October 2026 showed how quickly personal data can be exposed, repurposed, or placed beyond users’ control. Capcom confirmed that information linked to more than 11.7 million CAPCOM ID accounts was exposed, while Japan’s Nikkei disclosed its third data breach in a month. Google updated its privacy policy so that Gmail and Photos data shared with its AI features can inform targeted ads, and EU governments moved to allow companies to train AI on personal data under a “legitimate interest” basis rather than explicit consent. In the US, a federal court ruled that automakers can lawfully intercept your texts the moment you connect your phone. But there were wins too: a New Mexico judge ordered Meta to pay a record $25 billion over Cambridge Analytica, California restricted AI-powered emotion surveillance in the workplace, and European regulators urged smart-glasses makers to build in clear, hard-to-disable recording indicators. Here’s what happened this month.
Breaches & Security
⬇ Capcom ID Breach Exposes 11.7 Million Accounts: Capcom confirmed that attackers accessed email addresses, dates of birth, and display names from its CAPCOM ID platform.
⬇ Nikkei Discloses Third Data Breach in a Month: Japan’s financial media group reported a third breach exposing 1.83 million records through compromised cloud credentials.
⬇ Critical PHP Vulnerabilities Force Emergency Patching: Two remote code execution flaws in PHP triggered emergency patches after active exploitation was detected.
AI
⬇ Meta AI Glasses Recording Without Wake Phrase: Meta admitted its Ray-Ban smart glasses were recording conversations without the “Hey Meta” trigger, prompting a class action lawsuit.
⬆ California Bans AI Workplace Emotion Surveillance: Governor Newsom signed AB 1883 and SB 947, banning employers from using AI to monitor workers’ brain activity and emotions.
⬇ Google Opens Gmail and Photos Data to Ad Targeting: Google updated its privacy policy to let Search and Gemini use content from Gmail, Drive, and Photos to personalise ads when users enable the Personal Intelligence feature.
Government, Surveillance & Regulatory
⬇ EU Governments Approve GDPR Change for AI Training Without Consent: EU member states backed a proposal making AI training a possible “legitimate interest” under the GDPR, bypassing consent requirements.
⬇ Connected Cars as Surveillance Platforms: A federal court ruled that automakers can lawfully intercept your texts, and Schneier’s Crypto-Gram detailed how modern vehicles collect everything from GPS to biometric data with minimal regulatory oversight.
⬆ EDPB Calls for Mandatory Recording Indicators on Smart Glasses: The European Data Protection Board urged manufacturers to build visible and audible recording signals into smart glasses.
⬆ Meta Ordered to Pay $25 Billion Over Cambridge Analytica: A New Mexico judge found Meta liable for more than 43 million violations of state consumer-protection law in the Cambridge Analytica case.
⬆ Japan PM Orders Emergency Cybersecurity Countermeasures: Japan’s Prime Minister directed emergency measures after a string of breaches affecting millions of citizens.
Capcom ID Breach Exposes 11.7 Million Accounts
Capcom confirmed on 21 October that its CAPCOM ID online platform was breached, exposing email addresses, dates of birth, and display names for approximately 11.7 million accounts. The company said no passwords, payment details, or credit card data were taken, but the scale of the breach makes it one of the largest gaming-industry incidents this year. Capcom reset all affected account passwords and urged users to change credentials on any service where they reused their CAPCOM ID password.
💡 To protect yourself, check whether your email appeared in the breach using a service like Have I Been Pwned. If you reused your CAPCOM ID password anywhere else, change it immediately and enable two-factor authentication wherever it is available. A password manager can help you generate and store unique passwords for every account.
Continue reading: Capcom Data Breach Exposes 11.7 Million Account Records (Help Net Security)
Nikkei Discloses Third Data Breach in a Month
Japan’s Nikkei group reported its third data breach in October, this time affecting 1.83 million records after attackers gained access through compromised cloud credentials. The exposed data included subscriber names, email addresses, and service-usage history. Nikkei had already disclosed two smaller breaches earlier in the month, raising serious questions about the company’s security posture and incident-response capabilities.
💡 To stay prepared, review the accounts and services you have registered with Nikkei or any frequently breached organisation. Where possible, use unique email aliases for different services so that a breach at one does not give attackers a foothold across your digital life. Mailfence’s alias feature lets you create dedicated addresses for different accounts.
Learn more: Nikkei Discloses Third Data Breach in a Month, 1.8M Records Exposed (BleepingComputer)
Critical PHP Vulnerabilities Force Emergency Patching
The PHP Foundation released emergency patches for two critical remote code execution flaws, dubbed “PHP2Shell”, after researchers detected active exploitation in the wild. The vulnerabilities affected PHP versions 8.2 through 8.5 and allowed attackers to run arbitrary code on unpatched servers. Government agencies and major companies were forced to take services offline while applying the fix, and proof-of-concept exploit code began circulating shortly after disclosure.
