Why Are You Getting This?

You signed up to receive The Privacy Professor^® Tips, or initiated contact to stay in touch with Rebecca and/or Privacy & Security Brainiacs^® (PSB) and consented to receive the Tips. Please read our Privacy Notice & Communication Info at the bottom of this message for more information. You may unsubscribe from there as well.

Image created by Rebecca Herold using ChatGPT Images 2.5.

Beware of the Tricksters: Real Life Impersonators Are the Scariest Monsters This Halloween

October is the one month when masks, costumes, and spooky voices are expected. But this year, the scariest impersonators aren’t handing out candy. They’re after something far sweeter: your data. Today’s tricksters don’t lurk in haunted houses; they hide behind deepfakes, cloned voices, spoofed websites, fake job applications, and even counterfeit ATM and crypto machines. Some impersonators show up at your door dressed as utility workers or government reps. Others sneak into organizations disguised as legitimate employees, quietly siphoning off information like digital vampires.

And the horror doesn’t stop there. We’re seeing sexualized deepfake images sold online, scammers mimicking loved ones’ voices, and “helpful” tech support callers who are anything but. Even home services, such as babysitters, pet sitters, caregivers, and contractors, can be targets for impersonation schemes.

In a world where both physical and digital spaces are crawling with fraudsters, how do we tell the real from the fake? How do we avoid getting tricked so our lives stay filled with treats? These threats aren’t campy Halloween movie plots; they’re real, growing, and often terrifying. Keep reading for practical tips to help you stay safe from the impersonating ghouls among us.



We receive dozens of questions each month. Because we do take a significant amount of time to consider all aspects and then provide a thoughtful answer (that we wrote using our own expertise and experience, not using AI) that is as succinct as possible, we decided to limit the number of questions answered to four. As we are making changes in our business, next year we will also start regularly posting to our blog again, and we will answer more questions there, and point to them from our Tips.

This month our Question of the Month asks about how HIPAA impacts medical identity theft. The other three cover: Spotting impersonated calls from people you know; reacting to impersonated calls from businesses and organizations; and the use of passwords in physical security. Thank you for sending them in! 

Please read to the end where we provide some important information.

Since 2005, we have been freely distributing the Privacy Professor Tips monthly publication to help both businesses and individuals, of all ages, identify risks throughout their daily lives, within their own businesses, and to help them know how to prevent security incidents, privacy breaches, and to keep from being a victim of scams.

By sharing this Tips issue with others in your organization, you are also supporting a wide range of regulatory and other legal compliance requirements to sending such awareness communications. Thank you for reading and sharing!

We would love to hear from you!

Did you find the tips we provided useful? Did you like this issue? Do you have questions for us to answer? Please let us know at info@privacysecuritybrainiacs.com.

Rebecca

October Tips of the Month

• News You May Have Missed
• Privacy & Security Questions and Tips 
• Where to Find the Privacy Professor

Many readers are sending us alerts of privacy related news on a wide range of privacy topics. Thank you! We love getting your notices. With your help we are finding more unique news stories to share with you than ever before, along with news items that we believe are important for most folks to know, but that often do not get much mention in traditional news, or even in security and privacy news outlets. 

Here are just a few of the 150+ news stories we discovered throughout the past month that provide a wide range of interesting security and privacy related news. These news items demonstrate that such types of risks exist basically anywhere in the world, and that everyone needs awareness.

We have grouped the 40 news items into four broad categories: the first expands upon this month’s topic of “Costumes Are Cute. But Deepfakes, Voice Clones, and Fake Workers Are Not” with tips and news to raise privacy awareness for everyone. Followed by privacy related news in the categories, “Of Broad Interest,” “Privacy in Businesses, Governments, and Other Organizations,” and “Laws, Compliance, Legal Issues, and Lawsuits Involving Privacy and/or Security Issues.”

Within each category the items are in no particular order. Some include a TIPS: to provide some advice or additional insights to specific news items. Thanks to those many readers who sent your positive feedback; we appreciate it!

Do you have interesting, unusual, bizarre or odd stories involving security and privacy? Some of the most surprising items are in local news! Or questions about any of the notes we included for the stories we listed this month? Let us know!

Costumes Are Cute. But Deepfakes, Voice Clones, and Fake Workers Are Not

Image created by Rebecca Herold using ChatGPT Images 2.5. A few of the news stories in this section inspired the idea for this image.

Halloween used to be simple: a plastic mask, a pillowcase full of candy, and an unspoken agreement that the person dressed as Dracula wasn’t actually going to drain your blood. Today? The costumes have evolved, and the real-life impersonators out there aren't looking for fun-sized candy bars. They're after your data, your identity, and your security.

We are increasingly surrounded by bad actors in convincing disguises. Digitally, AI deepfakes fabricate hyper-realistic voices and video, phishing attacks haunt our inboxes and text streams, and fake websites clone trusted brands. Physically, scammers pose as utility workers, contractors, or delivery drivers just to step past your doorstep. Even organizations face insidious trickery, with stealth bad actors posing as legitimate job applicants solely to gain insider access and exfiltrate sensitive files.

From compromised ATMs to stolen medical identities and unauthorized workplace infiltrators, falling for these tricks turns everyday life into a genuine horror movie. But safety isn't about hiding under the covers. It's about learning how to spot the fake from the real. Read on to learn some real-life cybersecurity and privacy horrors, and some related effective ways to unmask today’s impostors and keep your personal and professional world sweet.

