FBI WARNS QR CODE PHISHING USED IN NORTH KOREAN CYBER SPYING

    Woman using her phone.

    Fake Super Bowl tickets and streaming messages often create urgency, pushing victims to click malicious links or fake login pages. (Kyle Ericksen/Penske Media via Getty Images)

    Kurt’s key takeaways

    Super Bowl scams are not random. Instead, they are precision-targeted using personal data sold behind the scenes. While you cannot stop scammers from trying, you can make it harder for them to find you. By removing your data now, you reduce scam messages, limit fake alerts and lower your risk, not only this Super Bowl, but throughout the entire year. That kind of protection is a win worth celebrating.

    Have you received scam texts or emails tied to the Super Bowl? What did they look like, and did you almost fall for one? Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter. 

    Copyright 2026 CyberGuy.com. All rights reserved.

    [ad_2]

    Source link

  • TikTok after the US sale: What changed and how to use it safely

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Since news broke in late January that TikTok’s U.S. operations would move under American-led ownership, many people who previously avoided the app are reconsidering. The shift has reopened conversations among parents, educators and older adults who once viewed TikTok as off-limits due to foreign ownership concerns.

    One reader summed up that hesitation clearly in an email we received. It reflects a question many families are asking right now.

    “I read a summary of the approved joint venture deal between China (20%) and U.S. Investors (80%). We do not have a TikTok account at this time. We’ve been following through the media about the helpful shorts and are considering opening an account, once the deal is consummated and control of accounts is in the hands of the U.S. side. Yet, we are not techies and are still concerned about the security of said accounts.”

    — Charlie

    That concern is understandable. For years, TikTok raised legitimate questions about foreign ownership, data access and national security. Those concerns were serious enough to trigger government bans, lawsuits and strong warnings to families. Now, that chapter has shifted. TikTok’s U.S. operations now sit under a U.S.-led ownership structure, with American investors holding a controlling interest and operational authority. That change matters. But it does not automatically change how the platform behaves. The more useful question today is not whether TikTok is allowed. It is how to use it wisely, with clear boundaries and better controls, especially for kids and teens. That is what this guide is about.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    5 MYTHS ABOUT IDENTITY THEFT THAT PUT YOUR DATA AT RISK

    TikTok’s shift to U.S.-led ownership has parents and older adults reconsidering the app after years of security concerns tied to foreign control. (Kayla Bartkowski/ Los Angeles Times via Getty Images)

    What the US ownership change actually improves

    It is important to acknowledge what is different now.

    US governance and control

    TikTok’s U.S. operations are no longer controlled by a China-based parent company. This removes the risk of direct access under Chinese national security laws.

    Stronger regulatory oversight

    The platform now operates under U.S. privacy expectations, enforcement standards and congressional scrutiny. That brings clearer guardrails around data handling.

    Clear accountability

    When something goes wrong, responsibility sits in one jurisdiction. There is no ambiguity about who answers for it. That is meaningful progress, especially for families who avoided TikTok entirely due to concerns about ownership.

    What TikTok says the new US structure safeguards

    TikTok says its U.S. operations now run through TikTok USDS Joint Venture LLC, a majority American-owned entity created under an executive order signed on Sept. 25, 2025. According to the company, the joint venture is designed to protect U.S. user data, secure the recommendation algorithm and oversee trust and safety decisions for American users. TikTok says U.S. user data is stored in Oracle’s secure U.S.-based cloud environment and protected through a comprehensive privacy and cybersecurity program that is audited and certified by third-party experts.

    The company also says the recommendation algorithm used for U.S. users is retrained, tested and secured within the United States. TikTok adds that the joint venture has decision-making authority over trust and safety policies and content moderation for U.S. users, with ongoing transparency reporting and independent oversight. These safeguards focus on where data is stored, who governs it and how systems are audited, not on eliminating data collection or personalization.

    What has not changed at all

    Here is the part many people overlook.

    Even with new ownership, TikTok still operates on the same core business model as every major social media platform.

    • It tracks what you watch and how long you watch.
    • It learns your interests and habits.
    • It uses that information to shape your feed and target advertising.

    TikTok remains exceptionally effective at this. Its recommendation system adapts quickly, which explains both its popularity and its influence. That power makes privacy settings more important than ever.

    A smarter way to use TikTok as a family

    Pretending TikTok does not exist rarely works. Kids hear about it from friends. Adults see useful videos shared across other platforms. A better approach is to set up intentionally from the start. The steps below do not ruin the experience. They simply reduce unnecessary exposure and give families more control.

    Step 1: Stop TikTok from accessing your contacts

    Limiting contact access prevents TikTok from mapping your personal network.

    How to turn off Contacts and Facebook syncing

    • Open the TikTok app
    • Tap your profile in the bottom right
    • Tap the three-line menu in the top right
    • Select Settings and Privacy
    • Click Privacy
    • Tap Sync Contacts and Facebook Friends
    • Toggle both options off so they appear gray

    Why this matters

    When contact syncing is on, TikTok can learn who you know, even if those people never use the app. Turning it off limits how the platform connects your account to real-world relationships, reduces account suggestions tied to your phone book and helps keep your personal network from becoming part of TikTok’s data profile.

    Step 2: Reduce ad targeting

    You will still see ads. They will rely less on activity outside TikTok.

    How to disable off-TikTok ad tracking

    • Open the TikTok app
    • Go to your profile in the bottom right of the screen
    • Click the three-line menu in the upper right
    • Tap Settings and Privacy
    • Scroll to Ads and tap it
    • Under Manage your off-TikTok data, toggle Targeted ads outside of TikTok off so it turns gray
    • If available, also toggle Targeted ads off to further limit personalization

    Why this matters

    Turning these off reduces how TikTok uses data collected beyond the app to personalize advertising. You will still see ads, but they will be less closely tied to your browsing and app activity elsewhere.

    Step 3: Make your account private

    This step is especially important for kids and teens. A private account limits who can view content, comment and interact.

    How to make your account private

    • Open the TikTok app
    • Go to your profile  in the bottom right of the screen
    • Click the three-line menu in the upper right
    • Tap Settings and Privacy
    • Click Privacy
    • Toggle Private Account on so it turns blue
    • Toggle Activity Status off so it turns gray

    Why this matters

    A private account puts you in control of who can view your content and interact with you. This is especially important for kids and teens, since it reduces exposure to strangers, spam accounts and unwanted messages.

    WHY CLICKING THE WRONG COPILOT LINK COULD PUT YOUR DATA AT RISK

    Street view of the TikTok building.

    Families weighing TikTok now face a new question: how to use the platform safely, even under American oversight. (Kayla Bartkowski/ Los Angeles Times via Getty Images)

    Step 4: Control how people can find you

    TikTok suggests accounts based on contacts, phone numbers and shared connections unless you stop it.

    How to turn off account suggestions

    • Open the TikTok app
    • Go to your profile in the bottom right of the screen
    • Tap the three-line menu in the upper right
    • Tap Settings and Privacy
    • Click Privacy
    • Tap Suggest Your Account to Others
    • Turn off all options

    Why this matters

    Account suggestions are often driven by phone numbers, contacts and shared connections. Turning these off makes it harder for TikTok to link your account to your offline identity or surface it to people you did not choose to connect with.

    Step 5: Hide what you like and follow

    Likes and follows send signals about your interests and habits. Keeping them private adds another layer of protection.

    How to hide your activity

    • Open the TikTok app
    • Go to your profile in the bottom right of the screen
    • Tap the three-line menu in the upper right
    • Tap Settings and Privacy
    • Click Privacy
    • Tap Following List under Interactions
    • Set it to Only you

    Why this matters

    Likes and follows reveal interests, habits and patterns over time. Keeping them private limits how much others can infer about you and reduces the data signals TikTok can amplify across the platform.

    Step 6: Download your TikTok data

    This step often changes how people view the platform.

    How to request your TikTok data

    • Open the TikTok app
    • Go to your profile in the bottom right of the screen
    • Tap the three-line menu in the upper right
    • Tap Settings and Privacy
    • Tap Account
    • Tap Download Your Data
    • Under Request data, review the types of information included and click the box next to it or select all 
    • Choose a file format
    • Tap Request data

    TikTok will begin preparing your file. This process typically takes a few days. Once your data is ready, you must return to the Download data tab to retrieve it. The download link expires after a short window, so check back regularly.

