news

The American Institute of CPAs and Artificial Intelligence Underwriting Company announced a joint assurance offering on October 19 that combines a SOC 2 report and AIUC-1 certification through one CPA-led engagement. Several CPA firms are already conducting initial engagements, with a full launch expected in early 2027 after that work concludes.The offering combines an examination…

SOC 2 plays an important role in how businesses demonstrate security controls and evaluate the companies they trust with sensitive information. Changes in audit guidance, reporting practices, and customer expectations affect both organizations pursuing reports and those relying on them.Headlines about disputed audit reports, AI-related guidance, and increased auditor scrutiny raise questions about how SOC…

An experimental OpenAI agent gained unauthorized access to Services Australia’s Medicare Statistics Reporting Service on June 18, 2026, reached files that were never meant to be public, and wrote files to an internal server.The agent was running inside an internal OpenAI evaluation, researching government spending on skin-condition medicines in Victoria, when it worked around the…

A breach of the Pentagon’s Defense Manpower Data Center (DMDC) exposed personal information belonging to approximately 3.054 million people, including 2.76 million living individuals and 294,000 deceased individuals, according to a defense official cited by ABC News. The reported figures include people connected to the military, rather than 3 million active-duty service members.Unauthorized access occurred between…

Helpfeel, the Kyoto-based operator of the Gyazo screenshot and screen-recording service, confirmed that an attacker exploited a vulnerability in Gyazo’s image upload server on September 11, 2026 and reached the service’s database.The breach exposed approximately 23.62 million user records, metadata for approximately 490 million images, and metadata tied to approximately 174 million images users had…

Updated September 21, 2026The Canvas breach is a cybersecurity incident involving unauthorized access to information in Instructure’s learning management system. Exposed data categories include usernames, email addresses, course names, enrollment information, and messages. A learning management system, or LMS, provides online tools for teaching, coursework, and academic communication. Instructure detected the first intrusion on April 29,…

Updated September 21, 2026The IDScan breach involves potential unauthorized access to identity information stored in customer accounts on IDScan.net’s cloud platform. The company published its security notice on September 4, 2026, identifying names and government-issued identification numbers as potentially affected information. Check: IDScan.net incident notice.Nexus advertised more than 153 million driver’s license records. However, this…

ISO 42006:2025 is tightening the rules for organizations that audit and certify ISO 42001 Artificial Intelligence Management Systems, adding AI-specific competence requirements, structured audit-time calculations and stronger expectations for certification decisions. Published on July 7, 2025, the standard is now moving into accreditation programs during 2026 as demand for credible AI certification grows.The change affects certification…

Illinois HB 3773 has been enforceable since January 1, 2026, yet employers still have no final regulations telling them how to deliver the notices the law demands. Signed as Public Act 103-0804 on August 9, 2024, the amendment to the Illinois Human Rights Act bars artificial intelligence that has the effect of discriminating on protected…

ISO 27001 has changed in recent years, but there is no new ISO 27001:2026 edition. Organizations pursuing or maintaining certification in 2026 must follow ISO 27001:2022 and its 2024 climate action amendment.The latest available data shows continued global interest in the standard. The ISO Survey 2024 reported 96,709 valid ISO 27001 certificates covering 179,877 sites.…