1.    How to report a platform that doesn't take down your intimate images. You reported an intimate photo or video shared without your consent. But 48 hours later, the platform hasn’t taken it down or responded to your request. Now what? Report the platform to the FTC at TakeItDown.ftc.gov to help keep platforms accountable for complying with the Take It Down Act.

2.    Scammers impersonating MyChart to steal personal information, install malware. A warning for millions of people who use MyChart to check their medical records. Scammers are now impersonating the patient portal, using realistic-looking emails, texts, and websites to try to steal personal information and, in some cases, get malware on your computer. Epic, the company behind MyChart, said scammers are using fake websites that can look almost identical to the real thing.

3.    Threat groups ramp up social-engineering attacks against healthcare sector. The Health Information Sharing and Analysis Center recently warned that the group ShinyHunters was using voice-phishing attacks to target the healthcare sector. The hackers used medical-themed impersonation domains to trick healthcare employees into exposing their credentials. More than a dozen member organizations have been hit by social-engineering attacks over the past couple of months.

4.    State troopers warn residents of scammers impersonating authorities, asking for gold bars. Pennsylvania State Police are investigating an organized fraud scheme in which scammers impersonate federal law enforcement officials to steal millions of dollars from victims nationwide. The scam typically begins with a pop-up message on a computer screen, followed by contact from individuals claiming to be federal officials. Perpetrators persuade victims that their personal information is linked to criminal activity and instruct them to buy gold bars or coins to turn over to couriers.

5.    Smartglasses should automatically blur people’s faces while filming, Australia’s online safety regulator says. Smartglasses with cameras can benefit the vision impaired but companies might pit ‘accessibility benefits against safety and privacy’, eSafety says. Australia’s online safety regulator has urged smartglasses companies to automatically blur people’s faces filmed on the devices, and make it clearer when someone is filming, as the federal government faces pressure to ban the technology.

6.    Man indicted on charges for allegedly threatening Marine recruiter, police and impersonating Toledo police officer. Witness reports stated that the indicted man allegedly drove beside a vehicle, told the driver that he was a police officer and ordered them to pull over northbound on I-75, in the Toledo area. Police say the accused chased the victim to a grocery store parking lot before boxing in the other driver's vehicle, preventing them from leaving.

7.    New Hampshire officials warn of rise in cryptocurrency ATM scams. Criminals impersonate government officials, law enforcement officers, financial institutions, and technology support representatives to convince victims to deposit cash into cryptocurrency machines. Once funds are transferred, the transactions are often irreversible, leaving victims with little chance of recovering their money.

8.    AI technologies, including voice cloning and deepfake videos, have enabled scammers to impersonate individuals and orchestrate convincing frauds, leading to nearly $893 million in reported losses in the US in 2025. The FBI tracked over 22,000 AI-linked fraud cases, with seniors particularly affected. An AI impersonation fraud complaint cost a U.S. victim an average of $39,946 in 2025. This is 1.93 times the $20,699 average across all 1,008,597 complaints filed with the FBI’s Internet Crime Complaint Center. Voice cloning is not a standalone crime category in federal reporting; it is an attack technique distributed across investment fraud, business email compromise, distress scams and employment fraud.

9.    For just $500, criminals can use AI voice cloning technology to scam you and your family. A review of dark web forums and social media channels conducted by NordVPN found that the criminal market for cloning tools has grown by 7.4 times over the last two years. The report was compiled after NordVPN studied activity related to AI cloning from January through July 2024 and January through July 2026. TIPS: “7.4 times” is a 740% increase! Expect voice impersonations to increase dramatically in the coming months and years. Especially for impersonations of family members, co-workers (especially those in positions of power such as CEO, HR, etc.), friends, neighbors, and people whose voices are well known, such as celebrities, politicians and sports stars. Help your family, friends and coworkers understand this risk so they can spot the signs. See the Questions & Answers section for more information on this.

10. They Stole Children’s Identities, Invented Mental Health Diagnoses and Billed Medicaid. A New Mexico mother and daughter who operated a Silver City afterschool program have each been sentenced to four and a half years in prison after admitting to a Medicaid fraud and identity theft scheme that used children's personal information and false mental health diagnoses to support billing. Susanne Kee and her daughter Bethanne Kee operated Kids in Need of Support Services, or KISS, a nonprofit that investigators said many families understood to be an afterschool and summer program. Behind the scenes, authorities found Medicaid claims for psychotherapy and other behavioral health services that were never actually provided. TIPS: This is a form of medical identity theft. See the Questions & Answers section for more information on this.

Of Broad Interest…

Image created by Rebecca Herold using Gemini Nano Banana 2. This scene relates to a news story in this section.

11.    A Jackson County, Alabama, judge is warning residents after he received a scam phone call this from a crook impersonating local law enforcement. Circuit Judge Brent Benson shared the warning on social media Saturday, saying he received a call from a blocked number in which the caller claimed to be with the Jackson County Sheriff's Office and told him he had a warrant out for missing jury duty.

12.    Puyallup, Washington, warns that scammers are impersonating city employees to get your money. The City has received reports of emails that appear to come from City staff and reference legitimate-looking invoices, development applications, or approval fees. In some cases, the fraudulent emails instruct recipients to request 'real-time payment instructions' or send money using banking or wire-transfer information," according to a city news release. The release said that the scammers may be using a city employee's name and an email that looks like an official city address. Tips: These city and state employee scams and crimes are increasing throughout all the U.S. For example, on August 3, 2026, in Honolulu, Hawaii, the Department of the Attorney General warned the public about a scam in which criminals are impersonating Attorney General Anne Lopez in an attempt to trick victims into purchasing gift cards and sending the card information to the scammers. On September 25, 2026, the Connecticut Department of Administrative Services (DAS) warned of fraudulent emails impersonating DAS officials and procurement employees. Some messages use a real employee’s name and reference a real State contract. Others impersonate Commissioner Michelle Gilman and ask school districts to review a “DAS business proposal.” If you receive a message asking for money from what claims to be state or city employees, do not reply, click links, open attachments, or send payment. Check the sender’s full email address, even if the display name looks familiar. Then verify the request using contact information you already have, or that is published on the official sites online. Do not use contact information supplied in the suspicious email.