    Why this matters

    Requesting your data shows the full scope of what TikTok stores about your account, from activity patterns to interaction history. Seeing that information firsthand helps you decide whether the level of tracking aligns with how you want to use the platform.

    Pro tip: Protect yourself beyond app settings

    Privacy settings help, but they cannot stop everything. Social media platforms like TikTok are common delivery points for malicious links, fake giveaways and look-alike login pages designed to steal passwords or install malware. Using strong, up-to-date antivirus software adds a critical layer of protection by blocking dangerous sites and downloads before a single click turns into a problem. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

     Take my quiz: How safe is your online security?

    Think your devices and data are truly protected? Take this quick quiz to see where your digital habits stand. From passwords to Wi-Fi settings, you’ll get a personalized breakdown of what you’re doing right and what needs improvement. Take my Quiz here: Cyberguy.com.

    WHATSAPP WEB MALWARE SPREADS BANKING TROJAN AUTOMATICALLY

    TikTok logo on a smartphone screen.

    (Photo Illustration by Nikolas Kokovlis/NurPhoto via Getty Images)

    Kurt’s key takeaways

    TikTok says new safeguards protect where U.S. data lives and who controls it. Your personal settings still determine how much data exists in the first place. Ownership changes reduce certain risks, but they do not replace personal responsibility. Privacy on TikTok depends far more on how you configure it than who owns it. If you are considering opening an account now that control sits with U.S. investors, start slow, lock down the settings and review your data early. That approach keeps you in control rather than the algorithm.

    If a platform knows this much about you, how much access are you truly comfortable giving it? Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    Copyright 2026 CyberGuy.com. All rights reserved.

    [ad_2]

    Source link

  • Tax season scams surge as filing confusion grows

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Tax season already brings stress. In 2026, it brings added confusion. Changes to tax filing programs and the discontinuation of the free government-run filing system have left many taxpayers unsure about what is legitimate. That uncertainty has created an opening for scammers who move quickly when people hesitate. 

    “Every tax season we see scammers ramp up their activity, and with likely confusion now that the free government-run filing system is discontinued, we’re sure scammers will take advantage,” said Lynette Owens, vice president of consumer marketing and education at Trend Micro.

    In past years, scammers have leaned heavily on impersonation. Fake IRS emails promising refunds, text messages claiming accounts have been flagged under new rules and fraudulent tax help offers that promise faster returns continue to circulate, Owens said. As February begins, many taxpayers feel pressure to file quickly. That urgency creates the perfect conditions for fraud.

    Sign up for my FREE CyberGuy Report

    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

    WHY SCAMMERS OPEN BANK ACCOUNTS IN YOUR NAME

    Scam emails often pose as IRS notices and demand immediate action to protect a refund. The IRS does not contact taxpayers this way. (Kurt “CyberGuy” Knutsson)

    Why scammers thrive when tax rules feel unclear

    Uncertainty is one of the most effective tools scammers have. When taxpayers are unsure how filing rules work or whether a message is legitimate, criminals step in with communications designed to sound official and helpful. The goal is not clarity. It is speed.

    “Scammers aim to create a heightened sense of anxiety among the people they are targeting,” Owens said. “When taxpayers don’t feel confident about what’s real, whether it’s new filing options, eligibility rules or program updates, criminals step in with messages that sound official and helpful.” They often pose as the IRS, a tax prep service, or even government support. Once trust is established, the message quickly turns transactional, asking for clicks, personal data or payments.

    The most common IRS impersonation scams right now

    While the delivery methods change, the core message rarely does. Something is wrong, and it must be fixed immediately. 

    “The most common tactic we’re seeing is fake refund or account alert messages that claim something is wrong and demand immediate action,” Owens said. Other scams go a step further. Some direct victims to fake IRS login pages designed to steal credentials.

    Others promote fraudulent tax assistance, presenting themselves as government-backed or low-cost help in order to collect personal and financial information. These scams arrive by email, text message, phone calls and fake websites. Many are polished enough to appear legitimate at first glance.

    Why phrases like new rules and urgent issues work

    Language plays a central role in tax scams. Phrases such as new rules or urgent account issues are designed to trigger panic before logic has a chance to catch up. They suggest the recipient has missed something important or risks losing money.

    “Those phrases work because they can trigger panic and urgency, and people are more likely to react emotionally than logically,” Owens said. “New rules suggest you may have missed something important, and an urgent account issue creates fear of penalties, delays or losing a refund.” 

    The safest response is to pause. Do not click links, reply to messages or call phone numbers included in the alert. Instead, go directly to a trusted source like IRS.gov using your own browser.

    A real tax scam message that looks legitimate

    Many tax scams follow a familiar structure. A common example reads: “IRS Notice: Your tax refund is on hold due to a filing discrepancy under updated 2026 rules. Verify your identity now to avoid delays.” 

    At first glance, messages like this may appear credible. They often include official-looking logos, reference numbers and links that resemble real government pages.

    “It may include a convincing IRS-style logo, a case number and a link that looks legitimate at a glance,” Owens said. “But the red flags are usually the same.” The message pressures immediate action, directs users to non-government websites, and requests sensitive information such as Social Security numbers, bank details or login credentials.

    HOW TO STOP IMPOSTOR BANK SCAMS BEFORE THEY DRAIN YOUR WALLET

    A fake IRS notification

    Fake IRS alerts use urgent language like “account issue” or “new rules” to trigger panic. Scammers rely on fear to push quick decisions. (Kurt “CyberGuy” Knutsson)

    What happens after someone falls for a tax scam?

    The damage rarely ends with a single click. 

    “The most serious consequences are identity theft and financial loss,” Owens said. “Once scammers have personal information, they can file fraudulent tax returns, steal refunds, open credit accounts and access bank funds.”

    Victims often spend months working to recover lost money, repair credit damage and restore their identities.

    How the IRS really communicates with taxpayers

    Despite repeated warnings, many people still believe the IRS might email or text them. 

    “A legitimate tax service or the IRS won’t reach out unexpectedly by email, text or social media, and they won’t pressure you to act immediately,” Owens said.

    Scam messages often share the same warning signs. They sound urgent, include links or attachments and ask for sensitive information right away. If a message creates panic or demands fast action, that alone is reason to be skeptical. The IRS primarily communicates by official mail. Unexpected digital contact should always raise concern.

    What to watch for next as scams evolve

    Tax scams continue to grow more sophisticated each year. 

    “Taxpayers should watch for scams that feel more real than ever,” Owens said. “That includes highly polished phishing emails, refund texts designed for quick mobile clicks, fake tax help ads and cloned websites that mimic real IRS or tax prep portals.”

    The biggest mistake people still make is treating an unexpected tax message like an emergency. 

    “In tax season, speed is the scammer’s advantage,” Owens said. “Taking 30 seconds to double-check the source can prevent months of financial and identity damage.”

    What to do if you clicked or responded by mistake

    If someone realizes too late that a message was fraudulent, fast action can limit the damage. 

    “First, stop engaging immediately,” Owens said. “Don’t click links, download attachments or reply.”

    Next, report the incident. Forward phishing emails to phishing@irs.gov and file a report at reportfraud.ftc.gov.

    After that, monitor financial accounts closely, change passwords and consider placing a fraud alert or credit freeze if necessary.

    To learn more about how to do this, go to Cyberguy.com and search “How to freeze your credit.” 

    SCAMMERS TARGET RETIREES AS MAJOR 401(K) RULE CHANGES LOOM FOR 2026 TAX YEAR AHEAD NATIONWIDE

    A calculator on top of tax papers

    Tax scammers target personal and financial data to steal refunds or commit identity theft. (Kurt “CyberGuy” Knutsson)

    Ways to stay safe during tax season

    Scammers count on rushed decisions. The good news is that a few smart habits can dramatically lower your risk.

    1) Slow down before responding to tax messages

    Urgency is the scammer’s favorite tool. Messages that demand immediate action aim to short-circuit your judgment. 

