Source: ZDNET
https://www.zdnet.com/article/most-ai-chatbots-devour-your-user-data-these-are-the-worst-offenders/
Like many people today, you may turn to AI to answer questions, generate content, and gather information. But as they say, there’s always a price to pay. In the case of AI, that means user data. In a new report, VPN and security service Surfshark analyzed what types of data various AIs collect from you and which ones scoop up the greatest amount.For its report, Surfshark looked at 10 popular AI chatbots — ChatGPT, Claude AI, DeepSeek, Google Gemini, Grok, Jasper, Meta AI, Microsoft Copilot, Perplexity, Pi, and Poe. The analysis checked the privacy details for each app on Apple’s App Store as well as the privacy policies for DeepSeek and ChatGPT. The goal was to determine how many types of data each app collects, whether it gathers data linked to you, and whether the app uses third-party advertising.
Also: The best AI chatbots: ChatGPT, Copilot, and notable alternatives
Surfshark focused on 35 different data types, including contact info, health and fitness, financial info, location, sensitive info, contacts, user content, history, identifiers, diagnostics, usage data, and purchases. As one example, sensitive info includes racial or ethnic data, sexual orientation, pregnancy or childbirth information, disability, religious or philosophical beliefs, trade union membership, political opinion, genetic information, or biometric data.
All 10 AI apps collect some type of user data. The average number of data types amassed was 13 out of 35. Some 45% of the apps gather your location. Almost 30% track user data, which means that the information collected from the app is linked with third-party data to deliver targeted ads or share with a data broker.
So, who are the worst offenders?
[…]
ChatGPT and other AI apps and services do provide ways for you to prevent or at least limit the collection of your data. Your best bet is to investigate the privacy policies and settings for any AI you use to see how you can take charge of your own data.
Source: WIRED
https://www.wired.com/story/us-spies-one-stop-shop-private-data/
Plus: A mysterious hacking group’s secret client is exposed, Signal takes a swipe at Microsoft Recall, Russian hackers target security cameras to spy on aid to Ukraine, and more.
This week, WIRED launched our Rogues issue—which included going a bit rough ourselves. WIRED senior correspondent Andy Greenberg flew to Louisiana to see how easy it would be to recreate the 3D-printed gun authorities say they found on Luigi Mangione when they arrested him for the murder of UnitedHealthcare’s CEO. The result? It was both easy and legal.
On Wednesday, US, European, and Japanese authorities announced the disruption of one of the world’s most widely used infostealer malware. Known as Lumma, the malware was used to steal sensitive information from victims around the world, including passwords, banking information, and cryptocurrency wallets details, according to authorities. Microsoft’s Digital Crime Unit aided in the operation, taking down some 2,300 URLs that served as the Lumma infrastructure.
A mysterious database containing more than 184 million records was taken down this week following its discovery by security researcher Jeremiah Fowler. The database contained 47 GB of data, which included information related to Amazon, Apple, Discord, Facebook, Google, Instagram, Microsoft, Netflix, Nintendo, PayPal, Snapchat, Spotify, Twitter, WordPress, Yahoo, and more.
In other news, the US charged 16 Russian nationals for allegedly operating the DanaBot malware, which authorities say was used in a wide variety of attacks, from ransomware to espionage. And a recent webinar revealed how a major venture capitalist helped get Starlink satellite internet activated for Israel following the October 7, 2023 attack by Hamas.
But that’s not all. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.
[…]
Subject: A Starter Guide to Protecting Your Data From Hackers and Corporations
Source: WIRED
https://www.wired.com/story/guide-protect-data-from-hackers-corporations/
Then there are the practical questions. What’s the best password manager? How can you keep your digital life under wraps at the border? And what kind of VPN should you be using? Is AI scraping my data?
WIRED senior writer and security expert Matt Burgess spoke with readers in a Reddit AMA this month about the basics of keeping your digital footprint locked down. Here’s what to know and why it’s important.
…
Source: masslive.com
https://www.masslive.com/westernmass/2025/05/western-mass-diners-fooled-by-fake-doordash-account-posing-as-real-restaurant.html
Western Massachusetts residents placed orders for a local restaurant but when DoorDash drivers arrived, there was no food waiting.The restaurant’s account was a scam.
The Wilbraham Italian restaurant said DoorDash drivers had been showing up to pick up food for the “past couple of nights” looking for orders placed on DoorDash. But those orders don’t exist in the restaurant’s internal ordering system because they don’t work with DoorDash or any other third party delivery services.
“Apparently, some nefarious character decided to create a DoorDash ‘merchant account’ in Cima’s name (using a fictitious email address, no less) and the company never bothered to confirm the validity of said account,” the restaurant wrote on Facebook.
Source: The Intercept
https://www.bespacific.com/us-spy-agencies-are-getting-one-stop-shop-to-buy-your-most-sensitive-personal-data/
The Intercept: “The ever-growing market for personal data has been a boon for American spy agencies. The U.S. intelligence community is now buying up vast volumes of sensitive information that would have previously required a court order, essentially bypassing the Fourth Amendment. But the surveillance state has encountered a problem: There’s simply too much data on sale from too many corporations and brokers. So the government has a plan for a one-stop shop. The Office of the Director of National Intelligence is working on a system to centralize and “streamline” the use of commercially available information, or CAI, like location data derived from mobile ads, by American spy agencies, according to contract documents reviewed by The Intercept.[…]
Filed: https://theintercept.com/technology/
[see also:] IRS, Department of Homeland Security Contracted Firm That Sells Location Data Harvested From Dating Apps – https://theintercept.com/2022/02/18/location-data-tracking-irs-dhs-digital-envoy/
Source: tech.co
https://tech.co/news/third-party-data-breaches-increasing
30% of data breaches that occurred last year involved a third party, new research shows. According to the Verizon 2025 Data Breach Investigations Report, during the year ended October 31, 2024, there were 15% more third-party data breaches than the previous year (15%).Third parties include suppliers, vendors, hosting partners, and IT support providers. These are a mainstay in most businesses, and as the study demonstrates, a growing source of concern from a cybersecurity standpoint.