13.    Appeals court ruling on AI-generated child images raises questions for families. Local advocates say decision could affect efforts to protect children online. A federal appeals court in Eau Claire, Wisconsin, upheld a decision to dismiss one charge against S. Anderegg, accused of creating thousands of explicit AI-generated images of children. Prosecutors say Anderegg used artificial intelligence (AI) to create thousands of “photorealistic” abuse images. A federal judge in Wisconsin first dismissed the possession charge against Anderegg. Last week, a federal appeals court agreed, upholding that decision. The court ruled that the possession of the AI-generated images is protected by the First Amendment. Anderegg still faces three other charges: producing the images, distributing them and sending them to a minor. Prosecutors say Anderegg is accused of sending some of the images to a 15-year-old boy and explained to the boy how he made them using AI. TIPS: The ruling is narrower than what the headline implies. It does not make it legal to turn a real child’s photo into a sexual deepfake, it doesn’t protect distributing such images or sending them to children, and creating a real child’s face or photograph can still qualify as illegal child sexual-abuse material because they harm an actual child. The challenge for prosecutors when the material is entirely synthetic and kept privately. The concern for families is practical: publicly posted photos can be copied, scraped, altered, and used in “nudify” or face-swapping tools. A photo that seems harmless can also expose a child’s face, name, school, location, or routine, making harassment, blackmail, impersonation, or sexual deepfakes easier. Practical precautions for parents include making online accounts private, disabling location data, avoid posting revealing or highly identifiable images, reviewing old posts and removing those that could be inappropriately altered, and limit photos that show school uniforms, addresses, or regular activities. If a sexualized fake image appears, preserve evidence without forwarding it, and report it to the platform and local police.

14.    Nassau police warn of Apple Pay text scam after woman lost $60,000. Police said the scam started when the woman received a text message claiming there had been account activity and that an extra $30,000 had been deposited into her account. The message instructed her to call a phone number. Police said the woman followed the instructions, withdrew $30,000 from her bank and handed it over. Investigators said the scammers then repeated the scheme. The woman ultimately lost $60,000, money police said she has been unable to recover. TIPS: Scammers frequently target older adults and urged residents to be cautious of unsolicited calls and messages. Apple provides a good advice about avoiding Apple Pay scams here. 

15.    A man was arrested after police said they caught him placing a fraudulent device on a Foster City ATM, authorities said. Foster City police had been monitoring local ATMs after learning that someone was using hidden devices to trap cash inside machines, allowing them to return later and collect money left behind by unsuspecting customers.

16.    Inside a 'modern slavery situation' where cyber scammers are victims themselves. “Some major crime organizations behind scams like this are based in Laos and Cambodia. My guest, Andy Greenberg, wrote about one such organization for Wired magazine, where he's a senior writer. That story involves human trafficking. Greenberg was contacted by a young computer engineer using the pseudonym Red Bull who was tricked into moving from India to Laos with the promise of a good IT job. When he got to the compound where his job was supposed to be, his passport was confiscated. He was turned into an indentured servant and forced to engage victims in cyber romance scams. Living conditions were awful. So was the work.” TIPS: This audio news report, that includes the transcript, provide insights into the world of impersonation scammers, and of other types of cybercriminals.

17.    Researchers used Claude to hack OpenAI employees' ChatGPT accounts. A trio of bug hunters researching frontier AI labs’ security weaknesses chained two vulnerabilities to take over multiple OpenAI employees’ ChatGPT accounts, then used that access to demonstrate they could reach an internal OpenAI repository by opening a harmless pull request.

18.    I Built AI Clones of My Coworkers. Things Got Weird. Some excerpts: “I created Brian Bot first—as my actual manager, he was the most important coworker to impress. I knew he lived in Alabama; that he used to work at Gizmodo; that he likes blogs.” “The real problem was that talking to Brian Bot was nothing like talking to actual Brian, which defeated its whole purpose.”

19.    Stop Replying 'Stop': The Danger of Responding to Spam Texts (And How to Block Them for Good). Tired of spam texts? Your phone comes with built-in protection against them, but it might be turned off by default. Here's how to change that on both iPhone and Android. TIPS: We block spam and scam numbers. Even though many scammers use many different phone numbers, many others don’t. Plus, after a while those blocked numbers will stop the numbers that cycle back around to you.

20. British fintech Revolut confirmed that it disclosed sensitive customer information to an unauthorized third party after receiving fraudulent requests sent from a legitimate government agency email domain. The exposed data included customers’ identity and contact details, including their birth date, postal and email addresses, and phone numbers, as well as copies of their identity documents including passports and driver’s licenses, according to a notification emailed to affected customers and reviewed by TechCrunch. The data may have also included verification selfies, account statements, and transaction histories, the firm said in its notification.

Privacy In Businesses, Governments, and Other Organizations…

Image created by Rebecca Herold using Gemini Nano Banana 2. A depiction of one of the news items in this section.

