Artem Stryzhak gets 70 months for Nefilim and Hive ransomware attacks targeting hospitals, government agencies and businesses in the US and overseas.
Source: HackRead · 2026-10-29
Category: Leaks & Breaches
-
Senators Demand Meta Answer for ‘Pervert Glasses’ Following 404 Media Investigation
Oregon Senator Ron Wyden and Massachusetts Senator Edward Markey sent a letter to Meta on Wednesday demanding the company answer for the privacy concerns its smart glasses pose to the public.
The letter cites 404 Media’s October 2025 investigation into how people use Meta’s smart glasses to harass massage parlor workers. That investigation found Instagram accounts with hundreds of thousands of followers and millions of views uploaded videos filmed with Meta’s Ray-Ban glasses, where men entered massage parlors across the country and solicited the workers for sex work. The full letter is here.
“Meta’s own disclosures confirm that imagery processed through its glasses’ visual AI features may be retained and used to train AI systems, including with the assistance of human reviewers,” the letter says. “Using intimate imagery for AI development is itself an invasion of privacy when the people depicted have not consented to that use, as is inherently the case for most bystanders captured by Meta’s glasses. Retaining that material for AI development, thereby extending the period during which it can be accessed, disclosed, or misused, exploits people’s highly sensitive information for Meta’s commercial benefit.”
Researchers Show How Meta’s ‘Pervert Glasses’ Are Used to Harass WomenA new study shows how pickup artist influencers use smart glasses to create content, and the connection between covert recording and harm.Research published in August revealed how Meta’s platforms encourage an ecosystem of abusive, harassing content from pickup artists and influencers who use Meta’s smart glasses to capture interactions with people minding their own business in public or at their workplaces, who might not even know they’re being filmed. In a January report by the BBC, a woman who was recorded with the glasses said she was “bombarded” with phone calls because her phone number was posted with the video, and men who had seen the video stalked her at work.
Earlier this year, more than 70 people sued Meta, claiming that their intimate images and videos were exposed to workers hired by the company to label the data for AI. In March, Swedish journalists reported that Kenyan data labelers were viewing and annotating uncensored footage from Meta’s smart glasses, including sexual and violent content; Meta ended its contract with those workers less than two months later. These are labor conditions that groups like the Data Labelers Association in Kenya are fighting back against, and for the people whose images are in the videos and photos, it’s an obvious violation of their privacy. People have also been modding these glasses to disable the light that indicates they’re recording for years
Meta has played dumb about the difference between AI glasses you wear on your face and an iPhone for a long time. Now, these senators want the tech giant to answer for themselves. In the letter, Wyden and Markey demand answers about what safeguards, if any, Meta has in place to prevent the nonconsensual “capture, disclosure, or processing of sensitive and intimate imagery,” whether Meta specifically evaluated the potential for its glasses “to facilitate voyeurism, nonconsensual intimate image capture, or similar privacy invasions,” what imagery it uses for AI training, and whether people can request their biometric and other data captured by its glasses be deleted, along with several more questions about the glasses’ safety and design.
“The reported disclosure of intimate footage to contractors for the purpose of AI training is particularly disturbing. Human review to fulfill a service knowingly requested by the person depicted is one thing; exposing unsuspecting individuals’ intimate moments to strangers for AI training is quite another,” Wyden and Markey wrote. “The individuals whose naked bodies, sexual activity, and other private moments have reportedly been captured by Meta glasses did not knowingly agree to having those images shared with strangers, much less for the purpose of improving Meta’s commercial AI systems. That disclosure and processing is an invasion of privacy, regardless of whether the footage is subsequently published or misused.”
💡Do you know anything else about harassment and Meta’s smart glasses? I would love to hear from you. Using a non-work device, you can message me securely on Signal at sam.404. Otherwise, send me an email at sam@404media.co.In the last few weeks, Meta has come under fire for quietly changing its privacy policies for business accounts and granting itself permission to scrape user’s content and connected websites to develop its AI products.
Meta has been pushing its smart glasses over the years with ads featuring A-list celebrities, including Chris Pratt, Chris Hemsworth, and Kris Jenner (all three in a 2025 Superbowl ad), Doja Cat, Jennie Kim from K-pop group BLACKPINK, and most recently, Kylie Jenner. Guerrilla ad makers have countered with their own anti-AI glasses ads around the world, and people have started calling the smart glasses “pervert glasses” in response to these widespread invasions of privacy they’ve come to represent. In August, Meta filed a patent to add facial recognition and highlight reel features to its smart glasses.
Source: 404 Media · 2026-10-29
-
Transferring Unused IPv4 Addresses in Asia Pacific: The Complete APNIC Playbook
Understand APNIC IPv4 transfer rules, buyer requirements, fees and approval steps, with helpful checks to assess address blocks before completing a transaction.