    “Scammers rely on fear, urgency or false promises, especially during tax season,” Owens said. “It’s important to slow down, verify information through official channels, and use trusted security tools.” If a message pressures you to act fast, stop. Take a breath before doing anything else.

    2) Verify filing changes through official IRS channels

    Scam messages often reference new rules, updated policies or eligibility changes. That language sounds credible when filing programs shift. Always confirm changes by typing IRS.gov directly into your browser or signing in to your trusted tax provider account. Never rely on links or phone numbers included in a message.

    3) Protect tax accounts with strong credentials

    Tax portals hold valuable personal and financial data. Weak passwords make them easy targets. Use strong and unique passwords for every tax-related account. A password manager can help generate and store secure credentials without relying on memory.

    Next, see if your email has been exposed in past breaches. Our #1 password manager (see Cyberguy.com) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

    Check out the best expert-reviewed password managers of 2026 at Cyberguy.com

    4) Watch for pressure tactics and refund promises

    Scammers know refunds motivate quick action. Messages claiming your refund is waiting, delayed or at risk often signal fraud. Be cautious of promises like faster refunds, guaranteed results or special access to government-backed assistance. Legitimate services do not operate that way.

    5) Avoid links and secure your devices with strong antivirus software 

    Clicking a single link can expose login credentials or install malware. Do not click on links in unexpected tax messages. Also, use strong antivirus software to help block malicious sites and detect threats before damage occurs.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

    6) Reduce your digital footprint

    Personal data fuels tax scams. The more information criminals can find online, the easier impersonation becomes. Using a data removal service can help limit exposed personal details across data broker sites. Less data means fewer opportunities for scammers to exploit your identity.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

    Kurt’s key takeaways

    Tax season pressure makes even cautious people vulnerable. In 2026, filing confusion adds fuel to the fire. Scammers know this and design messages to look official, urgent and helpful. Pausing, verifying and trusting official sources remains the strongest defense. When something feels rushed, it is usually for a reason.

    Have you received a suspicious IRS message this tax season, and what made you question whether it was real? Let us know by writing to us at Cyberguy.com

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

    Copyright 2026 CyberGuy.com.  All rights reserved.

    [ad_2]

    Source link

  • Amazon Prime settlement could put money back in your pocket

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Amazon has agreed to pay $2.5 billion to settle allegations brought by the Federal Trade Commission over how it enrolled customers in Prime and how difficult it made cancellation. 

    The FTC alleged Amazon enrolled millions of consumers without clear consent and failed to provide a simple way to cancel.

    “The evidence showed that Amazon used sophisticated subscription traps designed to manipulate consumers into enrolling in Prime, and then made it exceedingly hard for consumers to end their subscription,” Federal Trade Commission Chairman Andrew N. Ferguson said.

    Rather than proceed to trial, Amazon chose to settle the case. The company did not admit liability and says it has already made changes to Prime enrollment and cancellation flows. Still, the agreement stands as the second-largest monetary judgment ever secured by the Federal Trade Commission.

    ALEXA.COM BRINGS ALEXA+ TO YOUR BROWSER

    Eligible U.S. Amazon Prime members can now file claims for refunds tied to the FTC’s $2.5 billion settlement. (iStock)

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter

    How the $2.5 billion settlement breaks down

    The court-ordered settlement is divided into two parts. First, Amazon must pay a $1 billion civil penalty to the federal government. As a result, this marks the largest civil penalty ever tied to a violation of an FTC rule. Second, $1.5 billion is set aside for consumer refunds. Eligible Prime subscribers may receive compensation for Prime membership fees paid during the covered period, capped at $51 per person. Because this is an FTC action, only U.S.-based Prime subscribers qualify. Therefore, customers outside the United States are not eligible.

    Who qualifies for an Amazon Prime refund

    You may qualify for compensation if either of the following applies.

    • First, you signed up for Amazon Prime in the United States between June 23, 2019, and June 23, 2025.
    • Alternatively, you attempted to cancel Prime through the online cancellation process during that same period but were unable to complete it. This includes entering the cancellation flow and not finishing or accepting a Save Offer.

    To confirm when you joined Prime, log in to your Amazon account. Then go to Memberships and Subscriptions and select Payment history under Prime.

    How Amazon is issuing refunds

    Under the settlement, refunds are distributed in two groups based on eligibility.

    Automatic Payment Group

    Some consumers qualified for automatic payments.

    • You were eligible if you signed up for Prime between June 23, 2019, and June 23, 2025, enrolled through a challenged enrollment flow and used no more than three Prime benefits in any 12-month period.
    • Automatic payments were issued within 90 days of the court order, with most eligible customers receiving funds by late December 2025. These payments covered Prime membership fees paid up to $51. No claim was required.

    However, if you believe you qualified for an automatic payment but did not receive one, you may still be eligible to file a claim.

    Claims Process Payment Group

    At this point, the claims process is the primary path for refunds. The claims window opened January 5, 2026. Eligible consumers are being notified by email or postcard through early February. You may qualify to file a claim if you unintentionally enrolled in Prime through a challenged enrollment method or tried but failed to cancel your membership online between June 23, 2019, and June 23, 2025, and used fewer than 10 Prime benefits during any 12-month period. In addition, you must not have already received an automatic payment. To file a claim, you will need to confirm one of two conditions by checking a box on the claim form. Claims are reviewed for eligibility. Approved claims receive compensation for Prime fees paid, capped at $51 per person.

    The FTC says Amazon used confusing Prime signup and cancellation flows that led millions of users into unwanted subscriptions.

    The FTC says Amazon used confusing Prime signup and cancellation flows that led millions of users into unwanted subscriptions. (iStock)

    Where to file a Prime settlement claim

    If you are eligible to file a claim, official instructions will be provided by email or mail. You can also access the court-approved settlement site directly at: subscriptionmembershipsettlement.com.

    Links to the settlement site are also available on Amazon’s website, the Prime membership page and within the Amazon app.

    THE WEEK’S BEST AMAZON HOME DEALS: SAVE 40% OR MORE ON PILLOWS, BLENDERS, VACUUMS AND MORE

    Even if you do not qualify for a refund, this settlement is a strong reminder to review your subscriptions and confirm you are paying only for services you actively use. Here’s how to cancel a subscription using your iPhone and Android.

    “Payments are being handled by the settlement administrator. Customers can find information and submit claims at the administrator’s website subscriptionmembershipsettlement.com,” an Amazon spokesperson told CyberGuy.

    How to add or manage your Amazon Prime account

    If you already have an Amazon account, adding or managing Prime takes only a few minutes. First, log in to Amazon and open the Accounts and Lists menu. From there, select Prime to view your membership details. Next, follow the prompts to add Prime or manage an existing subscription. Amazon displays pricing, billing dates and available benefits before you confirm. For that reason, review each screen carefully so you know exactly what you are agreeing to. For more on “How to get a cheap Amazon Prime membership,” click here.

    Take my quiz: How safe is your online security?

    Think your devices and data are truly protected? Take this quick quiz to see where your digital habits stand. From passwords to Wi-Fi settings, you’ll get a personalized breakdown of what you’re doing right and what needs improvement. Take my Quiz here: Cyberguy.com.

    Kurt’s key takeaways

    Overall, this settlement sends a clear message about subscription transparency. While a $51 refund may feel modest, the broader impact matters. Regulators are forcing companies to simplify signups and make cancellations easier. If you ever felt trapped in a subscription you did not intend to start, this case shows enforcement is finally catching up to deceptive design tactics.

    The claim form shows where to find your Claim ID and PIN, which are required to file for an Amazon Prime settlement refund.

    The claim form shows where to find your Claim ID and PIN, which are required to file for an Amazon Prime settlement refund. (iStock)

    Have you ever tried to cancel a subscription and felt blocked or misled along the way? Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    Copyright 2026 CyberGuy.com. All rights reserved.

    [ad_2]

    Source link

  • YouTube lets parents limit or block Shorts for teens

    [ad_1]

    NEWYou can now listen to Fox News articles!