21.    Meta’s smart glasses privacy defense falters when AI can use camera without recording light. Meta has spent months defending its rapidly expanding line of AI glasses by pointing to a small white light. The company says the capture LED on its glasses warns nearby people when someone takes a photograph or records a video. But because some users have been trying to block the light to avoid being seen recording, Meta has gone so far as to disable the cameras on thousands of devices after detecting that users had covered, damaged, or removed the light. Now, Meta’s own documentation exposes a much larger problem with that privacy defense. On newer models, the LED does not illuminate when a wearer uses camera-based AI features, such as asking the glasses to identify a landmark or plant, according to Ray-Ban’s official FAQs. Meta says this is because those images are being used by the AI rather than captured as content intended for the user’s gallery. And that’s increasingly difficult to square with a privacy debate that is no longer simply about whether someone knows they are being photographed. Smart glasses can now use cameras, microphones, cloud-based AI and on-device processing to interpret what is happening around the wearer. The person standing in front of the glasses may see no recording light at all while the device’s camera answers an AI query. TIPS: This highlights the importance of designing and engineering effective, strong, security and privacy capabilities into all types of computing products so that security and privacy features cannot be disabled in areas where others in the vicinity may be recorded in some way.

22.    The Democratic People’s Republic of Korea (DPRK) Insider Threat Nobody Is Screening For. Huntress exposes five DPRK-linked remote workers hired companies through legitimate hiring channels by Western firms in 2026, tracked as FAMOUS CHOLLIMA. Most security programs are blind to it. Once inside the company the DPRK insider gets a company laptop, routes it through a GL.iNet travel router, onto residential WiFi, and then into a PiKVM device (a small hardware appliance that lets you control a computer remotely at the hardware level) granting hardware-level remote control to an operator who is not the person on the payroll. The PiKVM setup in particular is a red flag that the laptop is being controlled by a third party (the DPRK operative) while the hired identity serves as a front. The primary risk is sustained, credentialed access to internal source code, customer data, financial systems, and intellectual property. A DPRK worker embedded in a software engineering role for six months has repository access, participates in code reviews, and understands architecture — that's intelligence collection at a depth that external intrusion rarely achieves. TIPS: Situations where people were seeking employment, and getting hired, in organizations that have been targeted to have insiders to exfiltrate data, information, or to do other harms is another type of impersonation; impersonating a legitimate workforce member to obtain trusted access to what is valuable to the outside organization that planted them in the organization.

23.    AI agent breached Australia's government website. When blocked, it devised its own way to breach security; 4 hacking cases in 2 months. The incident took place in June, but the government learnt about it in September. Australian Prime Minister Anthony Albanese has expressed his anger over the incident. Since then, the incident has intensified the global debate over AI safety and its control. TIPS: This article provides a Q&A explaining the hacks and breaches.

24.    Federal lawmakers reintroduced the Health Infrastructure Security and Accountability Act (HISAA) bill, proposing mandatory minimum cybersecurity standards for covered entities and business associates to replace purely voluntary guidance from the original version of the bill. This is the second bill this year from congress specifically covering healthcare security. The first was the Health Care Cybersecurity and Resiliency Act of 2026 bill. These bills are likely the result of the increasing number of healthcare breaches that have exposed tens of millions of records just this year. The HISAA bill would require HHS to establish enforceable technical rules and require periodic stress tests to be run on critical healthcare systems. It would also raise HIPAA penalties, up to $250,000 per violation for uncorrected willful neglect. While these are currently bills and not laws, they indicate a clear push toward stronger, enforceable cybersecurity expectations for healthcare. TIPS: Compliance and security teams should continue assessing whether current safeguards, incident response plans, third-party oversight, and documentation could withstand greater regulatory scrutiny.

25.    Nvidia CEO Says AI Companies Will Be Sued to Death If Their Frontier Models Keep Doing Horrible Things. "The liability's incredible." According to Nvidia CEO Jensen Huang, if AI labs truly believe their tech could spiral out of control and cause widespread harm, they should simply not release a new product or face criminal liability.

26.    OpenAI disclosed on September 25, 2026, that its artificial intelligence agents had interacted with several U.S. government websites in unexpected ways, discovered as part of an ongoing review into the company's models' unanticipated behavior. The AI giant's models accessed publicly available information on two websites operated by the Securities and Exchange Commission as well as U.S. Census Bureau data, the company revealed Friday. OpenAI did not find any use of SEC credentials, access to accounts or nonpublic information, changes to SEC data or systems, or evidence of a compromise or vulnerability, the company said. AI evaluator and research lab Transluce said Friday that through an independent investigation it also found that agents appearing to originate from OpenAI attempted a rudimentary hack on a Department of Education website for the department's civil rights office, which did not succeed.

27.    Global: Enormous data pipelines powering major generative AI systems are rooted in mass invasions of privacy by design. Companies are extracting vast troves of online data through unlawful web scraping to build their generative artificial intelligence (AI) products in a way that is enabling a mass invasion of privacy, making these systems unlawful by design, Amnesty International said in a new briefing.

28.    FBI: Fake cop and government impersonation scams cost victims $1.6B. AI, fake uniforms, and mock offices help crooks sell the con. Scammers impersonating law enforcement or government officials have cost victims more than $1.6 billion since January 2025, the FBI reports. The FBI’s Internet Crime Complaint Center (IC3) received close to 61,000 complaints of this type between January 2025 and July 2026, putting the average per-complaint loss at more than $26,000. The most common type of scam is one involving criminals convincing targets to pay a sum of money to remove charges the fraudsters claim were filed against them. TIPS: Increasingly more types of business organizations are being impersonated. For example, the FTC warned about scammers targeting farmers posing as farm equipment businesses selling (fake) equipment to farmers, who end up empty-handed.

