White House scraps plan to block data brokers from selling Americans’ sensitive data

A senior Trump administration official has scrapped a plan that would have blocked data brokers from selling Americans’ personal and financial information, including Social Security numbers. 

The Consumer Financial Protection Bureau (CFPB) said in December 2024 it planned to close a loophole under the Fair Credit Reporting Act, the federal law that protects Americans’ personal data collected by consumer reporting agencies, such as credit bureaus and renter-screening companies. The rule would have treated data brokers no differently than any other company covered under the federal law and would have required them to comply with the law’s privacy rules.

The rule was withdrawn early Tuesday, according to its listing in the Federal Register. The CFPB’s acting director, Russell Vought, who also serves as the director of the White House’s Office of Management and Budget, wrote that the rule is “not aligned with the Bureau’s current interpretation” of the Fair Credit Reporting Act. 

Wired first reported the rule change on Wednesday. 

Data brokers are part of a multibillion-dollar industry of companies that profit from collecting and selling access to vast amounts of Americans’ personal and financial information. This personal data is then sold to other companies, as well as law enforcement and intelligence agencies, often without the explicit permission of the individuals. 

Collecting huge banks of data also comes with inherent risks. Over the past year, at least two data brokers were hacked, spilling millions of Social Security numbers online and exfiltrating a huge trove of user location data that tracked millions of people’s whereabouts. 

In 2024 alone, the Federal Trade Commission banned several data brokers from collecting and sharing data on individuals without their permission, following allegations of unlawfully tracking people. 

Privacy advocates have long called for the government to use the Fair Credit Reporting Act to rein in data brokers.

The decision by CFPB to cancel the rule comes days after the Financial Technology Association, an industry lobby group representing non-bank fintech companies, wrote to Vought in his capacity as the White House’s budget director. The lobby group asked the administration to withdraw the CFPB’s rule, claiming it would be “harmful to financial institutions’ efforts to detect and prevent fraud.”

CFPB did not return a request for comment.

Corrected the description of the FTA.

Read More

Scaling innovative companies at the intersection of cybersecurity, AI, and resilience

[embedded content]

Paladin Capital Group’s Nazo Moosa sat down with Mike Butcher at StrictlyVC London to discuss scaling innovative companies at the intersection of cybersecurity, AI, and resilience. She discussed how she’s driving purposeful investments that shape a secure and sustainable digital future.

Read More

Ivanti patches two zero-days that could lead to RCE in Endpoint Manager Mobile

Ivanti patched two flaws being chained to mount RCE attacksA “limited number” of companies were allegedly compromisedOnly on-prem products are affectedIvanti has released a patch for two vulnerabilities in its Endpoint Manager Mobile (EPMM) software, that’s allegedly being chained in remote code execution (RCE) attacks in the wild.The vulnerabilities are tracked as CVE-2025-4427, and CVE-2025-4428. The former is an authentication bypass in EPMM’s API, allowing threat actors to access protected resources. It was assigned a medium-severity score of 5.3.The latter is an RCE vulnerability exploited through maliciously crafted API requests. This one was given a high severity score (7.2/10).

You may like

Ivanti says it’s seen it abused in attacks: “When chained together, successful exploitation could lead to unauthenticated remote code execution,” the company said in a security advisory. “We are aware of a very limited number of customers whose solution has been exploited at the time of disclosure.”To address the issue, users should install Ivanti Endpoint Manager Mobile 11.12.0.5, 12.3.0.2, 12.4.0.2, or 12.5.0.1.”The issue only affects the on-prem EPMM product. It is not present in Ivanti Neurons for MDM, Ivanti’s cloud-based unified endpoint management solution, Ivanti Sentry, or any other Ivanti products,” the company further explained. “We urge all customers using the on-prem EPMM product to promptly install the patch.”Ivanti’s EPMM software is a popular solution across different industries, including healthcare, education, logistics, manufacturing, and government. According to The Shadowserver, there are hundreds of exposed instances at the moment, mostly in Germany (992), but with a significant number in the United States (418), as well.Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!Those that cannot apply the patch at this time can implement different workarounds. Ivanti said these users should follow best practice guidance or filtering access to the API using either the built-in Portal ACL’s functionality, or an external WAF. More details on using the portal’s ACL functionality can be found here.Via BleepingComputerYou might also like