💡 To limit your exposure, ensure any PHP-based applications and web servers you manage are running the latest patched versions. Organisations should audit their PHP deployments and apply updates without delay. If you run a website or web application built on PHP, contact your hosting provider to confirm the patches have been applied.
Read more: PHP Ships Emergency Patches for Critical PHP2Shell Flaws (BleepingComputer)
Learn more: PHP2Shell Vulnerability: Your Mailfence Account Is Safe (Mailfence Blog)
Meta AI Glasses Recording Without Wake Phrase
Meta admitted that its Ray-Ban Meta smart glasses were recording audio and video even when the user had not spoken the “Hey Meta” wake phrase. The company attributed the issue to a software bug that triggered passive recording in certain conditions. A class action lawsuit was filed in a California federal court, alleging that Meta violated wiretapping and privacy laws by capturing bystanders’ conversations and images without consent.
💡 To mitigate risks, if you own Meta smart glasses, check for the latest firmware update and review your device’s recording settings. Be aware that bystanders near anyone wearing smart glasses may have limited control over what is captured, and consider raising the topic in workplaces or social settings where privacy expectations are high.
Learn more: Meta AI Glasses Recording Without “Hey Meta” Class Action Lawsuit (Open Class Actions)
California Bans AI Workplace Emotion Surveillance
Governor Gavin Newsom signed AB 1883 and SB 947 into law, making California the first US state to ban employers from using AI to monitor workers’ brain activity, emotional states, and nervous-system data. The laws cover wearable neurotech devices, sentiment-analysis cameras, and stress-tracking software. Employers that violate the ban face penalties and potential civil action from affected workers.
💡 To take advantage of these new protections, California employees should familiarise themselves with the rights created by AB 1883 and SB 947. If your employer deploys AI-based monitoring tools that analyse emotions or biometric data, you may have grounds to file a complaint with the California Labor Commissioner.
Continue reading: California Bans Using AI to Monitor Workers’ Brains, Emotions (Bloomberg Law)
Google Opens Gmail and Photos Data to Ad Targeting
Google quietly updated its privacy policy on 16 October to create an exception to its long-standing rule that Gmail, Google Drive, and Google Photos content would not be used for ad targeting. The change applies when users connect those services to Google’s AI features, including Search and Gemini Apps, through Personal Intelligence. Search may then process the connected data to personalise content, including ads. Previously, Google maintained a clearer line: it did not use Gmail, Drive, or Photos content to show personalised ads. That line is now conditional. The revised policy states that Google will not personalise ads from these services “unless you choose to make data from these services available to other Google services that support personalised ads.”
💡 To protect yourself, review your Google account’s Personal Intelligence settings under “Connected Content apps” in Data & Privacy, and disconnect any services you do not want feeding into ad targeting. You can also turn off Personalised Recommendations in your Search settings. Note that previously collected data may remain in your Search history even after you disconnect. If you value email privacy, consider using an end-to-end encrypted provider like Mailfence that does not scan your messages for advertising purposes.
Read more: Google Says Gmail and Photos Data Can Now Influence Targeted Ads (The Hacker News)
Continue reading: Google Quietly Updates Privacy Policy So Gmail and Photos Could Shape Ads (Decrypt)
EU Governments Approve GDPR Change for AI Training Without Consent
EU member states approved a proposed change to the GDPR that would make AI training a possible “legitimate interest”, allowing companies to process Europeans’ personal data without explicit consent. The change is part of the broader “Data Omnibus” legislative package and would be assessed on a case-by-case basis but marks a major shift in how the regulation treats AI development.
Privacy campaigner Max Schrems called the proposal a “digital expropriation” of European citizens’ data, and his organisation noyb warned that it could effectively bypass core GDPR protections. The European Parliament must still approve the change, and civil-society groups are mobilising to fight it. If adopted, it would give companies like Meta, Google, and OpenAI a legal basis for training on Europeans’ personal data that currently requires consent or a narrow exemption.
💡 To engage with these developments, EU residents can contact their MEPs to make their views on AI training and personal data known before the Parliament vote. Review the privacy settings on any platform where your data might be used for model training, and exercise your right to opt out of data processing for AI purposes where that option is currently offered.
Learn more: EU Proposal Could Let AI Companies Train on Europeans’ Data by Default, Noyb Warns (Cybernews)
Connected Cars as Surveillance Platforms
A federal court ruled that Honda, Toyota, Volkswagen, and General Motors can lawfully record and intercept private text messages and call logs the moment a driver connects a phone to the vehicle’s infotainment system. The court found that users implicitly consent to the data collection by pairing their devices. Privacy advocates argued the ruling sets a dangerous precedent, as most drivers do not realise that connecting a phone grants the manufacturer access to personal communications.