29.    North Korea's fake job interviews infected 30,000 devices. WaterPlum recruiters used bogus coding tests to backdoor jobseekers and raid more than 7,000 crypto wallets. North Korea's employment scams work both ways. As well as placing fraudulent IT workers inside Western companies, regime-backed cybercriminals have posed as recruiters to infect more than 30,000 devices and steal over $10 million, according to an international advisory. Law enforcement and cybersecurity agencies from Australia, Germany, Japan, and the US issued an update on the campaign on Thursday. They said the attackers had compromised more than 7,000 cryptocurrency wallets and stolen funds that ultimately supported the North Korean regime.

30. ID verification service IDScan has confirmed that a data breach involved the theft of driver’s licenses from its systems, a week after a report said the identity document checker had been breached during a year-long hack. The company said in a website notice that hackers stole the driver’s licenses from the company’s cloud; the stolen information includes people’s full names and driver’s license numbers, along with identity numbers from other government-issued documents, such as passports.

Laws, Legal Issues, and Lawsuits About Or Significantly Involving Privacy and/or Security Issues…

Image created by Rebecca Herold using Gemini Nano Banana 2. A depiction of one of the news items in this section.

31.    OpenAI is being sued by a 13-year-old who witnessed a school shooting in Canada. The lawsuit argues that ChatGPT encouraged the shooter. An excerpt from the lawsuit: “ChatGPT played a role in the mass shooting and OpenAI could have, and should have, prevented it. Sadly, the victims didn’t learn this because OpenAI was forthcoming, but because its own employees leaked the story to the Wall Street Journal after they could no longer stomach the company’s silence. Those whistleblower disclosures and OpenAI’s eventual admissions revealed that ChatGPT deepened the Shooter’s violent fixation and pushed them toward the attack—the predictable result of OpenAI’s deliberate design choice to let ChatGPT engage with users about real-world violence. But that design choice was not the worst of it. OpenAI actually knew the Shooter was planning an attack and, after a contentious internal debate, made the conscious decision not to warn authorities.” TIPS: Organizations need to make sure they have security, privacy and safety controls for the use of AI tools in their network or they could be sued for how those who are authenticated on the network are using the AI tools. This is also an issue for families to address in how their family members are using AI tools.

32.    Nutex Health data posted online after cyberattack, lawsuits mount. The publicly traded micro-hospital operator is now downloading, processing and analyzing that data to determine its contents, scope and authenticity, according to a Sept. 10 SEC filing. Nutex said the review could take several weeks given the volume of data involved.

33.    On September 17, 2026, the US HHS OCR announced a settlement with Ambry Genetics Corporation (Ambry) for HIPAA Security Rule violations. Ambry, headquartered in Aliso Viejo, California, is a covered entity (CE) that provides genetic testing and clinical genomics services. In January of 2020, Ambry discovered that an employee’s email account was compromised by a phishing attack. The protected health information (PHI) of 225,370 individuals was potentially exfiltrated by the threat actor. Affected PHI included names, addresses, dates of birth, some Social Security numbers or driver’s license numbers, financial information, diagnoses and conditions, lab results, medications, and treatment information. Under the terms of the resolution agreement, Ambry agreed to implement a corrective action plan (CAP) that OCR will monitor for two years and paid $700,000 to OCR. See the full resolution agreement and CAP here.

34.    On August 27, 2026, the US HHS OCR announced a settlement with Azul Vision, Inc. (Azul Vision), a California-based healthcare provider offering optometry and ophthalmology services, for violations of the HIPAA Privacy Rule. This settlement marks OCR’s 55th Right of Access Enforcement action. The settlement resolves an investigation of a complaint alleging a failure to provide an individual with timely access to her protected health information (PHI). OCR’s investigation determined that Azul Vision failed to provide timely access to an individual’s PHI within 30 days. Under the terms of the resolution agreement, Azul Vision agreed to implement a corrective action plan (CAP) that OCR will monitor for two years, and paid $50,000 to OCR. See the full resolution agreement and CAP here.

35.    A Third Circuit case concerns plaintiffs’ allegations that Tower Health’s use of Meta Pixel violated the Health Insurance Portability and Accountability Act (HIPAA) by disclosing PHI to Meta, and the opinion discusses the pleading requirements for a HIPAA claim. The District Court held that Plaintiffs did not make sufficiently specific allegations about the information they shared on Tower Health’s website and dismissed all claims with prejudice. Plaintiffs moved for reconsideration and attached a proposed Third Amended Complaint (TAC) that included allegations of the Tower Health URLs Plaintiffs visited, including URLs for specific healthcare practitioners. The District Court denied the motion on the grounds of undue delay in seeking to further amend the complaint.

36.    Nuvei will pay $4.85 million to settle FTC charges that the firm opened and maintained payment processing accounts for merchants that it knew or should have known were engaged in deception, including tech support scams that took millions of dollars from consumers.

37.    In Canada: Bill C-8: A new federal cyber security framework for telecommunications and critical cyber systems. Bill C-8 introduces: (i) the authority to issue telecommunications orders (that is, Orders in Council and Ministerial Orders); (ii) guidelines for a mandatory program for certain critical cyber systems, subject to the CCSPA coming into force and future designations; and (iii) strengthened enforcement in terms of information exchange, audits, administrative monetary penalties, and violations.