Read More

SAP patches recently exploited zero-day in wake of NetWeaver server attacks

SAP fixed CVE-2025-42999, a 9.1/10 vulnerability in NetWeaverThis one was chained with CVE-2025-31324, which was fixed in AprilFortune 500 companies are apparently at riskSAP has patched a critical-severity zero-day vulnerability in NetWeaver server that was being chained in attacks targeting some of the world’s biggest enterprises.The vulnerability is tracked as CVE-2025-42999, and carries a severity score of 9.1/10 (critical). On NVD, it was said that SAP NetWeaver Visual Composer Metadata Uploader is “vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.”In a statement given to BleepingComputer, SAP said it discovered this flaw when it was investigating a different one, also a zero-day. This one was reported earlier in April this year, and is now tracked as CVE-2025-31324 (10/10 – critical). The two flaws were allegedly being abused in attacks since January 2025.

You may like

SAP issues patchWhen security researchers first discovered CVE-2025-31324 being abused, it was said that more than 1,200 SAP instances were at risk of being hijacked. Some researchers claimed the number of vulnerable endpoints was somewhat smaller – around 500 instances.Visual Composer is a development tool that allows users to build web-based business applications without writing code. It’s mostly used to create dashboards, forms, and interactive reports. The Metadata Uploader, on the other hand, is a tool for importing external data models (metadata) into the Visual Composer design environment. This allows developers to connect to remote data sources (web services, databases, or SAP systems).ReliaQuest, watchTowr, and Onapsis, are just some of the firms that observed the bug being exploited in attacks in which threat actors were dropping web shells on vulnerable servers. SAP, however, told the media that it was not aware of any attacks that impacted customer data or systems.”Something like 20 Fortune 500/Global 500 companies are vulnerable, and many of them are compromised,” Onyphe CTO Patrice Auffret told BleepingComputer.Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!Via BleepingComputerYou might also like

Read More

Extensive investment scam that stole €3 million tackled by Europol

Europol have dismantled an organised crime groupThe group was carrying out investment scamsOver 100 victims lost a combined €3 millionA globally operating organised crime group has been dismantled by Eurojust and Europol in a joint operation with German, British, Cypriot, Albanian, and Israeli investigators – leading to the arrest of a suspect. Eurojust confirms the group defrauded over a hundred victims, taking over €3 million through a fake online investment platform.The group used cyber trading and was able to make “considerable profits” and to defraud the victims. The group, as criminals often do, promised substantial profits in a short period of time. Once victims transferred money to the platform, they were then shown false charts indicating they could earn much more if more is transferred to the platform.The online networks used criminals posing as brokers, using ‘psychological tactics’ to convince the victims to transfer even more finds, which of course, were never actually invested into anything, but rather were directly stolen by the group.

You may like

Disrupted operationsThe scam was uncovered after a married couple reported the fraud to German authorities – and an inquiry uncovered an extensive network of criminals. Law enforcement seized evidence connected to the investigation like documents, electronic devices, and cash.Digital scams, particularly investment fraud, is a serious danger, and is costing internet users millions every year. New tools for cybercriminals, especially AI tools, are helping fraudsters pump out scamming campaigns in minutes, allowing criminals to access cybercrime with far fewer skills than used to be necessary.This goes beyond extensive phishing campaigns, with deepfake celebrity endorsements, deepfake calls or videos, and even AI-generated fake websites mimicking legitimate businesses“The good news is there are ways to avoid falling victim to such attacks,” said Aaron Walton, Threat Intel Analyst at Expel.Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!“Many organisations build in technological solutions to help prevent malicious emails from landing in user’s inboxes by automatically detecting suspicious indicators. Users can also protect themselves and their organisations by flagging any emails that appear suspicious to their security teams.”You might also like

Read More

Google is adding new device-level features for its Advanced Protection program

At the Android Show, taking place ahead of Google I/O 2025, Google announced that it is adding new device-specific features to its Advanced Protection program, which is designed to protect public figures such as politicians and journalists from different digital threats, with the Android 16 release. The new features include a new way of storing device logs that are accessible only by the user, protection from spam calls, and an auto-restart feature for when the device is locked for a certain amount of time. These features are aimed at adding an extra layer of security for public figures and preventing their devices from being compromised.