The ruling landed alongside a broader warning from Bruce Schneier, whose October Crypto-Gram highlighted how connected vehicles have become full-scale surveillance platforms. Today’s cars collect real-time GPS location, driving behaviour, biometric data from cabin sensors, and even audio from in-car microphones, with much of this information shared with manufacturers, insurers, and third-party data brokers. Schneier argued that the regulatory framework has not kept pace with the data-collection capabilities now built into every new vehicle.
💡 To limit your exposure, review your vehicle’s privacy settings and data-sharing options, which are often buried in the infotainment menu. Consider using Bluetooth audio-only mode rather than a full phone connection, and disable telemetry and location sharing where the option exists. Be cautious about connecting your phone to rental or shared vehicles, as personal data can persist on the infotainment system long after you return the car.
Continue reading: Court Rules Automakers Can Record and Intercept Owner Text Messages (The Record)
Learn more: Connected Cars Are a Surveillance Platform (Schneier on Security)
EDPB Calls for Mandatory Recording Indicators on Smart Glasses
The European Data Protection Board published guidelines calling on smart-glasses manufacturers to build in visible LED indicators and audible alerts that activate whenever a device is recording. The EDPB argued that manufacturers cannot rely on the wearer alone to notify bystanders and that technical safeguards must be designed into the hardware. The guidelines apply to any smart eyewear sold or used in the EU and could influence upcoming product designs from Meta, Google, and others.
💡 To stay informed, if you are developing or deploying smart-glasses technology in Europe, review the EDPB’s guidelines and assess whether your products meet the recommended standards. For everyday users, this is a positive signal that regulators are pushing for privacy by design in wearable technology.
Learn more: Statement 1/2026 of the EDPB on smart glasses (EDPB)
Meta Ordered to Pay $25 Billion Over Cambridge Analytica
A New Mexico judge ordered Meta to pay $25 billion in penalties after a jury found the company liable for more than 43 million violations of the state’s Unfair Practices Act in connection with the Cambridge Analytica scandal. The ruling represents the largest privacy-related penalty ever imposed on a technology company. Meta said it would appeal.
The case centred on allegations that Facebook misled users about how their personal data was collected, shared, and used for political profiling. The record-breaking penalty signals that US courts are increasingly willing to hold technology companies accountable for data-privacy failures. While the final amount may be reduced on appeal, the precedent strengthens the hand of state attorneys general and consumers in future privacy litigation.
💡 To take advantage of this development, check whether you are eligible for any restitution or class membership arising from the ruling. More broadly, review and tighten the privacy settings on your social-media accounts, and consider limiting the personal information you share on platforms that have a history of data mishandling.
Read more: Judge Orders Meta to Pay $25 Billion for Violating New Mexico Law in the Cambridge Analytica Data Breach (ABC News)
Japan PM Orders Emergency Cybersecurity Countermeasures
Japan’s Prime Minister ordered emergency cybersecurity measures in October after a wave of data breaches affecting millions of citizens, including the repeated Nikkei incidents covered above. The government directed critical infrastructure operators to conduct immediate security audits and report vulnerabilities and announced plans to accelerate the rollout of active cyber-defence operations.
💡 To stay prepared, organisations operating in Japan or partnering with Japanese companies should expect tighter cybersecurity requirements in the coming months. Individuals can check the Japan CERT website for advisories and ensure their own online accounts are secured with strong, unique passwords and two-factor authentication.
Continue reading: Japan Steps Up Cyber Warnings as Data Leaks Hit Millions of Customers (The Next Web)
Recommended Reading
- Crypto-Gram October 2026 (Schneier on Security)
- List of Recent Data Breaches in 2026 (Bright Defense)
- Cybersecurity & Privacy News and Analysis (Law360)
- Which Private AI Assistant Actually Keeps Your Chats Private? (Mailfence Blog)
- Why Am I Not Getting Emails on My iPhone? 8 Fixes (Mailfence Blog)
That’s All for This Month’s Newsletter!
October 2026 made one thing clear: data is being collected from every angle, whether through breached gaming platforms, car infotainment systems, smart glasses that record without warning, or email inboxes quietly opened to ad networks. The positive developments this month remind us that accountability is possible: a $25 billion penalty, new state laws banning AI emotion tracking, and European regulators insisting on privacy by design in wearable technology. The question is whether these wins can keep pace with the threats. Stay informed, review your settings, and never assume that any device or service is collecting less than it can.
Best,
Patrick
Get the latest privacy news in your inbox
Sign up to the Mailfence Newsletter.