38.    Four takeaways from August decisions: (1) a federal magistrate judge concluded CIPA § 631 does not apply to internet communications but that § 632 does; (2) a cookie banner that merely pointed to a privacy policy did not establish consent to third-party data sharing; (3) a banner that offers, but fails to honor, users a choice can supply the “confidential communication” element of a § 632 claim; and (4) a consent defense depends on whether the privacy policy actually describes the third-party disclosures that tracking technologies make.

39.    Gavin Newsom imposes strict new rules on AI, social media and chatbots for children. California governor hails ‘nation-leading’ legislation banning addictive features for users under 16. The laws, signed by the Democratic California governor on September 10, 2026, include AB 1709, which bars social media companies from using infinite scroll and autoplay for users under 16.

40. Massachusetts Superior Court Business Litigation Session (“BLS”) recently dismissed a putative privacy class action against Tripadvisor arising from alleged website tracking, holding that the plaintiff was bound by a choice-of-law provision selecting Massachusetts law. In D’Antonio v. Tripadvisor, LLC, the California plaintiff asserted claims under the California Invasion of Privacy Act (“CIPA”), alleging that a third-party tracker collected IP addresses and other identifiers from users of Tripadvisor’s website. “The court held that Tripadvisor’s Terms of Use formed an enforceable contract and that the parties’ choice-of-law provision governed the dispute. Because the plaintiff acknowledged that his claims could not proceed under Massachusetts law, the court dismissed the action. The decision is significant for Massachusetts businesses facing an influx of website tracking litigation based on California statutes. Like Vita v. New England Baptist Hospital, D’Antonio reflects scrutiny of efforts to extend state wiretapping statutes to commonplace website technologies. It also demonstrates that a well-designed online assent process and Massachusetts choice-of-law provision can provide important defenses to out-of-state privacy claims.”

Check out our Privacy & Security Brainiacs blog page for more unique security and privacy news items. Have you run across any surprising, odd, offbeat or bizarre security and/or privacy news? Please let us know! We may include it in an upcoming issue.

We continue to receive a wide variety of questions about security and privacy. Questions about current hot topics in society, and increasingly more about healthcare privacy and security. Thank you for sending them in! This month, our Question of the Month asks about how HIPAA impacts medical identity theft. The other three cover: Spotting impersonated calls from people you know; reacting to impersonated calls from businesses and organizations; and the use of passwords in physical security.

Are the answers interesting and/or useful to you? Please let us know! Keep your questions coming!

Question of the Month:

Image created by Rebecca Herold using ChatGPT Images 2.5. Images representative of the four questions answered.

Q1: How does HIPAA impact medical identity theft?

A1:

Generally put, medical identity theft occurs when someone uses another person’s personal or health information, such as name, health insurance details, or medical record numbers, to obtain medical services, prescription drugs, or insurance reimbursements. Victims can face incorrect medical records, denied claims, unexpected bills, and compromised care when clinicians rely on tainted histories, and tainted health data. This can put the victim of medical health data not only at financial and potentially embarrassment risks, but also at very real personal health safety risks. The theft can be committed by outsiders who steal data or by insiders who misuse authorized access.

HIPAA requires covered entities (CEs; healthcare providers, health plans, and healthcare clearinghouses) and their business associates (BAs) to implement comprehensive privacy and security safeguards for protected health information (PHI). Those obligations include administrative, physical, and technical controls. These include, but are not limited to, access controls, audit logging, workforce training, encryption where appropriate, and policies limiting use and disclosure to treatment, payment, and healthcare operations (TPO). By law, these organizations must limit who can view, change, or access in any way PHI, and must detect and respond to unauthorized access. When CEs and BAs comply with strong and effective controls, they make it significantly harder for external attackers and malicious insiders to obtain or misuse PHI for medical identity theft.

Because HIPAA ties legal responsibility to entities that create, receive, maintain, or transmit PHI during healthcare and health plan (insurance) operations, it reduces the risk that regulated healthcare systems themselves will be the source of identity theft if they are complying with the HIPAA requirements.  Strong authentication, role‑based access, timely revocation of credentials, routine audits, and incident response plans all help prevent both opportunistic breaches and deliberate misuse by employees who have legitimate access. When violations occur, HIPAA’s enforcement mechanisms, (investigations, corrective action plans, potential penalties, etc.) create incentives for CEs and BAs to fix gaps that could enable identity theft.

However, there are many entities that collect health related data that fall outside HIPAA’s scope. Consumer apps (period trackers, symptom checkers), wearable IoT devices (fitness trackers, smart watches), and many online services gather sensitive health data directly from individuals, as wells as from tech companies that collected such data through online data collecting and tracking. These entities are not CEs or BAs under HIPAA. Those companies may be governed by other laws, platform policies, or voluntary privacy programs, but they are not subject to the same uniform federal privacy and security requirements and enforcement framework that HIPAA established for healthcare organizations. As a result, individuals must evaluate the privacy and security practices of these non‑regulated services before sharing health data with them. For example, individuals should always check those entities’ privacy policies, data sharing practices, encryption use, and determine whether the entity sells or shares data with third parties.

In short, HIPAA significantly lowers the likelihood that medical identity theft will originate from regulated healthcare providers, insurers, clearinghouses and their business associates by requiring effective and comprehensive protections and accountability for PHI. But HIPAA is not a universal shield: health data held by many consumer apps, IoT vendors, and a wide range of other entities may lack equivalent safeguards, leaving individuals responsible for vetting those services themselves. To minimize risks, people should limit sharing, use reputable vendors with strong security practices, and monitor medical and insurance statements for unexpected activity. Together, organizational compliance under HIPAA and practical personal choices about non‑regulated services offer the best defense against medical identity theft. In addition to periodically checking health records to ensure no prescriptions, healthcare services, or anything else has been recorded within their health records. While reviewing your credit reports regularly from the big three credit reporting agencies (CRAs; Equifax, Experian, and Transunion) will help you identify financial fraud, they will not identify medical identity theft, so you need to check your personal health records regularly.

