Morning Cyber Alert: GM agrees to 1275M California settlement over sale of drivers data

12 May 2026

So I was scrolling my feeds earlier and this headline stopped me dead — GM agrees to 1275M California settlement over sale of drivers data. And honestly? It pissed me off. Not in a dramatic “world’s ending” way, but in that specific “we’re still doing this?” kind of way. If you follow cybersecurity at all, you know exactly what I mean.

We keep patching, updating, training employees, buying fancy tools… and yet the same attack vectors keep reappearing like uninvited guests at a party. Today’s roundup is a perfect example. We’ve got everything from social engineering to supply-chain hijacking, all wrapped up in one neat little package of bad news. FYI, buckle up. 🙂

Before you grab another cuppa, let me break down what’s actually going on — because most news sites just throw facts at you and call it a day. I’m here to give you the why it matters and what you should actually do bits.

The big story: GM agrees to 1275M California settlement over sale of drivers data

Let’s start with the headline everyone’s sharing: GM agrees to $12.75M California settlement over sale of drivers’ data. On the surface, it’s just another security report. Beneath the surface though, there’s a lot more going on.

Here’s what actually happened. According to BleepingComputer:

Right. So why should you care personally? Because this isn’t a “big banks only” problem. These threats cascade down. IMO, the scariest part isn’t the headline — it’s what the headline represents.

Breaking down the attack vector

Initial access: How did they get in? Phishing? Weak credentials? An unpatched system sitting there like an open window?
Lateral movement: Once inside, did they move quietly or go loud? Most orgs don’t detect lateral movement for weeks or months.
Payload delivery: Was it ransomware? A backdoor? Data exfiltration? The type of payload tells you the motive.
Impact: Data theft, financial loss, reputational damage, or all three? Every breach has a ripple effect.

Ever wondered why attackers keep using the same old tricks? Simple answer: they keep working. We build castles and they just stroll through the front door with a convincing email. It’s embarrassing, but it’s reality.

What the experts aren’t saying loudly enough

Most cybersecurity coverage reads like a press release. “Company X was breached. Sensitive data may have been compromised. They’re investigating.” Great. Very helpful. :/

What they rarely talk about is the cultural problem. The CFO who refuses MFA because it “takes too long.” The intern with admin rights because “it’s easier that way.” The unpatched server that everyone knows about but nobody owns.

If I ran your IT department, I’d start with a brutally honest risk assessment. Not the checkbox kind — the kind where you actually look at your attack surface and want to cry a little bit. Because pretending everything’s fine is how you end up as the next headline.

Story 2: iOS 265 Brings Default End-to-End Encrypted RCS Messaging Be…

This one’s from The Hacker News and it caught my attention for a different reason. iOS 26.5 Brings Default End-to-End Encrypted RCS Messaging Between iPhone and Android. Let me give you the TL;DR first, then the rant.

Now, on its own this might not seem huge. But step back and look at the pattern. We’re seeing the same things over and over:

Trust exploitation: Attackers don’t break encryption — they break trust.
Speed over security: DevOps teams shipping code faster than security teams can review it.
Tool fatigue: Buying more tools instead of using the ones you already paid for properly.
Posture drift: Your security posture was great in January. It is not great anymore.

I’ve watched companies spend six figures on a shiny new SIEM, only to learn nobody configured the alerts properly. That’s not a technology problem — that’s an ego problem. FYI, the best security tool in the world is useless if your team ignores it.

Story 3: FCC Softens Ban on Foreign-Made Routers

This one’s from Dark Reading and it caught my attention for a different reason. FCC Softens Ban on Foreign-Made Routers. Let me give you the TL;DR first, then the rant.

The Federal Communications Commission eased some restrictions and pushed back deadlines for foreign router manufacturers, but the ban is still in place.

Now, on its own this might not seem huge. But step back and look at the pattern. We’re seeing the same things over and over:

Trust exploitation: Attackers don’t break encryption — they break trust.
Speed over security: DevOps teams shipping code faster than security teams can review it.
Tool fatigue: Buying more tools instead of using the ones you already paid for properly.
Posture drift: Your security posture was great in January. It is not great anymore.

What’s the real picture here?

If there’s one thing these stories have in common, it’s that attacks are getting quieter, more targeted, and more creative. The days of mass ransomware spam are still around, but the real money is in the quiet breaches. The ones you don’t notice for six months. The ones that slowly exfiltrate data while your monitoring dashboards show happy green lights.

Think about your own org for a second. When was your last table-top exercise? When did someone actually test your incident response plan? Not read it — test it. Most businesses can’t answer that, and that’s terrifying.

The threat landscape isn’t getting worse — it’s getting smarter

We’re not dealing with bored teenagers anymore. We’re dealing with:

Ransomware cartels running like businesses with HR departments and onboarding.
State-sponsored actors who don’t want your money — they want your intellectual property.
Supply-chain attackers who know it’s easier to poison the upstream than breach the castle directly.
AI-assisted phishing that writes more convincing emails than your sales team.

And here’s the bit nobody wants to say out loud: a lot of organisations are not ready. They have policies that look good on paper, but the minute someone runs a basic phishing simulation, it falls apart. The user clicks the link. The password gets typed in. The attacker has a foothold.

It’s not about being perfect. It’s about being prepared. Can you detect an intrusion in minutes rather than months? Can you isolate a compromised system before it spreads? Can you recover without paying a ransom? Those are the questions that matter.

So what should you actually do?

Right, enough doom and gloom. Let’s talk about practical steps. Not the “enable MFA and call it done” advice — the stuff that actually moves the needle.

Immediate wins (this week)

Audit your privileged accounts. Who has domain admin? Why? When did you last review that list?
Enable MFA everywhere. Yes, everywhere. No exceptions. Not even for the CEO.
Patch your public-facing assets. Your VPN appliance, your email gateway, your web server. If it’s on the internet and unpatched, it’s a ticking clock.
Test your backups. Actually restore something. If you can’t do a full restore from backup in under two hours, your backups aren’t real.
Check your logging coverage. Are you logging DNS requests? Auth events? File access? If logs don’t exist, detection doesn’t exist.

Medium-term improvements (this month)

Segment your network. If a phishing email compromises a workstation, can it reach your domain controller? If yes, fix that.
Deploy EDR properly. Not just installed — tuned, monitored, and staffed. An EDR nobody watches is just expensive decoration.
Run a phishing simulation. Then train the people who failed. Then run another one. Repeat until your click rate drops below 5%.
Review third-party access. That vendor with a VPN tunnel from 2019? They have the same access as your IT team. That should terrify you.
Document your incident response plan. Not in a Word doc that nobody reads — in a format your team can follow at 3am when everything is on fire.

Look, I’m not saying this is easy. Cybersecurity is hard. It costs money, it takes time, and it requires actual organisational commitment. But the alternative — becoming the next headline — is a lot more expensive.

The bottom line

So there you have it. Another day, another round of breaches, attacks, and reminders that we can’t just coast on good intentions. Cybersecurity is a full-contact sport — sitting on the sidelines isn’t an option.

Here’s the thing though — if you’re reading this, you’re already ahead of the game. Most people don’t even think about this stuff until it’s their credit card on the dark web. So give yourself credit for that. Then go patch something. 🙂

Stay patched. Stay paranoid. Stay curious. I’ll see you in the next brief.

Breaking

Morning Cyber Alert: GM agrees to 1275M California settlement over sale of drivers data