    YouTube is rolling out new parental controls designed to give families more say over how much time teens spend scrolling through Shorts. 

    Parents can now set daily time limits or block Shorts entirely, depending on what works best for their household. The update comes as concerns grow around endless scrolling and its impact on teens. 

    YouTube says these tools are meant to support healthier viewing habits while still allowing young users to enjoy the platform in a more balanced way.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    Why YouTube is focusing on Shorts

    Parents can now set a daily time limit for YouTube Shorts, including an option to block Shorts entirely.  (AP Photo/Lai Seng Sin, File)

    5 PHONE SAFETY TIPS EVERY PARENT SHOULD KNOW

    Short-form video has become one of the most addictive parts of social media, especially for teens. The constant scroll can make it hard to stop watching, even when kids are supposed to be studying or winding down for bed. YouTube says the new controls respond to feedback from parents, advocates, and lawmakers who want stronger safeguards for young users. The goal is to give families flexibility instead of forcing an all-or-nothing approach.

    What parents can now control on YouTube

    If you supervise a teen’s Google account, you can now:

    • Set a daily time limit for YouTube Shorts
    • Block Shorts entirely by setting the limit to zero minutes
    • Turn on bedtime reminders
    • Enable take-a-break alerts
    • Manage supervised teen accounts across multiple devices

    YouTube also says it is adjusting how content is recommended to teens, placing more emphasis on videos tied to curiosity, life skills, inspiration, and credible information that supports well-being.

    How parents limit or block YouTube Shorts for teens

    Before you start, make sure:

    • Your teen is using a supervised Google account
    • You have access to Google Family Link
    • Your teen is signed into YouTube on their device with that supervised account

    Step-by-step instructions

    • Open the Google Family Link app on your phone or tablet (iPhone or Android).
    • Tap your teen’s profile.
    • Tap Controls, then select YouTube.If YouTube does not appear, confirm the account is set up as supervised.
    • If YouTube does not appear, confirm the account is set up as supervised.
    • Tap Screen time or Shorts settings.
    • Find the option labeled Shorts daily limit.
    • Choose how much time your teen can scroll Shorts each day:Set a time limit to allow limited scrollingSet the limit to zero minutes to block Shorts entirely
    • Set a time limit to allow limited scrolling
    • Set the limit to zero minutes to block Shorts entirely
    • In the same section, turn on:Take a break remindersBedtime reminders
    • Take a break reminders
    • Bedtime reminders
    • Confirm your changes.

    The new limits apply immediately.

    OPENAI TIGHTENS AI RULES FOR TEENS BUT CONCERNS REMAIN

    Children Use Smartphones in Hallway

    YouTube’s supervised account settings let parents choose age-appropriate content and manage how teens experience the platform. (StockPlanets/Getty Images)

    What happens when your teen reaches the Shorts limit

    Once the daily limit is reached:

    • The Shorts feed locks
    • A message explains that the daily limit has been reached
    • Shorts unlock automatically the next day

    Regular, long-form YouTube videos remain available unless you restrict them separately through screen-time controls.

    Important things parents should know

    • Teens cannot change or bypass Shorts limits on their own
    • Limits apply across all devices signed into the supervised account
    • Shorts controls are separate from overall YouTube screen-time limits
    • Blocking Shorts does not block standard YouTube videos

    Other parental tools worth checking

    Beyond Shorts, parents can also:

    • Turn off autoplay
    • Review watch and search history
    • Adjust content recommendations
    • Pause YouTube during homework or sleep hours

    These options are managed through Google Family Link, with guidance and account setup available in YouTube’s Family Center.

    What this means to you

    If you are a parent or guardian, these controls give you more practical ways to manage screen time without banning YouTube entirely. You can limit Shorts during school nights, allow more time on long trips, or block them when focus matters most. Instead of relying on willpower alone, families now have built-in tools that help reinforce healthy habits.

    Take my quiz: How safe is your online security?

    Think your devices and data are truly protected? Take this quick quiz to see where your digital habits stand. From passwords to Wi-Fi settings, you’ll get a personalized breakdown of what you’re doing right and what needs improvement. Take my Quiz here: Cyberguy.com.

    Kurt’s key takeaways

    Short-form video is not going away, but the way teens interact with it can change. YouTube’s new parental controls show a shift toward giving families more flexibility and clearer boundaries. Used alongside conversations about online habits, these tools can make a real difference. Oh, and be sure to check out my new “Beyond Connected” podcast on YouTube.

    Child using a device on a couch.

    YouTube says these new parental controls are designed to reduce endless scrolling and support healthier viewing habits for teens. (Kurt “CyberGuy” Knutsson)

    How much control do you think parents should have over teens’ screen time, and where should the line be drawn? Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    Copyright 2026 CyberGuy.com. All rights reserved.

    [ad_2]

    Source link

  • Grubhub confirms data breach amid extortion claims

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Food delivery platform Grubhub has confirmed a recent data breach after unauthorized actors accessed parts of its internal systems. 

    The disclosure comes as sources tell BleepingComputer the company is now facing extortion demands linked to stolen data.

    In a statement to BleepingComputer, Grubhub said it detected and stopped the activity quickly.

    “We’re aware of unauthorized individuals who recently downloaded data from certain Grubhub systems,” the company said. “We quickly investigated, stopped the activity, and are taking steps to further increase our security posture.”

    Grubhub added that sensitive information, such as financial details or order history, was not affected. However, the company declined to answer follow-up questions about when the breach occurred, whether customer data was involved or if it is actively being extorted.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    RANSOMWARE ATTACK EXPOSES SOCIAL SECURITY NUMBERS AT MAJOR GAS STATION CHAIN

    Grubhub confirmed a data breach after unauthorized actors accessed parts of its internal systems, prompting an investigation and heightened security measures. (Michael Nagle/Bloomberg via Getty Images)

    What Grubhub has confirmed so far

    While details remain limited, Grubhub confirmed several key points. It has brought in a third-party cybersecurity firm and notified law enforcement. Beyond that, the company has stayed largely silent. That lack of detail has raised concern, especially given Grubhub’s recent security history. Just last month, the company was linked to scam emails sent from its own b.grubhub.com subdomain. Those messages promoted a cryptocurrency scam promising large returns on Bitcoin payments. Grubhub said it contained the incident and blocked further unauthorized emails. It did not clarify whether the two events are related.

    Sources link the breach to ShinyHunters extortion

    According to multiple sources cited by BleepingComputer, the ShinyHunters hacking group is behind the extortion attempt. The group has not publicly commented on the claims and declined to respond when contacted. Sources say the attackers are demanding a Bitcoin payment to prevent the release of stolen data. That data reportedly includes older Salesforce records from a February 2025 breach and newer Zendesk data taken during the most recent intrusion. Grubhub uses Zendesk to run its online customer support system. That platform handles order issues, account access and billing questions, making it a valuable target for attackers.

    How stolen credentials may have enabled the attack

    Investigators believe the breach may be tied to credentials stolen during earlier Salesloft Drift attacks. In August 2025, threat actors used stolen OAuth tokens from Salesloft’s Salesforce integration to access sensitive systems over a 10-day period. According to a report from Google Threat Intelligence Group, also known as Mandiant, attackers used that stolen data to launch follow-up attacks across multiple platforms. “GTIG observed UNC6395 targeting sensitive credentials such as AWS access keys, passwords and Snowflake-related access tokens,” Google reported. ShinyHunters previously claimed responsibility for that campaign, stating it stole roughly 1.5 billion records from Salesforce environments tied to hundreds of companies.

    Why this breach still matters

    Even if payment data and order history were not affected, support systems often contain personal details. Names, email addresses and account notes can be enough to fuel phishing attacks or identity scams. More importantly, this incident highlights how older breaches can continue to cause damage long after the initial attack. Stolen credentials that are never rotated remain a powerful entry point for threat actors.

    Ways to stay safe after the Grubhub data breach

    If you use Grubhub or any online delivery service, a few smart steps can reduce your risk after a breach.

    1) Update your password and stop re-use

    Start by changing your Grubhub password right away. Make sure you do not reuse that password anywhere else. Reused passwords give attackers an easy path into other accounts. A password manager can help here. It creates strong, unique logins and stores them securely so you do not have to remember them all.

    Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

    Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.

    ILLINOIS DHS DATA BREACH EXPOSES 700K RESIDENTS’ RECORDS

    Man delivering Grubhub.

    The food delivery platform says it quickly stopped the intrusion but has not disclosed when the breach occurred or whether customers were targeted. (Leonardo Munoz/VIEWpress)

    2) Turn on two-factor authentication

    If two-factor authentication (2FA) is available, enable it. This adds a second step when you sign in, such as a code sent to your phone or app. Even if a hacker steals your password, two-factor authentication can stop them from getting in.

    3) Watch closely for phishing attempts and use strong antivirus software

    Be alert for emails or texts that mention orders, refunds or support issues. Attackers often use stolen support data to make messages feel urgent and real. Do not click links or open attachments unless you are certain they are legitimate. Strong antivirus software can also help block malicious links and downloads before they cause harm.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

    4) Remove your data from people-search sites

    Consider using a data removal service to reduce your online footprint. These services help remove your personal details from data broker sites that attackers often use to build profiles. Less exposed data means fewer tools for scammers to exploit.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    5) Ignore crypto messages using trusted brands

    Be skeptical of any cryptocurrency offers tied to familiar companies. Grubhub was previously linked to scam emails promoting crypto schemes, which shows how often attackers abuse trusted names. Legitimate companies do not promise fast returns or pressure you to act immediately.

    6) Monitor your Grubhub account and email activity

    Check your Grubhub account for anything that looks unfamiliar. Watch for unexpected password reset emails, order confirmations or support messages you did not request. Attackers often test stolen data quietly before making bigger moves.

    7) Secure the email linked to your Grubhub account

    Your email account is the key to password resets. Change that password and enable two-factor authentication if it is not already on. If attackers control your email, they can regain access even after you change other passwords.

    8) Stay alert for delayed scams tied to the breach

    Breach data is often reused weeks or months later. Phishing attempts may appear long after headlines fade. Treat any future messages claiming to reference Grubhub support, refunds or account issues with extra caution.

    These steps will not undo a breach, but they can limit how attackers exploit stolen information and reduce your risk going forward.

    FIBER BROADBAND GIANT INVESTIGATES BREACH AFFECTING 1M USERS

    Laptop on the Grubhub site.

    Sources tell BleepingComputer the Grubhub breach is tied to extortion demands involving allegedly stolen customer support data. (Gabby Jones/Bloomberg via Getty Images)

    Kurt’s key takeaways

    Grubhub’s confirmation puts an official stamp on what sources have warned about for weeks. While the company says sensitive data was not affected, unanswered questions remain. As extortion-driven breaches rise, transparency and rapid credential rotation matter more than ever. What stands out most is how past compromises continue to create new risks. When access tokens live too long, attackers do not need to break in again. They simply walk back through an open door.

    If companies stay quiet after breaches, how can customers know when it is time to protect themselves? Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    Copyright 2026 CyberGuy.com. All rights reserved.

    [ad_2]

    Source link

  • French lawmakers approve bill banning social media for children under 15

    [ad_1]

    PARIS — French lawmakers approved a bill banning social media for children under 15, paving the way for the measure to enter into force at the start of the next school year in September, as the idea of setting a minimum age for use of the platforms gains momentum across Europe.

    The bill, which also bans the use of mobile phones in high schools, was adopted by a 130-21 vote late Monday. French President Emmanuel Macron has requested that the legislation be fast-tracked and it will now be discussed by the Senate in the coming weeks.

    “Banning social media for those under 15: this is what scientists recommend, and this is what the French people are overwhelmingly calling for,” Macron said after the vote. “Because our children’s brains are not for sale — neither to American platforms nor to Chinese networks. Because their dreams must not be dictated by algorithms.”

    The issue is one of the very few in a divided National Assembly to attract such broad support, despite critics from the hard left denouncing provisions of the bill as infringement on civil liberties. Weakened domestically since his decision to dissolve parliament plunged France into a prolonged political crisis, Macron has strongly supported the ban, which could become one of the final major measures adopted under his leadership before he leaves office next year.

    The French government had previously passed a law banning phone use in all primary and middle schools.

    The vote in the assembly came just days after the British government said it will consider banning young teenagers from social media as it tightens laws designed to protect children from harmful content and excessive screen time.

    The French bill has been devised to be compliant with the European Union’s Digital Services Act, which imposes a set of strict requirements designed to keep internet users safe online. In November, European lawmakers called for action at EU level to protect minors online, including a bloc-wide minimum age of 16 and bans on the most harmful practices.

    According to France’s health watchdog, one in two teenagers spends between two and five hours a day on a smartphone. In a report published in December, it said that some 90% of children aged between 12 and 17 use smartphones daily to access the internet, with 58% of them using their devices for social networks.

    The report highlighted a range of harmful effects stemming from the use of social networks, including reduced self-esteem and increased exposure to content associated with risky behaviors such as self-harm, drug use and suicide. Several families in France have sued TikTok over teen suicides they say are linked to harmful content.

    The French ban won’t cover online encyclopedias, educational or scientific directories, or platforms for the development and sharing of open-source software.

    In Australia, social media companies have revoked access to about 4.7 million accounts identified as belonging to children since the country banned use of the platforms by those under 16, officials said. The law provoked fraught debates in Australia about technology use, privacy, child safety and mental health and has prompted other countries to consider similar measures.

    [ad_2]

    Source link

  • French Lawmakers Approve Bill Banning Social Media for Children Under 15

    [ad_1]

    PARIS (AP) — French lawmakers approved a bill banning social media for children under 15, paving the way for the measure to enter into force at the start of the next school year in September, as the idea of setting a minimum age for use of the platforms gains momentum across Europe.

    The bill, which also bans the use of mobile phones in high schools, was adopted by a 130-21 vote late Monday. French President Emmanuel Macron has requested that the legislation be fast-tracked and it will now be discussed by the Senate in the coming weeks.

    “Banning social media for those under 15: this is what scientists recommend, and this is what the French people are overwhelmingly calling for,” Macron said after the vote. “Because our children’s brains are not for sale — neither to American platforms nor to Chinese networks. Because their dreams must not be dictated by algorithms.”

    The issue is one of the very few in a divided National Assembly to attract such broad support, despite critics from the hard left denouncing provisions of the bill as infringement on civil liberties. Weakened domestically since his decision to dissolve parliament plunged France into a prolonged political crisis, Macron has strongly supported the ban, which could become one of the final major measures adopted under his leadership before he leaves office next year.

    The vote in the assembly came just days after the British government said it will consider banning young teenagers from social media as it tightens laws designed to protect children from harmful content and excessive screen time.

    The French bill has been devised to be compliant with the European Union’s Digital Services Act, which imposes a set of strict requirements designed to keep internet users safe online. In November, European lawmakers called for action at EU level to protect minors online, including a bloc-wide minimum age of 16 and bans on the most harmful practices.

    According to France’s health watchdog, one in two teenagers spends between two and five hours a day on a smartphone. In a report published in December, it said that some 90% of children aged between 12 and 17 use smartphones daily to access the internet, with 58% of them using their devices for social networks.

    The report highlighted a range of harmful effects stemming from the use of social networks, including reduced self-esteem and increased exposure to content associated with risky behaviors such as self-harm, drug use and suicide. Several families in France have sued TikTok over teen suicides they say are linked to harmful content.

    The French ban won’t cover online encyclopedias, educational or scientific directories, or platforms for the development and sharing of open-source software.

    In Australia, social media companies have revoked access to about 4.7 million accounts identified as belonging to children since the country banned use of the platforms by those under 16, officials said. The law provoked fraught debates in Australia about technology use, privacy, child safety and mental health and has prompted other countries to consider similar measures.

    Copyright 2026 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.

    Photos You Should See – January 2026

    [ad_2]

    Associated Press

    Source link

  • Here’s the tech powering ICE’s deportation crackdown  | TechCrunch

    [ad_1]

    President Donald Trump said he would make countering immigration one of his flagship policies during his second term in The White House, promising an unprecedented number of deportations. 