(Somewhat) Quick Hits:

Here are three more questions, most of which we are answering at a comparatively high level. We provide more in-depth information and associated details about these topics in separate blog posts, videos on our YouTube channel, in infographics and e-books, LinkedIn posts to our business page, and within our online training and awareness courses.

Q2: Some of my children are away at college, and others travel a lot for their high school clubs, sports, and other extracurriculars. I’m really worried that scammers are going to be calling and cloning their voices to extort money from me. But I also worry that my children may be kidnapped. How can we spot the signs of voice cloning when we receive a phone call?

A2:

This is a really important topic because voice impersonation scams are dramatically increasing; I’m so happy to know you are preparing for this! A familiar voice is no longer reliable proof that a loved one is actually on the phone. AI-enabled voice cloning can make a scammer sound convincingly like a child, relative, friend, or colleague, often while claiming an accident, arrest, medical emergency, or kidnapping and demanding immediate payment or confidential information. The safest response is to slow down, verify independently, and refuse to send money until identity and safety are confirmed. Here are three specific types of information about this I want you to know.

Red flags to notice

Be on the lookout for a combination of these warning signs:

• An unexpected call from an unfamiliar, blocked (many tools can impersonate numbers that you’ve blocked), or spoofed number.
• A highly emotional, urgent story designed to cause panic and prevent careful thinking.
• Pressure to act immediately, keep the situation secret, or avoid contacting other family members.
• A demand for payment through gift cards, wire transfers, cryptocurrency, cash-transfer apps, or cash picked up by a courier.
• A demand to immediately send sensitive business information, like payroll data, via the same methods previously described.
• A caller who will not let you call your child, family member, etc., directly, claims their phone is unavailable, or insists that you stay on the line.
• Odd pauses, unnatural phrasing, inconsistent details, background noise that does not fit the story, or a voice that sounds unusually flat, distorted, or repetitive. Keep in mind: These may be clues, but they are not required; a sophisticated clone may sound authentic.

Use a shared code word

Before an emergency occurs (like, now), establish a private code word or short phrase with family members, close friends, and relevant co-workers (CEOs, HR personnel, IT admins, managers, etc.). It should be memorable but not guessable from social media, family history, or public records. Very importantly: Do not post or discuss it online!

If a caller claims to be your child, relative, friend, or colleague, or puts that person on the phone, ask for the code word or phrase. Failure to provide it should be treated as a strong indication of impersonation. Still, do not rely on the code word alone if a caller claims an immediate physical danger: hang up and call the person using a number already saved in your contacts, not the number that called you or one supplied by the caller. If you cannot reach them, contact a roommate, coach, school official, teammate, or another trusted person who may be able to verify their safety.

If it is a scam

Preserve the phone number, voicemail, messages, payment instructions, and timestamps. Report the incident to the FTC at ReportFraud.ftc.gov, file an FCC complaint for an illegal call or text, and report suspected criminal activity to local law enforcement and the FBI’s Internet Crime Complaint Center. If money was sent, contact the bank, card issuer, wire service, or payment platform immediately to request a stop, freeze, or reversal.

After you establish the above plan, review it with those who could be involved in such scams. Then, review this information again every month or so, to make sure they remember. After a few reminders, the actions will often become second nature, but do not make an assumption about this.

Q3: I’m not IT, security or privacy savvy. How can I spot a call from a scammer pretending to be a legitimate business? For example, my bank, doctor, utilities company, credit card company, the police, IRS, some random business, etc.

A3:

Great question! It is a good time to remind everyone reading this, that a caller’s displayed number, logo, employee name, or convincing script does not prove the call is legitimate. Scammers can spoof caller ID and impersonate banks, utilities, government agencies, medical offices, police, charities, and businesses; the safest default is to end an unexpected call and independently contact the organization through a trusted number.

Red Flags

Here are some recommended actions to take to spot impersonated businesses and organizations. Be especially cautious when an unexpected caller:

• Creates urgency: “Pay now,” “Your service will be shut off today,” “Your account is compromised,” or “You will be arrested.”
• Demands secrecy, says you must stay on the line, or discourages you from contacting anyone else.
• Requests passwords, one-time verification codes, Social Security numbers, medical information, account numbers, remote computer access, a payment, or any other type of information that is confidential.
• Demands gift cards, cryptocurrency, cash, a wire transfer, or a payment app transfer. A legitimate government agency, bank, utility, or police department will not require an unexpected caller to use these methods.
• Claims your money must be moved to a “safe” account. That is a classic scam indicator.
• Tries to convince you that the caller ID proves who they are. It does not; caller ID can be falsified.

Do not argue or provide information. Hang up, then call the organization using the number on your card, bill, patient portal, official website, or a previously saved contact, etc. Do not call a number the caller gives you.

What to document and when to record

• Document immediately: The date/time, incoming number, what the caller said (exact wording if possible), the name they used, any account numbers they quoted, and the payment method requested.
• When to record: Laws for recording phone calls vary by jurisdiction. In the U.S., some states require two‑party consent to record (meaning both the caller and called must agree to being recorded); others (like Iowa, where I am located) allow one‑party recording (so generally put with some exceptions, I could record any call without telling the person I’m speaking with on the phone). If you plan to record, check local law first, write it down for quick reference in such circumstances, and tell the caller you are recording if required. If you cannot record legally, take detailed notes and save call logs and screenshots of caller ID.

