Linn Foster Freedman

AI notetakers are widely used by businesses in all industries. Although efficient, they pose privacy and cybersecurity risks , including lax compliance with established privacy and security frameworks such as GDPR or SOC 2, weak encryption, and recording conversations without consent, which may be in violation of one-party recording laws. For lawyers, it could mean an unauthorized waiver of privilege.

Security Company Arctic Wolf has reported that it has documented more than 400 incidents where threat actors flooded employees' inboxes with spam, to the point of extreme frustration, then used Teams to contact the frustrated employee posting as IT support to assist in fixing the problem. The Teams contact comes within minutes of the flooding of the inbox. Because the Teams contact is from a legitimate platform and is not a vulnerability with Teams, the victim believes it is legitimate and accepts the help. This is another example of how threat actors use legitimate tools in a malicious way.

Last week was Digital Parenting Week. I must admit that I was not aware it existed, but certainly believe it's a good idea. Parents must talk to their kids about the risks of the digital world and how to protect themselves. I previously commented on tips to strengthen children's privacy in a digital world in a previous Privacy Tip The post still resonates and is applicable today.

On October 29, 2026, General Motors (GM) agreed to pay $220 million to 35 state Attorneys General over allegations that its Smart Driver program associated with its OnStar service violated the privacy of users. The AGs alleged that GM illegally sold drivers' private location and driving behavior data to brokers without users' consent, who then sold it to insurers that allegedly used it to set and increase auto insurance rates.

My buddies at CrowdStrike have uncovered a campaign launched by threat actor VAPOR PANDA starting on October 17, 2026, where ARTEX (an AI-powered penetration testing tool developed in China) is used with the Chinese-developed DeepSeek LLM to attack “more than 200 distinct organizations worldwide, including foreign ministries in Latin America, Europe, Asia, and the Middle East; semiconductor, defense, and think tank organizations in the U.S.; and telecommunications providers in multiple regions.”

My buddies at CrowdStrike have uncovered a campaign launched by threat actor VAPOR PANDA starting on October 17, 2026, where ARTEX (an AI-powered penetration testing tool developed in China) is used with the Chinese-developed DeepSeek LLM to attack “more than 200 distinct organizations worldwide, including foreign ministries in Latin America, Europe, Asia, and the Middle East; semiconductor, defense, and think tank organizations in the U.S.; and telecommunications providers in multiple regi

On October 29, 2026, General Motors (GM) agreed to pay $220 million to 35 state Attorneys General over allegations that its Smart Driver program associated with its OnStar service violated the privacy of users. The AGs alleged that GM illegally sold drivers’ private location and driving behavior data to brokers without users’ consent, who then sold it to insurers that allegedly used it to set and increase auto insurance rates.

Last week was Digital Parenting Week. I must admit that I was not aware it existed, but certainly believe it’s a good idea. Parents must talk to their kids about the risks of the digital world and how to protect themselves. I previously commented on tips to strengthen children’s privacy in a digital world in a previous Privacy Tip The post still resonates and is applicable today.

Consumer Reports (CR), Aspen Digital, and the Global Cyber Alliance recently released the fifth annual for Cybersecurity Awareness Month. The report explores how American consumers perceive and manage digital security and offers new insights into the rise of digital scams and fraud.

In the wake of targeted cybersecurity attacks against European industrial refrigeration manufacturers, the Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Health and Human Services (HHS), U.S. Department of Agriculture (USDA), and the Department of Transportation (DoT) warned industrial refrigeration and cold chain monitoring systems of malicious cyber activity targeting their industry and provided recommendations for preparation and defense.