    A year in, data shows that deportations by Immigration and Customs Enforcement (ICE) and Customs and Border Protection have surpassed at least 350,000 people

    ICE has taken center stage in Trump’s mass removal campaign, raiding homes, workplaces, and public parks in search of undocumented people, prompting widespread protests and resistance from communities across the United States. 

    ICE uses several technologies to identify and surveil individuals. Homeland Security has also used the shadow of Trump’s deportations to challenge long-standing legal norms, including forcibly entering homes to arrest people without a judicial warrant, a move that legal experts say violates the Fourth Amendment protections against unreasonable searches and seizures. 

    Here are some of the technologies that ICE is relying on.

    Cell-site simulators

    ICE has a technology known as cell-site simulators to snoop on cellphones. These surveillance devices, as the name suggests, are designed to appear as a cellphone tower, tricking nearby phones to connect to them. Once that happens, the law enforcement authorities who are using the cell-site simulators can locate and identify the phones in their vicinity, and potentially intercept calls, text messages, and internet traffic.  

    Cell-site simulators are also known as “stingrays,” based on the brand name of one of the earliest versions of the technology, which was made by U.S. defense contractor Harris (now L3Harris); or IMSI catchers, a technology that can capture a nearby cell phone’s unique identifier which law enforcement can use for identifying the phone’s owner.  

    In the last two years, ICE has signed contracts for more than $1.5 million with a company called TechOps Specialty Vehicles (TOSV), which produces customized vans for law enforcement. 

    A contract worth more than $800,000 dated May 8, 2025 said TOSV will provide “Cell Site Simulator (CSS) Vehicles to support the Homeland Security Technical Operations program.”  

    TOSV president Jon Brianas told TechCrunch that the company does not manufacture the cell-site simulators, but rather integrates them “into our overall design of the vehicle.” 

    Cell-site simulators have long been controversial for several reasons.  

    These devices are designed to trick all nearby phones to connect to them, which means that by design they gather the data of many innocent people. Also, authorities have sometimes deployed them without first obtaining a warrant.  

    Authorities have also tried to keep their use of the technology secret in court, withholding information, and even accepting plea deals and dropping cases rather than disclose information about their use of cell-site simulators. In a court case in 2019 in Baltimore, it was revealed that prosecutors were instructed to drop cases rather than violate a non-disclosure agreement with the company that makes the devices.  

    Facial recognition

    Clearview AI is perhaps the most well-known facial-recognition company today. For years, the company promised to be able to identify any face by searching through a large database of photos it had scraped from the internet. 

    On Monday, 404 Media reported that ICE has signed a contract with the company to support its law enforcement arm Homeland Security Investigations (HSI), “with capabilities of identifying victims and offenders in child sexual exploitation cases and assaults against law enforcement officers.” 

    According to a government procurement database, the contract signed last week is worth $3.75 million. 

    ICE has had other contracts with Clearview AI in the last couple of years. In September 2024, the agency purchased “forensic software” from the company, a deal worth $1.1 million. The year before, ICE paid Clearview AI nearly $800,000 for “facial recognition enterprise licenses.”

    Clearview AI did not respond to a request for comment. 

    ICE is also using a facial recognition app called Mobile Fortify, which federal agents use to identify people on the street. The app relies on scanning a person’s driver’s license photo against 200 million photos, much of the data sourced from state driver’s license databases.

    Paragon phone spyware

    Contact Us

    Do you have more information about ICE and the technology it uses? We would love to learn how this affects you. From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or email. You also can contact TechCrunch via SecureDrop.

    In September 2024, ICE signed a contract worth $2 million with Israeli spyware maker Paragon Solutions. Almost immediately, the Biden administration issued a “stop work order,” putting the contract under review to make sure it complied with an executive order on the government’s use of commercial spyware. 

    Because of that order, for nearly a year, the contract remained in limbo. Then, last week, the Trump administration lifted the stop work order, effectively reactivating the contract

    At this point, the status of Paragon’s relationship with ICE in practice is unclear.  

    The records entry from last week said that the contract with Paragon is for “a fully configured proprietary solution including license, hardware, warranty, maintenance, and training.” Practically speaking, unless the hardware installation and training were done last year, it may take some time for ICE to have Paragon’s system up and running.

    It’s also unclear if the spyware will be used by ICE or HSI, an agency whose investigations are not limited to immigration, but also cover online child sexual exploitation, human trafficking, financial fraud, and more.

    Paragon has long tried to portray itself as an “ethical” and responsible spyware maker, and now has to decide if it’s ethical to work with Trump’s ICE. A lot has happened to Paragon in the last year. In December, American private equity giant AE Industrial purchased Paragon, with a plan to merge it with cybersecurity company RedLattice, according to Israeli tech news site Calcalist.

    In a sign that the merger may have taken place, when TechCrunch reached out to Paragon for comment on the reactivation of the ICE contract last week, we were referred to RedLattice’s new vice president of marketing and communications Jennifer Iras. 

    RedLattice’s Iras did not respond to a request for comment for this article, nor for last week’s article.

    In the last few months, Paragon has been ensnared in a spyware scandal in Italy, where the government has been accused of spying on journalists and immigration activists. In response, Paragon cut ties with Italy’s intelligence agencies. 

    Phone hacking and unlocking technology

    In mid-September, ICE’s law enforcement arm Homeland Security Investigations signed a contract with Magnet Forensics for $3 million.

    This contract is specifically for software licenses so that HSI agents can “recover digital evidence, process multiple devices,” and “generate forensic reports,” according to the contract description.

    Magnet is the current maker of the phone hacking and unlocking devices known as Graykey. These devices essentially give law enforcement agents the ability to connect a locked phone to them and unlock them and access the data inside of them. 

    Magnet Forensics, which merged with Graykey makers Grayshift in 2023, did not respond to a request for comment.

    Cellphone location data 

    At the end of September, 404 Media reported that ICE bought access to “an “all-in-one” surveillance tool that allows the agency to search through databases of historical cellphone location data, as well as social media information.  

    The tool appears to be made of two products called Tangles and Webloc, which are made by a company called Penlink. One of the tools promises to leverage “a proprietary data platform to compile, process, and validate billions of daily location signals from hundreds of millions of mobile devices, providing both forensic and predictive analytics,” according to a redacted contract found by 404 Media.  

    The redacted contract does not identify which one of the tools makes that promise, but given its description, it’s likely Webloc. Forbes previously cited a case study that said Webloc can search a given location to “monitor trends of mobile devices that have given data at those locations and how often they have been there.”  

    This type of cellphone location data is harvested by companies around the world using software development kits (SDKs) embedded in regular smartphone apps, or with an online advertising process called real-time bidding (RTB) where companies bid in real-time to place an ad on the screen of a cellphone user based on their demographic or location data. The latter process has the by-product of giving ad tech companies that kind of personal data.  

    Once collected, this mass of location data is transferred to a data broker who then sells it to government agencies. Thanks to this layered process, authorities have used this type of data without getting a warrant by simply purchasing access to the data. 

    The other tool, Tangles, is an “AI-powered open-source intelligence” tool that automates “the search and analysis of data from the open, deep, and the dark web,” according to Penlink’s official site.  

    Forbes reported in September that ICE spent $5 million on Penlink’s two tools.  

    Penlink did not respond to a request for comment.  

    License plate readers

    ICE relies on automated license plate reader (ALPR) companies to follow drivers across a large swath of the U.S., such as where people go and when.

    ICE also leans on its connections with local law enforcement agencies, which have contracts with ALPR providers, like surveillance company Flock Safety, to obtain immigration data by the backdoor. Flock is one of the largest ALPR providers, with over 40,000 license plate scanners around the United States, and only getting larger with its partnerships with other companies, such as video surveillance company Ring.

    Efforts by ICE to informally request data from local law enforcement has prompted some police departments to cut off federal agencies from their access.

    Border Patrol runs its own surveillance network of ALPR cameras, the Associated Press reported.

    For years, ICE has used the legal research and public records data broker LexisNexis to support its investigations. 