With the Android 16 release, the company is adding an intrusion logging feature for threat analysis. This feature stores your device logs with end-to-end encryption in the cloud. If there is suspicion around the device being compromised, these logs can be used to perform analysis.

The company is also adding USB protection to allow only charging from a new USB connection while the device is locked.

Google said devices under the Advanced Protection program will also automatically restart if the device is locked for 72 consecutive hours. TechCrunch reported last month that the feature was mentioned in the Google Play services update.

What’s more, if you have Advanced Protection enabled, with Android 16, the system will prevent you from automatically reconnecting to Wi-Fi networks that are not secure.

The program is also gaining a feature to privately process conversations on the device to try and detect a potential scam for an ongoing phone call. The company launched this feature for Pixel phones earlier this year.

Check out how to watch the livestream and more from Google I/O.

Read More

Google announces new security features for Android for protection against scam and theft

At the Android Show on Tuesday, ahead of Google I/O, Google announced new security and privacy features for Android. These new features include new protections for calls, screen sharing, messages, device access, and system-level permissions. With these features, Google aims to protect users from falling for a scam, keep their details secure in case a device is stolen or taken over by an attacker, and enhance device-level security for various attacks.

Phone scammers often ask users to take actions like tapping on unsafe links or downloading unknown apps. In order to protect users, Google is blocking some actions and warning users of a potential scam while they are on a call with someone not in their contact list.

Image Credits:Google

For Android 16, these actions include side-loading an app for the first time from a web browser, messaging app, or other sources that have not been verified by Google, and granting accessibility permission to an app so that a scammer can take control of the device. The company is also preventing users running Android 6 or later from disabling Google Play Protect, which scans the device for harmful apps while they are on a call.

Google is adding screen-sharing protection as well by reminding users to stop sharing the screen after a call ends.

The company is also testing a new warning screen with select banks in the U.K. to prevent fraud through screen-sharing. When users on devices running Android 11 or later open a partner bank’s app while sharing a screen with an unknown number, the device will show a warning screen with a button to quickly end the screen-sharing.

Image Credits:Google

Messages protection

Google is enhancing protection against scams in Google Messages after launching the feature in March. The feature uses on-device AI to alert users of a potential scam based on the conversation. The company is now bolstering user security by having the tool to detect more types of fraud, including crypto, gift card, toll road, and other billing fees, financial impersonation, and technical support.

Image Credits:Google

What’s more, the company is adding verification keys to the Google Contacts app, which will help users authenticate that the person on the other end is the intended receiver. Users can verify their contacts by having them scan a QR code or match numbers displayed on the screen.

Verified keys mean that your conversation with your contact on Google Messages is end-to-end encrypted and secured. Google said that if an attacker starts controlling a phone number through a SIM swap attack and messages you through a new device, the Google Contacts app will show the verification status as unverified. This feature will be available for Google Messages later this summer for users running Android 10 or later versions.

Image Credits:Google

Theft-protection measures

Earlier this year, Google rolled out Identity Check protection to Pixel and Samsung devices with OneUI 7. The feature requires users to use biometric authentication to change critical settings like changing your device PIN or biometrics, disabling theft protection, or accessing Passkeys when the user is not at one of the trusted locations they have added. The company is now making this feature available to other device makers with Android 16.

Later this year, Google will add better protection for Factory Reset, restricting all kinds of functions on the device that are reset without authorization of the previous lock pattern/PIN or Google account credentials. This essentially makes a stolen device hard to use.

Image Credits:Google

To prevent someone from locking your device remotely, the company is adding a security challenge question to prevent unauthorized access. With Android 16, the company will also hide one-time passwords if the device is not connected to Wi-Fi and hasn’t been unlocked recently.

Image Credits:Google

Additional protections

The company is adding new features to its Google Play Protect live detection program as well, which detect unsafe apps that have hidden or changed icons. This feature will be available in the coming months for users running Google Pixel 6+. The company said it is now applying a new set of on-device rules to catch more categories of malicious apps.

Google is adding new measures to bolster its Advanced Protection Mode to protect public figures with new on-device features. The company is also debuting a new Find My Hub to keep track of items, friends, and family.

Check out how to watch the livestream and more from Google I/O.

