https://trustcenter.ca/brief A free weekly email on the breaches, settlements and vendor failures that change what buyers ask in a security review, and what to have ready. en-CA https://trustcenter.ca/brief/8-patch-netscaler-then-read-the-labcorp-terms https://trustcenter.ca/brief/8-patch-netscaler-then-read-the-labcorp-terms Tue, 29 Sep 2026 13:00:00 +0000 Ottawa is looking at how a breach was disclosed, not only how it happened. Canada's federal privacy regulator opened an investigation into IDScan following a data breach. Your AI agents are logging in as humans and SOC 2 cannot tell. A vendor-authored piece argues that AI agents often operate through human credentials, so actions taken by an agent look identical to actions taken by the person whose credentials it borrowed. https://trustcenter.ca/brief/7-fake-government-requests-real-ai-attacks https://trustcenter.ca/brief/7-fake-government-requests-real-ai-attacks Tue, 22 Sep 2026 13:00:00 +0000 Revolut handed over customer data to someone pretending to be a government. Revolut confirmed that an unauthorized party obtained customer information by submitting a fraudulent data request from a legitimate government email domain. https://trustcenter.ca/brief/6-revolut-handed-data-to-a-fake-government-request https://trustcenter.ca/brief/6-revolut-handed-data-to-a-fake-government-request Tue, 15 Sep 2026 13:00:00 +0000 Trezor's supplier breach keeps growing, and it was never Trezor's system. Trezor says a breach at its supplier ShipMonk is considerably worse than first reported, now affecting around 81,000 customers. Revolut gave customer data to someone posing as a government agency. Revolut disclosed a breach after sharing customer data with a threat actor impersonating a government agency. Delaware amends its privacy and breach notification laws. On September 2, 2026, Delaware's governor signed HB 380 and HB 381. https://trustcenter.ca/brief/5-court-records-drivers-licences-and-an-ftc-bill https://trustcenter.ca/brief/5-court-records-drivers-licences-and-an-ftc-bill Tue, 08 Sep 2026 13:00:00 +0000 Thomson Reuters court software breached in March, disclosed in September. Thomson Reuters disclosed that an unauthorized party obtained files from C-Track, the court case management platform sold by its West Publishing unit, in March 2026. McKesson tells the SEC it was hit through third-party applications. McKesson disclosed a cybersecurity incident in which attackers got into third-party applications and stole data, with the intrusion detected on August 25, 2026. An ID verification vendor appears to be the source of 153 million licence scans. A new dark web identity theft service is selling digital scans of more than 153 million driver's licences belonging to people in the United States and Canada. https://trustcenter.ca/brief/4-what-cisas-two-red-teams-say-about-your-soc-2 https://trustcenter.ca/brief/4-what-cisas-two-red-teams-say-about-your-soc-2 Tue, 01 Sep 2026 13:00:00 +0000 McKesson breach came through third-party applications. McKesson disclosed a cybersecurity incident involving unauthorized access to third-party applications and data theft. Two arrests in the TeamPCP open-source supply chain spree. The Australian Federal Police arrested two men in Western Australia, aged 21 and 23, over alleged membership in TeamPCP. https://trustcenter.ca/brief/3-a-cvss-10-in-entra-id-and-a-breach-that-grew-tenfold https://trustcenter.ca/brief/3-a-cvss-10-in-entra-id-and-a-breach-that-grew-tenfold Tue, 25 Aug 2026 13:00:00 +0000 SickKids gets hit through somebody else's software. Toronto's Hospital for Sick Children disclosed a security incident that exposed personal information belonging to some current and former employees and job applicants. Defence contractors do not believe their own CMMC scores. US defence contractors are reporting doubts about the accuracy of their own self-assessment scores under CMMC Phase I. https://trustcenter.ca/brief/1-a-250-000-penalty-and-a-vendor-that-went-dark https://trustcenter.ca/brief/1-a-250-000-penalty-and-a-vendor-that-went-dark Tue, 11 Aug 2026 13:00:00 +0000 LexisNexis pulled products offline over a third-party vendor incident. LexisNexis took several services offline, including Diligence and the Metabase API, in response to unusual activity on servers hosted and managed by a third-party vendor it has not named. New York fined a money transmitter for a weak program, not a breach. The New York Department of Financial Services announced that Order Express, a licensed money transmitter, will pay a $250,000 penalty for violations of the DFS cybersecurity regulation, 23 NYCRR Part 500.