    In 2022, two non-profits obtained documents via Freedom of Information Act requests, which revealed that ICE performed more than 1.2 million searches over seven months using a tool called Accurint Virtual Crime Center. ICE used the tool to check the background information of migrants.   

    A year later, The Intercept revealed that ICE was using LexisNexis to detect suspicious activity and investigate migrants before they even committed a crime, a program that a critic said enabled “mass surveillance.”

    According to public records, LexisNexis currently provides ICE “with a law enforcement investigative database subscription (LEIDS) which allows access to public records and commercial data to support criminal investigations.” 

    This year, ICE has paid $4.7 million to subscribe to the service. 

    LexisNexis spokesperson Jennifer Richman told TechCrunch that ICE has used the company’s product “data and analytics solutions for decades, across several administrations.”

    “Our commitment is to support the responsible and ethical use of data, in full compliance with laws and regulations, and for the protection of all residents of the United States,” said Richman, who added that LexisNexis “partners with more than 7,500 federal, state, local, tribal, and territorial agencies across the United States to advance public safety and security.” 

    Surveillance giant Palantir

    Data analytics and surveillance technology giant Palantir has signed several contracts with ICE in the last year. The biggest contract, worth $18.5 million from September 2024, is for a database system called “Investigative Case Management,” or ICM.

    The contract for ICM goes back to 2022, when Palantir signed a $95.9 million deal with ICE. The Peter Thiel-founded company’s relationship with ICE dates back to the early 2010s. 

    Earlier this year, 404 Media, which has reported extensively on the technology powering Trump’s deportation efforts, and particularly Palantir’s relationship with ICE, revealed details of how the ICM database works. The tech news site reported that it saw a recent version of the database, which allows ICE to filter people based on their immigration status, physical characteristics, criminal affiliation, location data, and more. 

    According to 404 Media, “a source familiar with the database” said it is made up of ‘tables upon tables’ of data and that it can build reports that show, for example, people who are on a specific type of visa who came into the country at a specific port of entry, who came from a specific country, and who have a specific hair color (or any number of hundreds of data points).” 

    The tool, and Palantir’s relationship with ICE, was controversial enough that sources within the company leaked to 404 Media an internal wiki where Palantir justifies working with Trump’s ICE. 

    Palantir is also developing a tool called “ImmigrationOS,” according to a contract worth $30 million revealed by Business Insider

    ImmigrationOS is said to be designed to streamline the “selection and apprehension operations of illegal aliens,” give “near real-time visibility” into self-deportations, and track people overstaying their visa, according to a document first reported on by Wired.

    First published on September 13, 2025 and updated on September 18, 2025 to include Magnet Forensics’ new contract, again on October 8, 2025 to include cell-site simulators and location data, and again on January 26, 2026 to include license plate readers.

    [ad_2]

    Lorenzo Franceschi-Bicchierai, Zack Whittaker

    Source link

  • Malicious Google Chrome extensions hijack accounts

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Cybersecurity researchers have uncovered a serious threat hiding inside Google Chrome. 

    Several browser extensions pretend to be helpful tools. In reality, they quietly take over user accounts. These extensions impersonate popular human resources and business platforms such as Workday, NetSuite and SAP SuccessFactors. Once installed, they can steal login data and block security controls designed to protect users.

    Many people who installed them had no warning signs that anything was wrong.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    WHY CLICKING THE WRONG COPILOT LINK COULD PUT YOUR DATA AT RISK

    Cybersecurity researchers warn that fake Google Chrome extensions are silently hijacking user accounts by stealing login data and bypassing security protections. (Bildquelle/ullstein bild via Getty Images)

    The fake Chrome extensions to watch out for

    Security researchers from Socket’s Threat Research Team identified five malicious Chrome extensions connected to this campaign. The add-ons were marketed as productivity or security tools, but were designed to hijack accounts.

    The extensions include:

    • DataByCloud Access
    • Tool Access 11
    • DataByCloud 1
    • DataByCloud 2
    • Software Access

    We reached out to Google, and a spokesperson told CyberGuy that the extensions are no longer available on the Chrome Web Store. However, some are still available on third-party software download sites, which continues to pose a risk. If you see any of these names installed in your browser, remove them immediately.

    Why malicious Chrome extensions look legitimate

    These malicious add-ons are designed to look legitimate. They use professional names, polished dashboards and business-focused descriptions. Some claim to offer faster access to workplace tools. Others say they restrict user actions to protect company accounts. Privacy policies often promise that no personal data is collected. For people juggling daily work tasks or managing business accounts, the pitch sounds helpful rather than suspicious.

    What these extensions actually do

    After installation, the extensions operate silently in the background. They steal session cookies, which are small pieces of data that tell websites you are already logged in. When attackers get these cookies, they can access accounts without a password. At the same time, some extensions block access to security pages. Users may be unable to change passwords, disable accounts or review login history. One extension even allows criminals to insert stolen login sessions into another browser. That lets them sign in instantly as the victim.

    Why malicious Chrome extensions are so dangerous

    This attack goes beyond stealing credentials. It removes the ability to respond. Security teams may detect unusual activity, but cannot fix it through normal controls. Password changes fail. Account settings disappear. Two-factor authentication tools become unreachable. As a result, attackers can maintain access for long periods without being stopped.

    How to check for these extensions on your computer

    If you use Google Chrome, review your extensions now. The process only takes a few minutes.

    • Open Google Chrome
    • Click the three-dot menu in the top right corner
    • Select Extensions, then choose Manage Extensions
    • Review every extension listed

    Look for unfamiliar names, especially those claiming to offer access to HR platforms or business tools.

    WEB SKIMMING ATTACKS TARGET MAJOR PAYMENT NETWORKS

    Woman using Google on her laptop.

    Malicious Chrome add-ons disguised as productivity tools targeted users of popular business platforms like Workday, NetSuite and SAP SuccessFactors. (Photo by S3studio/Getty Images)

    How to remove suspicious Chrome extensions

    If you find one of these extensions, remove it immediately.

    • Open Manage Extensions in Chrome
    • Find the suspicious extension
    • Click Remove
    • Confirm when prompted

    Restart your browser after removal to ensure the extension is fully disabled. If Chrome sync is enabled, repeat these steps on all synced devices before turning sync back on.

    What to do after removing the extension

    Removal is only the first step. Change passwords for any accounts accessed while the extension was installed. Use a different browser or device if possible.

    A password manager can help you create strong, unique passwords for each account and store them securely. This reduces the risk of reused passwords being exploited again.

    Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

    Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.

    Finally, review account activity for unfamiliar logins, locations or devices and be sure to follow the steps below to stay safe moving forward.

    Ways to stay safe going forward

    Simple habits can significantly reduce your risk.

    1) Limit browser extensions

    Only install extensions you truly need. The fewer extensions you use, the smaller your attack surface becomes.

    2) Be cautious with add-ons

    Avoid extensions that promise premium access or special tools for enterprise platforms. Legitimate companies rarely require browser add-ons for account access.

    3) Check permissions carefully

    Be wary of extensions that request access to cookies, browsing data or account management. These permissions can be abused to hijack sessions.

    4) Review extensions regularly

    Check your browser every few months and remove tools you no longer use or recognize.

    WHATSAPP WEB MALWARE SPREADS BANKING TROJAN AUTOMATICALLY

    Person typing on their computer.

    Several fake browser extensions were removed from the Chrome Web Store after researchers linked them to account takeover attacks. (Photo Illustration by Serene Lee/SOPA Images/LightRocket via Getty Images)

    5) Use strong antivirus software

    Strong antivirus software can help detect malicious extensions, block suspicious behavior and alert you to browser-based threats before damage occurs.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

    6) Consider a data removal service

    If your work or personal information has been exposed, a data removal service can help reduce your digital footprint by removing your details from data broker sites. This lowers the risk of follow-up scams or identity misuse.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    7) Avoid third-party download sites

    Do not reinstall extensions from third-party websites, even if they claim to offer the same features. These sites often host outdated or malicious versions.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Kurt’s key takeaways

    Browser extensions can be useful, but this research shows how easily they can also be abused. These fake Chrome add-ons did not rely on flashy tricks or obvious warnings. They blended in, looked professional and quietly did their damage in the background. The good news is that you do not need to be a tech expert to protect yourself. Taking a few minutes to review your extensions, remove anything unfamiliar and lock down your accounts can make a real difference. Small habits, repeated regularly, go a long way in reducing risk. If there is one takeaway here, it is this: convenience should never come at the cost of security. A clean browser and strong account protections give you back control.

