Apple to Scan Publicly Shared iCloud Photos and Files for Harmful Content

PUODO Fines Poznań Logistics University PLN 64,652 for Inadequate GDPR Risk Analysis

The Polish data protection authority PUODO has imposed a fine of 64,652 zł on Wyższa Szkoła Logistyki w Poznaniu for failing to conduct proper risk assessments and implement sufficient technical and organizational measures under GDPR. The violation came to light after a staff member accidentally shared a file containing personal data of 964 students via the university's online deanery platform. The file was accessed by 125 out of 388 authorized users and downloaded 361 times. PUODO found that the university's risk analysis ignored risks such as accidental data disclosure, even after the incident occurred. The authority also referenced a prior high-profile case involving ING Bank Śląski, which received an 18.4 million zł fine later upheld by the courts. The university was ordered to update its processing operations to minimize data protection risks. President Mirosław Wróblewski emphasized the need for accountability and confidentiality in handling student records.

Format-Preserving Permutation Replaces Uniqueness Checks for Duplicate-Free Data Masking in PostgreSQL

A team developing a data masking service for PostgreSQL and SQL Server has replaced random or hash-based replacement with keyed permutations built on Feistel networks. The approach guarantees uniqueness within each format class without checking the target table, preserves referential integrity across tables, and remains fully deterministic and reproducible. Values are decomposed into fixed, variable, and checksum fields; only the variable portion is permuted inside its numeric range using an eight-round Feistel construction with AES as the round function, followed by cycle-walking when the result exceeds the original domain size. The method supports mixed-radix classes such as IBAN, SNILS, IMEI, and email addresses while keeping control digits valid. Because the construction is non-standard, the authors explicitly warn that it provides pseudonymization rather than irreversible anonymization.

Personal AI Assistants Build Detailed Profiles on Friends and Family Raising Privacy Concerns

The latest generation of personal AI agents such as Muse from Meta and Dots from OpenAI are gaining deep access to user emails, messengers, and financial accounts while autonomously collecting data. Security researchers discovered that Muse, internally referred to as Hatch, stores memory in Markdown files under ~/memory/ and runs hourly background tasks that create individual profile pages for every person connected to the user. These profiles include sections on Facts, History, Relationships, Open Topics, and Strengthening, populated only with verified details such as addresses, recurring themes, important dates, and relationship dynamics. The agents operate with root privileges on Ubuntu by default and maintain separate directories for 113 sub-agents along with a PostgreSQL-backed search system and nightly dream processes. Data collection extends to individuals who never installed the agent, supplementing existing social graphs maintained by major technology companies. An isolated virtual machine architecture developed with assistance from Signal creator Moxie Marlinspike is intended to limit cross-agent communication and allow users to erase memory at any time.