Immediate verification actions

Hang up if pressured. Call the organization back using a trusted number from your statement, official website, or the back of your card. Do not use numbers the caller provides. Ask specific account questions only the real organization would know.

Who to report to

Here are a few examples of the organizations to whom to report such calls:

• United States: Report to the Federal Trade Commission (FTC) and, for internet‑enabled fraud, the FBI’s IC3; also notify your bank and phone carrier.
• United Kingdom: Report to Action Fraud (national fraud reporting center).
• Canada: Report to the Canadian Anti‑Fraud Centre.
• Australia: Report to Scamwatch (Australian Competition and Consumer Commission).

If the scam involves threats, impersonation of police, or possible kidnapping, contact local emergency services immediately and provide the documentation you collected. Also notify your bank or credit card company right away to freeze accounts or reverse transactions.

Keeping calm, documenting details, verifying through official channels, and reporting promptly are the best defenses against impersonation scams.

If you want to discuss the details in more depth, let us know. We’d be happy to help you.

Q4: What is the role of passwords in physical security?

A4:

I received this question from a physical security and safety industry group, who published my answer in their members publication.

Passwords play a critical role in physical security by safeguarding restricted areas, hardware, and personnel from threat actors. Historically the primary credential for secured rooms, computers, and sensitive physical assets, passwords are now often supplemented or replaced by biometrics, PINs, and smart cards. Research since 2021 shows standalone password use in physical access control has declined, now representing 29%–44% of authentication methods depending on region. Still, passwords remain essential in several operational scenarios:

• Legacy infrastructure: Older hardware and lock systems lack biometric or card‑reader compatibilities.
• Remote or harsh environments: Locations such as Antarctic stations, offshore rigs, or jungle sites face unreliable connectivity and weather‑related equipment failures.
• Cost and simplicity: Passwords require no specialized hardware, making them practical for budget‑limited facilities.
• Universal usability: Passwords offer an intuitive, widely understood method for diverse, non‑technical workforces.

In these contexts, passwords continue to protect physical spaces and sensitive activities even as security ecosystems evolve.

We hope you found the previous news items and questions/answers interesting and/or useful! Please send us any other security, privacy and/or compliance questions you have. We thank you for reading the monthly Privacy Professor Tips!

Rebecca will be participating in a panel discussion, “The Great Data Clean Up: How to Reduce Risk Without Losing Business Value” at the InformationWeek virtual event, “The High Stakes Dilemma: Data Protection Strategies for 2026-27” from 2:45 PM - 3:30 PM EDT on Thursday, October 22. Rebecca is looking forward to discussing how data integrity is necessary for effective security and privacy, in addition to supporting compliance with many legal requirements. A key point she will be making will be about the need to engineer security, privacy and safety controls into AI products from the very beginning of product ideation.

NOTE: Dan Swanson recently discussed the need for designing security and privacy controls into products in a round table discussion with Patrick Hayes and Brice Oinksky, “Architecture & Engineering: Building Resilience by Design.” Listen to it as a type of primer for Rebecca’s October 22 event.

We are excited to provide ways for MSPs, law firms, and other professional services organizations to offer our monthly tips to their clients! It is already working well for some such organizations. Get in touch with us for the details!

If you are a HIPAA business associate (BA) have you and the others in your organization taken your HIPAA security and privacy training for the year yet? If you are a HIPAA covered entity (CE), have you checked to ensure your Bas have taken their training? HIPAA requires security and privacy training, and the HHS OCR has indicated in all their HIPAA non-compliance settlements that such training needs to occur at least once a year. We can help you! Take our “HIPAA Basics for Business Associates: 2026 Edition”, which includes many supplemental materials you can use during the course of your business activities. Click here for more information.     

This ½ hour “Secure Coding” lecture by Dr. M.E. Kabay focuses on the importance of secure coding: designing and writing programs that avoid common errors that can interfere with the intended functions of the software with possible harm to users and legal consequences for the software producers. Ensuring sound, secure programming requires both human factors and technical issues, with necessary coordination of systems analysts, designers, coders, and testers. Learners completing the course and passing the quiz will get a certificate documenting this achievement and can apply the associated 0.5 hours of time to most security and privacy certification ongoing learning requirements. Click here for more information.

What topics would you like to see us create videos, and more formal online courses, for? Let us know!

Have questions about our education offerings? Contact us!

View This Newsletter Online

The Privacy Professor | Website

Privacy & Security Brainiacs| Website

Permission to Share



If you would like to share, please forward the Tips message in its entirety. You can share excerpts as well, with the following attribution:

Source: Rebecca Herold. October 2026 Privacy Professor Tips

www.privacysecuritybrainiacs.com.

NOTE: Permission for excerpts does not extend to images.

Privacy Notice & Communication Information

You are receiving this Privacy Professor Tips message as a result of:

1) subscribing through PrivacySecurityBrainiacs.com/Tips or

2) making a request directly to Rebecca Herold or 

3) connecting with Rebecca Herold on LinkedIn. 

When LinkedIn users invite Rebecca Herold to connect with them, she sends a direct message when accepting their invitation. That message states that in the spirit of networking and in support of the communications that are encouraged by LinkedIn, she will send those asking her to link with them her monthly Tips messages. If they do not want to receive the Tips messages, the new LinkedIn connections are invited to let Rebecca know by responding to that LinkedIn message or contacting her at rebeccaherold@rebeccaherold.com. 

If you wish to unsubscribe, just click the SafeUnsubscribe link below.