Read More

Microsoft Build 2025: What to expect, from Azure to Copilot upgrades

Microsoft is hosting its annual Build developer conference next week from May 19 to 22. The event is guaranteed to include announcements regarding new AI integrations, services, and apps, including for Windows.

At last year’s Build, Microsoft announced an integration of Copilot into Microsoft Teams, Copilot+ AI-powered PCs, Windows Volumetric Apps for Meta Quest headsets, and more.

The keynotes will be streamed online for free. As for what to expect, there is good reason to believe Microsoft will announce deeper integrations for its Copilot generative AI with many of its software offerings, both on the consumer and enterprise sides.

The company last November raised prices for many of its software products, including Windows 365, Office 365, and Microsoft 365, among many others, by 5%. To justify these increases, the company could introduce new AI-powered features and capabilities.

Copilot is likely to be a headliner at Build, and big changes to it could be on the way. Microsoft is reportedly testing alternative AI models from xAI, Meta, Anthropic, and DeepSeek as possible replacements for OpenAI technology in Copilot as the relationship between Microsoft and OpenAI becomes strained.

On Windows, Copilot could gain “agentic” functionality that allows the tech to perform basic PC tasks autonomously. Well-known leaker TestingCatalog found references to an Action button in the Copilot client for Windows that, when selected, can kick off certain “everyday tasks.”

Microsoft is also said to have developed a family of models called MAI that are competitive with OpenAI’s own, which the tech giant is considering offering through an API. Build may well end up being the venue where Microsoft decides to unveil these.

Techcrunch event

Berkeley, CA
|
June 5

BOOK NOW

The company could also announce a follow-up to its Azure Maia 100 AI Accelerator, a custom AI chip for Microsoft’s Azure cloud service. Rumors of a “Maia 2” bubbled up on social media last week; chipmaker Marvell is contracted to manufacture it, according to semiconductor analyst Ray Wang.

Read More

Apple brings emergency satellite features to iPhone 13 with iOS 18.5

Apple on Monday released iOS 18.5, which expands emergency satellite capabilities to iPhone 13 owners for the first time. Previously, the satellite features were available to those running an iPhone 14 or later.

The emergency satellite system for iPhone is designed to be used at critical times when a cellular signal or Wi-Fi is not available, as it lets people contact emergency services, send a text by satellite, share information with their emergency contacts, or call for roadside assistance.

The iOS 18.5 update is focused on providing access to carriers’ satellite services, like those from T-Mobile (with Starlink). You can check to see if you have access to this feature from the Cellular menu under the iPhone’s Settings.

To date, the feature has been credited with saving lives, rescuers say, including helping lost and injured hikers, saving people from wildfires, and more.

While the expansion of satellite emergency services to iPhone 13 owners is the most notable addition with iOS 18.5, iPhone users are also receiving a good handful of smaller updates.

This includes the addition of a new feature for Screen Time, Apple’s parental control software, which alerts parents if their child correctly enters the parent’s passcode to access Screen Time permissions.

Among the other improvements is an updated Mail app, which makes it easier to access the “All Mail” category as its own tab; a new Pride wallpaper; and an easier way to subscribe to content from the Apple TV app on a smart TV or connected device. Plus, Apple has fixed a bug where the Apple Vision Pro app would launch with a black screen if downloaded from the App Store, as well as other bugs with Siri, enterprise apps not launching, and more.

Techcrunch event

Berkeley, CA
|
June 5

BOOK NOW

iOS 18.5 was released alongside iPadOS 18.5, which largely addresses bug fixes; visionOS 2.5; watchOS 11.5; and security-focused updates for macOS Ventura 13.7.6 (22H625) and macOS Sonoma 14.7.6.

Read More

This American VC is betting on European defense tech; that’s still very unusual

VCs are known to move in herds, which is why Eric Slesinger stands out a bit. While most American investors chase AI startups or U.S.-based defense tech startups, the former CIA officer is hunting for defense tech deals in Europe. In fact, Slesinger, founder of 201 Ventures, recently closed a $22 million fund focused on seed-stage European defense tech startups. His path from developing gadgets and software for CIA agents to becoming perhaps the only American VC exclusively investing in European defense tech also appears to be a prescient one.