Source: HackRead · 2026-10-29
-
Next-gen privacy protocols: WireGuard vs OpenVPN vs Shadowsocks
Compare WireGuard, OpenVPN and Shadowsocks for speed, privacy, enterprise access and censorship resistance, including VPN tunnels differ from encrypted proxies.
Source: HackRead · 2026-10-28
-
Icepick
An internal database identifying more than 41,000 employees for the U.S. Department of Homeland Security (DHS). The database, from an Okta single sign-on service used by the DHS, reveals employee…
Source: Distributed Denial of Secrets · 2026-10-28
-
JPN: Times Car reporting ¥5.5 billion loss has firms bracing for data breach fallout
Maddie Baker and Spencer Landers As cyberattacks continue across Japan, companies are coming to realize the great financial risk of such attacks if their lax cybersecurity systems cause millions of peoples’ personal information to be leaked. Times Car, which saw personal data that included the driver’s licenses of 1.46 million people leaked in September, is learning…
Source: DataBreaches.net · 2026-10-28
-
Objection, your honor
You’ve probably heard, at this point, about the big changes coming to Meta’s AI scraping terms for business accounts. Nieman Lab had that scoop, and since then, small businesses, journalists, and artists using Meta products like Instagram have been raising the alarm. But if you’re in the EU or UK, you might be in luck and can object to that use of your data, as some users have pointed out.
Images via Unsplash / collage via 404 Media If You’re In the UK or EU, Here’s How to Object to Meta’s AI Training
Earlier this month, Meta updated its commercial terms of use for business accounts to allow it to “use any content from such domains, web pages, or URLs to provide, develop, improve, research, train, and maintain the integrity of” Meta’s products.
Many artists and small business owners that rely on Instagram and Facebook are livid at Meta granting itself permission to use their content, including from websites simply connected to their Meta accounts, to train AI. But for users in the United Kingdom and European Union, for now, there’s a way to object.
Meta buried this change in its Commercial Terms, and Nieman Lab first reported on the change. The update was originally set to go into effect on October 30, but following backlash, Meta changed the effective date to November 20. Adding to the confusion, Meta then removed the word “train” from a list of allowed use cases, Nieman Lab reported, and limited those uses to “advertising and business products,” where previously it said that data would be used for all Meta products. Those terms still allow Meta plenty of leeway for scraping users’ data to develop its products, however.
Several users based in the UK and EU have explained how to object on Instagram. On mobile: by clicking the three lines on their account, going to the privacy center, and clicking “object,” which goes to a form that asks users to write why they are objecting to their data being used. They received an email from Meta saying their objections were approved.
MORE FROM 404
On the podcast this week, we talk Flock CEO’s leaked police conference audio and Sam’s piece about Marissa Mayer’s latest meltdown. Subscribe wherever you get your pods.
FROM AROUND THE WEB
The New York Times has an antisocial aversion to linking: Another day, another the-New-York-Times-isn’t-linking controversy. The specifics here almost don’t matter because this happens seemingly every day, but basically the New York Times investigation about chemical plant polluters under the Trump administration was covered in much the same way by Hunterbrook, a news outlet fused with a hedge fund. The Times article—which led the Sunday print edition—uses similar photos, some of the same sources, and covers similar ground to Hunterbrook’s earlier investigation from February, with no acknowledgment or link whatsoever. After the cofounder of Hunterbrook rightfully ranted about this on X, the Times added an acknowledgment (but no link!!!) toward the bottom of the story. Puck’s Dylan Byers has a good rundown about what happened, which includes parts of a three-paragraph Times’ spokesperson statement explaining at length why they don’t think they have to link. This is extremely antisocial, deranged behavior and it’s ridiculous that the Times is still getting away with this. Bottom line: I’m sure the Times was already working on this story, what with their massive newsroom. Even so, they got beat, and they should link. Journalism awards need to stop looking the other way when big outlets do this. This has happened to us many times and it actually does matter for smaller outlets and links are free. Let’s try them!
Artificial reef: TIL that a gigantic military ship, the SS United, is going to be purposefully sunk to be turned into an “artificial reef.” Scuba divers seem quite excited. I didn’t really know that this was a thing that was done, but maybe I’m a rube.
Ransomware scam mitigation scammer: A company that promised to help victims of ransomware (for a fee) was indicted by the feds, according to ProPublica and a Department of Justice affidavit. The original investigation that led to this was published by ProPublica back in 2019 but is still worth a read; there are so many of these companies that prey on victims of cyberattacks, sextortion campaigns, etc.
Today in c’mon, man: CIA whistleblower John Kirakou is doing sponcon for Kalshi, writing “I spent 15 years at the CIA trying to figure out what was going to happen next in the world. Now Kalshi is finding new ways to put a price on those predictions. This partnership between Kalshi and S&P Dow Jones Indices is fascinating.” C’mon, man.