    How many browser extensions do you have installed right now that you have never looked at twice? Let us know by writing to us at Cyberguy.com.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts  and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    Copyright 2026 CyberGuy.com. All rights reserved.

    [ad_2]

    Source link

  • Why clicking the wrong Copilot link could put your data at risk

    [ad_1]

    NEWYou can now listen to Fox News articles!

    AI assistants are supposed to make life easier. Tools like Microsoft Copilot can help you write emails, summarize documents and answer questions using information from your own account. But security researchers are now warning that a single bad link could quietly turn that convenience into a privacy risk. 

    A newly discovered attack method shows how attackers could hijack a Copilot session and siphon data without you seeing anything suspicious on screen.

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.     

    Because Copilot stays tied to your logged-in Microsoft account, attackers can quietly use your active session to access data in the background. (Photo by Donato Fasano/Getty Images)

    What researchers discovered about Copilot links

    ILLINOIS DHS DATA BREACH EXPOSES 700K RESIDENTS’ RECORDS

    Security researchers at Varonis uncovered a technique they call “Reprompt.” In simple terms, it shows how attackers could sneak instructions into a normal-looking Copilot link and make the AI do things on their behalf.

    Here’s the part that matters to you: Microsoft Copilot is connected to your Microsoft account. Depending on how you use it, Copilot can see your past conversations, things you’ve asked it and certain personal data tied to your account. Normally, Copilot has guardrails to prevent sensitive information from leaking. Reprompt showed a way around some of those protections.

    The attack starts with just one click. If you open a specially crafted Copilot link sent through email or a message, Copilot can automatically process hidden instructions embedded inside the link. You don’t need to install anything, and there are no pop-ups or warnings. After that single click, Copilot can keep responding to instructions in the background using your already logged-in session. Even closing the Copilot tab does not immediately stop the attack, because the session stays active for a while.

    How Reprompt works

    Varonis found that Copilot accepts questions through a parameter inside its web address. Attackers can hide instructions inside that address and make Copilot execute them as soon as the page loads.

    That alone would not be enough, because Copilot tries to block data leaks. The researchers combined several tricks to get around this. First, they injected instructions directly into Copilot through the link itself. This allowed Copilot to read information it normally shouldn’t share.

    Second, they used a “try twice” trick. Copilot applies stricter checks the first time it answers a request. By telling Copilot to repeat the action and double-check itself, the researchers found that those protections could fail on the second attempt.

    Third, they showed that Copilot could keep receiving follow-up instructions from a remote server controlled by the attacker. Each response from Copilot helped generate the next request, allowing data to be quietly sent out piece by piece. The result is an invisible back-and-forth where Copilot keeps working for the attacker using your session. From your perspective, nothing looks wrong.

    MICROSOFT SOUNDS ALARM AS HACKERS TURN TEAMS PLATFORM INTO ‘REAL-WORLD DANGERS’ FOR USERS

    Varonis responsibly reported the issue to Microsoft, and the company fixed it in the January 2026 Patch Tuesday updates. There is no evidence that Reprompt was used in real-world attacks before the fix. Still, this research is important because it shows a bigger problem. AI assistants have access, memory and the ability to act on your behalf. That combination makes them powerful, but also risky if protections fail. As researchers put it, the danger increases when autonomy and access come together.

    It’s also worth noting that this issue only affected Copilot Personal. Microsoft 365 Copilot, which businesses use, has extra security layers like auditing, data loss prevention and admin controls.

    “We appreciate Varonis Threat Labs for responsibly reporting this issue,” a Microsoft spokesperson told CyberGuy. “We have rolled out protections that address the scenario described and are implementing additional measures to strengthen safeguards against similar techniques as part of our defense-in-depth approach.”

    8 steps you can take to stay safe from AI attacks

    Even with the fix in place, these habits will help protect your data as AI tools become more common.

    1) Install Windows and browser updates immediately

    Security fixes only protect you if they’re installed. Attacks like Reprompt rely on flaws that already have patches available. Turn on automatic updates for Windows, Edge and other browsers so you don’t delay critical fixes. Waiting weeks or months leaves a window where attackers can still exploit known weaknesses.

    2) Treat Copilot and AI links like login links

    If you wouldn’t click a random password reset link, don’t click unexpected Copilot links either. Even links that look official can be weaponized. If someone sends you a Copilot link, pause and ask yourself whether you were expecting it. When in doubt, open Copilot manually instead.

    Corporate signage of Microsoft Corp at Microsoft India Development Center

    Even after Microsoft fixed the flaw, the research highlights why limiting data exposure and monitoring account activity still matters as AI tools evolve. (Photographer: Prakash Singh/Bloomberg via Getty Images)

    3) Use a password manager to protect your accounts

    A password manager creates and stores strong, unique passwords for every service you use. If attackers manage to access session data or steal credentials indirectly, unique passwords prevent one breach from unlocking your entire digital life. Many password managers also warn you if a site looks suspicious or fake.

    Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords, and secure those accounts with new, unique credentials.

    Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.

    4) Enable two-factor authentication on your Microsoft account

    Two-factor authentication (2FA) adds a second layer of protection, even if attackers gain partial access to your session. It forces an extra verification step, usually through an app or device, making it much harder for someone else to act as you inside Copilot or other Microsoft services.

    5) Reduce how much personal data exists online

    Data broker sites collect and resell personal details like your email address, phone number, home address and even work history. If an AI tool or account session is abused, that publicly available data can make the damage worse. Using a data-removal service helps delete this information from broker databases, shrinking your digital footprint and limiting what attackers can piece together.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    6) Run strong antivirus software on your device

    Modern antivirus tools do more than scan files. They help detect phishing links, malicious scripts and suspicious behavior tied to browser activity. Since Reprompt-style attacks start with a single click, having real-time protection can stop you before damage happens, especially when attacks look legitimate.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

    7) Regularly review your account activity and settings

    Check your Microsoft account activity for unfamiliar logins, locations, or actions. Review what services Copilot can access, and revoke anything you no longer need. These checks don’t take long, but they can reveal issues early, before attackers have time to do serious damage. Here’s how:

    Go to account.microsoft.com, and sign in to your Microsoft account.

    Select Security, then choose View my sign-in activity and verify your identity if prompted.

    Review each login for unfamiliar locations, devices or failed sign-in attempts.

    If you see anything suspicious, select This wasn’t me or Secure your account, then change your password immediately and enable two-step verification.

    Visit account.microsoft.com/devices, and remove any devices you no longer recognize or use.

    In Microsoft Edge, open Settings > Appearance > Copilot and Sidebar > Copilot, and turn off Allow Microsoft to access page content if you want to limit Copilot’s access.

    Review apps connected to your Microsoft account and revoke permissions you no longer need.

    close up of hands of business person working on computer, man using internet and social media

    A single Copilot link can carry hidden instructions that run the moment you click, without any warning or pop-ups.  (iStock)

    8) Be specific about what you ask AI tools to do

    Avoid giving AI assistants broad authority like “handle whatever is needed.” Wide permissions make it easier for hidden instructions to influence outcomes. Keep requests narrow and task-focused. The less freedom an AI has, the harder it is for malicious prompts to steer it silently.

    Kurt’s key takeaway

    Reprompt doesn’t mean Copilot is unsafe to use, but it does show how much trust these tools require. When an AI assistant can think, remember and act for you, even a single bad click can matter. Keeping your system updated and being selective about what you click remain just as important in the age of AI as it was before.

    Do you feel comfortable letting AI assistants access your personal data, or does this make you more cautious? Let us know by writing to us at Cyberguy.com.

    CLICK HERE TO DOWNLOAD THE FOX NEWS APP

    Sign up for my FREE CyberGuy Report 
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter. 

    Copyright 2026 CyberGuy.com. All rights reserved. 

    [ad_2]

    Source link