What would compel someone to leave “the best first job ever” at the CIA to pursue this specific ambition? As Slesinger told TechCrunch in a recent StrictlyVC Download podcast interview, the answer came from identifying a critical shift that many missed. “I left because I noticed that the private sector was increasingly playing a role in this competition that I previously had understood really to just be a government to government competition,” Slesinger explained. “What became obvious more so every day was that the private sector was playing such a big role here.”

With degrees from Stanford in mechanical engineering and Harvard Business School, Slesinger’s background helped prepare him to bridge the gap between defense technology and commercial ventures. But it was his willingness to go against conventional wisdom that has made him interesting to investors, founders, and tech reporters alike.

“I have always enjoyed going where other people tend to not want to go,” said Slesinger. “That was why I enjoyed the work at the CIA so much. A couple of things that people there used to say was, ‘go where others don’t go and do what they can’t do.’”

As for what U.S. VCs were missing, from Slesinger’s point of view there were three things. First, “Europe has individual entrepreneurs that are just as hungry, just as high conviction, and just as smart as anywhere else in the world.” Second, “European governments waited way too long to rethink what the arrangement on their own security meant, and therefore hadn’t actually taken a critical eye towards it.” And third, “Europe was quickly being seen and will, in my opinion, continue to be the site of serious gray zone competition,” meaning activities by state or non-state actors that fall between traditional peace and outright war.

Perhaps the most surprising aspect of Slesinger’s European venture has been the cultural resistance he says he encountered regarding defense investments. In 2022, after moving from the U.S. to Madrid, he started the European Defense Investor Network, which now includes entrepreneurs, investors, and policymakers. In a 2023 Medium post, Slesinger wrote about how his European VC colleagues were afraid to talk about their defense-related investments. Unlike in America, he told TechCrunch, defense tech investing in Europe “was seen as uncouth, something that should be done but not spoken about, and certainly not spoken about in polite company at the dinner table.” (Slesinger quickly added, “I’m exaggerating a little bit, but there’s a kernel of truth there.”)

He says that cultural hesitance resulted in “many founders thinking about it, deciding not to build a company in the [defense] space.” Now that’s changing. The NATO Innovation Fund — the world’s first multi-sovereign venture capital fund, backed by 24 NATO allies and launched in the summer of 2022 after the Russia-Ukraine war broke out — has helped. Indeed, it’s a significant backer of 201 Ventures.

Techcrunch event

Berkeley, CA
|
June 5

BOOK NOW

So has the attention garnered by up-and-coming defense tech startups on the continent, including Munich-based Helsing, which is developing AI for use on battlefields and is currently valued at more than $5 billion by its investors. Another up-and-comer in Slesinger’s portfolio is Delian Alliance Industries, an Athens-based outfit developing surveillance towers to detect autonomous threats. Delian has so far raised seed funding but is a hot ticket that’s surely being actively courted by VCs.

With eight investments to date, 201 Ventures focuses on technologies that address that gray zone competition because, in Slesinger’s words, it’s “happening at scale in Europe, and it will for the next couple of decades.” These market dislocations, he said, “whether they’re price inefficiencies or a government playing a larger role in a market that it might otherwise if not for wanting a sovereign capability . . .these gray zone dislocations actually are a good form of alpha.”

In addition to Delian, another of Slesinger’s bets is Polar Mist, a Swedish startup producing maritime drones with advanced navigation capabilities. Other focus areas include hypersonics and subsurface mapping.

One challenge in funding defense tech startups is the longer development timeline compared to traditional venture investments. Slesinger acknowledged this tension in his chat with TechCrunch: “If you have a 10-year-venture-fund life cycle, that’s a real thing that we sort of have to do things to try to accelerate or bend a little bit.”

Slesinger also thinks that “European companies ought to be doing more lobbying at much earlier stages.”

Both raise questions about whether his gamble will pay off for investors. At the same time, his early vision for a more autonomous European defense ecosystem is becoming embraced by a whole lot of other investors these days as geopolitical tensions rise and Europe rethinks its security arrangements.

Data published earlier this year by the NATO Innovation Fund and the research group Dealroom showed that European startups working on defense and related tech raised 24% more capital in 2024 than in 2023, hitting $5.2 billion — surpassing even AI funding.

With President Donald Trump returning to office in January and casting doubt on the U.S.’s commitment to European defense, that figure is likely to climb even higher.

Read More

1 2 3 9