Archive security incidents
xz-utils Backdoor (CVE-2024-3094) (Archive)
A build-time backdoor in liblzma, planted through a multi-year social engineering campaign against a single maintainer, and caught by a performance regression.
Public record archive
Privacy and security archive
Short, source-linked records of incidents, laws, research, surveillance, and censorship. Each entry shows what is documented and what still needs review.
Browse by category
Data Breaches 2 entries
Confirmed incidents in which personal data was exposed, with the affected data described as the reporting organisation described it. Surveillance 2 entries
Documented state or corporate collection of information about people, including bulk collection programmes. Censorship 2 entries
Government or operator blocking, filtering or throttling of services and content. Security Incidents 6 entries
Vulnerability disclosure, exploitation of widely deployed software, and systemic compromise. Privacy Laws 5 entries
Legislation, regulation, and binding court decisions, tracked by the date they took effect. Corporate Privacy 2 entries
Material changes to how a company collects, retains or shares data, sourced to company disclosures. Government Documents 2 entries
Primary documents released by public bodies: reports, orders, declassified records and FOI responses. Research Papers 2 entries
Peer-reviewed and preprint research that changed how a technique is understood.
Latest entries
Archive privacy laws
EU Digital Services Act (Regulation 2022/2065) (Archive)
The EU framework for online intermediaries, including conditional liability exemptions, notice and action duties, and restrictions on targeted advertising to minors.
Archive privacy laws
California Consumer Privacy Act as amended by the CPRA (Archive)
The CCPA and the California Privacy Rights Act, and the rights they created for California consumers.
Archive security incidents
Log4Shell (CVE-2021-44228) (Archive)
A remotely exploitable JNDI lookup in Apache Log4j 2, the disclosure-to-exploitation window, and the supply chain behind it.
Archive security incidents
Colonial Pipeline Ransomware Attack (Archive)
The 7 May 2021 ransomware attack on the operator of the largest US fuel pipeline, the ransom payment, and the recovery of most of it.
Archive corporate privacy
Apple App Tracking Transparency (Archive)
Apple introduced a permission requirement for app tracking across companies and access to the advertising identifier.
Archive security incidents
SolarWinds SUNBURST (Archive)
A malicious update distributed through SolarWinds Orion, attributed publicly to a named threat actor, and the disclosure that followed.
Archive privacy laws
US State Privacy Laws (Archive)
The wave of US state comprehensive privacy statutes from 2020, and what differs between them.
Archive data breaches
Marriott Starwood guest database breach (Archive)
A compromise of the Starwood guest reservation database was disclosed by Marriott after its acquisition of Starwood.
Archive privacy laws
Schrems II (Case C-311/18) (Archive)
The Court of Justice judgment that invalidated the EU-US Privacy Shield and required a case-by-case assessment of transfers to the United States.
Archive privacy laws
General Data Protection Regulation (EU) 2016/679 (Archive)
The EU data protection regulation, its scope, and the obligations it created for organisations that process personal data.
Archive data breaches
Equifax 2017 data breach (Archive)
A 2017 intrusion into Equifax systems exposed personal information held by the credit reporting company.