The report sheds light on the evolving nature of attack vectors, as hackers deploy increasingly sophisticated methods to seize confidential information. With breaches on the rise in general, and businesses failing in their duties to prevent them, the cybersecurity landscape is in a perilous position.
…
Subject: X Funds for Content Creators Went to a Click Farm
Source: Newser + AI
https://www.newser.com/story/369377/x-funds-for-content-creators-went-to-a-click-farm.html
…
Subject: Fannie Mae joins Palantir to launch AI-run mortgage fraud unit
Source: UPI.com
https://www.upi.com/Top_News/US/2025/05/28/Fannie-Mae-Palantir-AI-fraud-crime-unit/5801748463848/
May 28 (UPI) Financial giant Fannie Mae said Wednesday it will launch its AI-powered unit to detect and prevent mortgage fraud in a partnership with AI software company Palantir.
“By integrating this leading AI technology, we will look across millions of datasets to detect patterns that were previously undetectable,” said Fannie Mae’s president and chief executive officer Priscilla Almodovar.
According to Fannie officials, it will not only detect suspicious activity but ultimately will “trigger investigative action.”
Subject: Cybercriminals exploit AI hype to spread ransomware, malware
Source: Bleeping Computer
https://www.bleepingcomputer.com/news/security/cybercriminals-exploit-ai-hype-to-spread-ransomware-malware/
Cisco Talos researchers have discovered that the same technique is now followed by smaller ransomware teams known as CyberLock, Lucky_Gh0$t, and a new malware named Numero.
Tagged:
Source: Krebs on Security
https://krebsonsecurity.com/2025/05/u-s-sanctions-cloud-provider-funnull-as-top-source-of-pig-butchering-scams/
The U.S. government today imposed economic sanctions on Funnull Technology Inc., a Philippines-based company that provides computer infrastructure for hundreds of thousands of websites involved in virtual currency investment scams known as “pig butchering.” In January 2025, KrebsOnSecurity detailed how Funnull was being used as a content delivery network that catered to cybercriminals seeking to route their traffic through U.S.-based cloud providers.“Americans lose billions of dollars annually to these cyber scams, with revenues generated from these crimes rising to record levels in 2024,” reads a statement from the U.S. Department of the Treasury, which sanctioned Funnull and its 40-year-old Chinese administrator Liu Lizhi. “Funnull has directly facilitated several of these schemes, resulting in over $200 million in U.S. victim-reported losses.”
Pig butchering is a rampant form of fraud wherein people are lured by flirtatious strangers online into investing in fraudulent cryptocurrency trading platforms. Victims are coached to invest more and more money into what appears to be an extremely profitable trading platform, only to find their money is gone when they wish to cash out.
Amazon said its Amazon Web Services (AWS) hosting platform actively counters abuse attempts.
[…]
Source: Paul Krugman SubStack
https://paulkrugman.substack.com/p/digital-corruption-takes-over-dc
So why do ordinary people keep buying crypto? Part of the answer is intense marketing; as I mentioned in a recent post, my Venmo app (which is actually useful) is constantly trying to sell me crypto. But the most compelling explanation why people buy crypto is that there is a clear affinity between the psychology of buying crypto and the psychology of gambling. Retail crypto looks, in particular, a lot like the “numbers racket,” which siphoned millions of dollars from generations of working-class Americans until it was largely supplanted by state lotteries.
The numbers racket was illegal, but flourished anyway because the criminal organizations paid off police and politicians.
But they were pikers by today’s standards. According to Public Citizen, crypto companies accounted for almost half of all corporate spending during the 2024 election. Donald Trump and his family have made billions off the $Trump and $Melania “meme coins,” but I wouldn’t be surprised to learn that other politicians have also been the beneficiaries of crypto largesse.
What is a stablecoin? It’s a digital token like Bitcoin — that is, an asset that “belongs” to whoever has the secret numerical key that unlocks it. But unlike Bitcoin, whose value in dollars fluctuates wildly day to day, a stablecoin is supposed to retain a fixed value in dollars. The stablecoin issuer maintains that stability by standing ready to buy its tokens back, holding reserves of conventional assets like Treasury bills for that purpose.
One way to think about this is that stablecoin issuers are like banks back in the days before the Civil War, when gold and silver coins were the only official forms of money. Many banks issued paper currency, which they promised to redeem for gold and silver coins on demand. Similarly, stablecoin firms issue tokens that they promise to redeem for dollars.
Today, however, the federal government is deeply involved in banking, for very good reasons. After the devastating bank runs of the 1930s, in particular, officials realized that they needed to guarantee the value of deposits via the FDIC, while at the same time requiring banks to limit the kinds of risks they take. The goal was to limit the risk of financial crisis. While we did have a nasty crisis in 2008, that mostly involved “shadow banks” that evaded precautionary regulation. And stablecoins are, among other things, a new kind of shadow bank.
The fundamental point is that the growth and legitimation of stablecoins poses new risks to overall financial stability — all in the name of making it easier for criminals to do their business.