Today in printers: I am absolutely mesmerized by this microphotography of an inkjet printing, which won the 2026 Nikon Small World photomicography competition. Ole Bielfeldt’s work is on his Instagram, which is absolutely worth checking out. Wow, wow wow.
Today in yikes: A Roblox scraper has been grabbing more than a hundred gigabytes of data from a 3D modeling community, including more than 60 GB of adult content from a section of the site called “SmutBase.” “We don’t think Roblox set out to collect adult content, and we have no evidence that any of it reached a model or a product. The scrapes were likely automated. But that is exactly the problem: as far as our logs show, nobody checked. A crawler working for a company whose platform tens of millions of children use was pointed at an adult site, and it took explicit models without telling them apart from anything else,” Open3DLabs wrote in a blog post about the scraping. “For a company being sued by several US states over child safety, ‘our AI team bulk-downloaded an adult site without looking’ is not a good position to be in.”
Source: 404 Media · 2026-10-28
-
If You’re In the UK or EU, Here’s How to Object to Meta’s AI Training
Earlier this month, Meta updated its commercial terms of use for business accounts to allow it to “use any content from such domains, web pages, or URLs to provide, develop, improve, research, train, and maintain the integrity of” Meta’s products.
Many artists and small business owners that rely on Instagram and Facebook are livid at Meta granting itself permission to use their content, including from websites simply connected to their Meta accounts, to train AI. But for users in the United Kingdom and European Union, for now, there’s a way to object.
Meta buried this change in its Commercial Terms, and Nieman Lab first reported on the change. The update was originally set to go into effect on October 30, but following backlash, Meta changed the effective date to November 20. Adding to the confusion, Meta then removed the word “train” from a list of allowed use cases, Nieman Lab reported, and limited those uses to “advertising and business products,” where previously it said that data would be used for all Meta products. Those terms still allow Meta plenty of leeway for scraping users’ data to develop its products, however.
EU users’ personal data rights are governed by the General Data Protection Regulation and the AI Act. GDPR, which became enforceable in 2018, requires explicit consent to use personal data. This includes the right to object to one’s data being used. The AI Act, which went into effect in 2024, dictates how AI companies can use personal data, and how people can opt in or out, stating that they can withdraw consent at any time. The UK has its own version of the GDPR. The European Commission states: “The GDPR rules only apply to personal data about individuals; they do not govern data about companies or any other legal entities. However, information in relation to companies may constitute personal data where it allows the identification of a natural person.”
Several users based in the UK and EU have explained how to object on Instagram. Instagram user bookish.sil posted a walkthrough of how they did it on mobile: by clicking the three lines on their account, going to the privacy center, and clicking “object,” which goes to a form that asks users to write why they are objecting to their data being used. They received an email from Meta saying their objection was approved. Instagram user jenniqueart posted a similar walkthrough with the same results.
My Meta accounts are based in the US, but using a VPN to locate my IP address in London, I could see options in my Meta privacy settings that would let me object to the use of my information by Meta AI. To get there on desktop with a VPN on, I went to my account privacy center, clicked “Submit a privacy rights request” at the bottom, selected Instagram, clicked “How can I object to the processing of my information?” and got to a page where I could choose to object to the use of my information for Meta AI or third parties, which were two separate options.
When my location is based in the US, these options don’t appear.
When I clicked through the option to “object to the use of my information for Meta AI,” however, it returned an error page that said “This form is only available to people in certain regions.” GDPR is meant to apply to wherever someone is located at the time, but since this objection applies to the preferences of one account, it might be based on where the account was created. I tried again located in Belgium and got the same results. I’ve asked Meta to clarify.
As many have already pointed out in the comments on UK and EU users who’ve posted walkthroughs, these objection steps aren’t available to people outside of those countries, and as Meta continuously changes its platform, these steps might not work for everyone always. Unless something changes before November 20, the rest of us are screwed.
Source: 404 Media · 2026-10-28
-
KR: Bithumb discloses data leak after internal system breach; One of three financial firm breaches reported that day
CoinTelegraph reports: South Korea’s crypto exchange Bithumb is investigating the extent of a data leak caused by a hack of its internal mobile system earlier this week, Yonhap News Agency reported Wednesday. Bithumb discovered the breach of its in-house mobile system — the platform used by employees to communicate internally — on Tuesday and notified…
Source: DataBreaches.net · 2026-10-28
-
Japanese internet giant GMO tells customers to shut down and disconnect PCs from the internet following data breach and ransomware threat
Sead Fadilpašić reports: Japanese internet giant GMO Group has told its customers to scan their computers for viruses, back up all of their data, disconnect the devices from the internet and then shut them down. The announcement, which literally told customers, “unplug any cords connected to your PC,” was made in response to a cyberattack…
Source: DataBreaches.net · 2026-10-28