Meta CTO says employee-tracking data landed ‘where it wasn’t supposed to go’

Offen Fair Web Analytics

Offen là công cụ phân tích web mã nguồn mở, miễn phí, tự lưu trữ, bảo vệ quyền riêng tư dữ liệu theo GDPR, cho phép người dùng toàn quyền kiểm soát dữ liệu và lựa chọn thu thập dữ liệu.

Là người phát triển muốn bảo vệ quyền riêng tư của người dùng và tuân thủ quy định GDPR, Offen Fair Web Analytics là giải pháp tự chủ, mở nguồn giúp bạn xây dựng giải pháp phân tích web minh bạch và an toàn.

Weekly Update 511: Live from my Riad in Marrakech

Troy Hunt discusses the futility of data removal services that claim to scrub personal information from data brokers after a breach. He argues that once data is leaked, it cannot truly be removed, and criticizes marketing efforts by data removal companies that seek product placement on breach-related content without understanding this reality.

HubSpot backs down over using customer data for AI

HubSpot reversed a controversial policy change just four days after announcing it. The CRM company had quietly updated its terms on July 1 to opt all customers into a data-pooling feature for an AI-powered sales lead tool, using contact and employer data stored in their accounts. The backlash was immediate, driven by sales leaders and RevOps teams on LinkedIn who argued the data belonged to customers, not HubSpot. Chief product and technology officer Duncan Lennox apologized, called it 'a mistake,' and committed to making any future customer data use opt-in only. The episode mirrors similar controversies at Slack (2024) and Zoom (2023), and highlights a broader tension: SaaS vendors racing to fuel AI features with customer data are finding that default opt-out is increasingly a trust-breaking move, especially when the data in question is a company's competitive asset.

Why hackers are targeting your digital supply chain, not just your systems

Các hacker ngày càng nhắm vào chuỗi cung ứng kỹ thuật số bằng cách tấn công các nhà cung cấp bên thứ ba đáng tin cậy, thay vì trực tiếp vào hệ thống mục tiêu. Những vụ việc như backdoor XZ Utils hay vụ vi phạm MoveIt của Marks & Spencer cho thấy hậu quả tài chính, vận hành và danh tiếng nghiêm trọng. Các biện pháp phòng ngừa bao gồm thẩm định nhà cung cấp, đánh giá rủi ro thường xuyên, hợp đồng rõ ràng về nghĩa vụ bảo mật, kế hoạch ứng phó sự cố và bảo hiểm mạng.

Lập trình viên nên đọc bài này để hiểu cách hackers lợi dụng các thư viện mã nguồn mở và nhà cung cấp hợp tác để xâm nhập hệ thống mà không cần vượt qua các biện pháp bảo mật nội bộ, từ đó tìm hiểu cách bảo vệ dự án của mình khỏi các rủi ro từ chuỗi cung ứng kỹ thuật số.

Swimming Pools, Pee, and Trying to Delete Your Data From the Internet

Troy Hunt argues that data removal services are fundamentally limited in their effectiveness. While they can successfully request removal from legally operating data brokers, they are completely powerless against malicious actors, dark web leak sites, and the viral replication of breached data across Telegram channels and hacking forums. Using the analogy of trying to remove pee from a swimming pool, he explains why once data from a breach like ShinyHunters spreads, it can never truly be erased. This is why he declines partnership requests from data removal companies on Have I Been Pwned — they simply cannot address the worst-case scenarios that HIBP users actually face.

Amazon Basics, but for intellectual property.

AI providers may be using enterprise customer data to identify successful products and build competing tools — just as Amazon used merchant data to launch Amazon Basics. The Anthropic/Figma situation is cited as a concrete example: Anthropic's chief product officer sat on Figma's board while Figma's AI features were built on Claude, then resigned days before Anthropic launched Claude Design, a direct Figma competitor. The broader argument is that when companies integrate AI into their workflows, they expose proprietary processes and product data to a third party that could become a competitor, regardless of contractual assurances about training data.

Mount Royal University confirms breach as hackers claim attack

Mount Royal University (MRU) in Calgary confirmed a cyberattack on June 17 in which hackers stole data from the university's H drive — containing information on current and former students and employees — and then deleted the original files to hinder recovery. A separate J drive storing departmental data was also wiped, with no confirmed evidence of prior exfiltration. The threat group CMD Organization has claimed responsibility, demanding a 30 BTC (~$1.9M) ransom and threatening to leak or auction the stolen data. MRU has notified the Alberta Information and Privacy Commissioner and law enforcement, and is offering two years of credit monitoring to affected employees. Full system recovery could take weeks to months.