Loading story…
The Federal Trade Commission (FTC) has initiated legal action against Hunter Rice, CEO of Iconic Hearts Holdings, the parent company of the anonymous messaging app Sendit, for alleged violations of child privacy laws and deceptive business practices. According to a civil complaint filed by the Department of Justice, Sendit collected personal information from children under the age of 13 without obtaining parental consent, in direct violation of the Children’s Online Privacy Protection Rule (COPPA). The data collected included phone numbers, usernames, photos, and birth dates associated with accounts on platforms such as TikTok, Snapchat, and Instagram. The FTC asserts that Sendit’s operators were fully aware that a significant portion of their user base consisted of children under 13, as evidenced by self-reported ages and complaints from parents. In 2022 alone, 116,000 users reportedly indicated they were under 13. Despite this knowledge, the company failed to implement the required parental notification and consent mechanisms mandated by COPPA. In addition to privacy violations, Sendit is accused of manipulating users, including children, into subscribing to paid services through deceptive means. The app allegedly sent fake messages from non-existent individuals and promised to reveal the identities of message senders, a promise it did not fulfill. Users were required to pay for subscriptions to access these features, but the terms of the subscription plans were not clearly disclosed. The FTC claims that these practices also violated the Restore Online Shoppers' Confidence Act and the FTC Act. The agency’s Bureau of Consumer Protection Director, Christopher Mufarrige, emphasized that the company’s leadership was aware of the underage user base and still chose to disregard legal requirements. The complaint highlights that the company’s actions not only breached privacy laws but also exploited children’s trust for financial gain. The FTC’s lawsuit seeks to hold both the company and its CEO accountable for these alleged violations. The case underscores the ongoing regulatory scrutiny of apps targeting or attracting children, particularly regarding data privacy and ethical monetization practices. The outcome of this lawsuit could have significant implications for other technology firms operating in the youth market. Iconic Hearts Holdings has not publicly responded to the allegations at this time. The FTC’s enforcement action serves as a warning to other app developers about the importance of compliance with child privacy regulations. The case also raises broader concerns about the transparency of subscription models in apps popular with minors. Legal experts suggest that the FTC may seek both financial penalties and injunctive relief to prevent future violations. The Sendit case is part of a broader trend of increased regulatory focus on protecting children’s data online.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
The U.S. Federal Trade Commission alleged that messaging app Sendit and its CEO violated the Children’s Online Privacy Protection Rule by collecting children’s data without proper consent and using deceptive practices tied to subscriptions and in-app engagement. Multiple reports describe the action as an FTC lawsuit or complaint filed in late September 2025.
4 references tracked. Mallory keeps watching after this page renders.
malwarebytes.com
Open sourcebankinfosecurity.com
Open sourcescworld.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Federal Trade Commission, joined by California and Utah, sued telehealth provider **Hims & Hers** over allegations that it disclosed sensitive patient and health-related information to advertising and technology platforms including **Meta** and **Snap** while representing that it protected user privacy. Regulators say the company used tracking pixels and similar tools from multiple third parties, including Microsoft, Pinterest, Reddit, and X, to collect and transmit users’ website activity and health-related data without adequate disclosure or consent. The complaint also alleges broader consumer protection violations, including charging some users before medical consultations and making subscription cancellations unnecessarily difficult, leading to recurring charges. Hims & Hers said its privacy policy explains users’ choices regarding data use and that it plans to contest the allegations, while the case adds to growing enforcement pressure on telehealth and healthcare firms over the use of advertising trackers on services handling sensitive medical information.
Jul 31, 2026
The Federal Trade Commission (FTC) has taken enforcement action against *Illuminate Education*, an educational technology provider, following a significant data breach in December 2021 that exposed the personal information of over 10 million students. The breach occurred when a hacker exploited credentials belonging to a former employee who had left the company more than three years prior, gaining access to sensitive data such as email addresses, dates of birth, student records, and health information stored in cloud-based databases. The FTC alleged that Illuminate misrepresented its security practices to customers and school districts, including false claims about data encryption and inadequate access controls, threat detection, and vulnerability management. As part of the settlement, Illuminate Education is required to implement a comprehensive data security program and delete unnecessary data. The company had previously settled with three state attorneys general for $5.1 million and agreed to a corrective action plan. The FTC emphasized that companies handling children's data will be held accountable for failing to uphold privacy and security commitments, especially when sensitive information like medical diagnoses is involved. Illuminate was also criticized for storing student data in plain text and for delayed notification to affected school districts about the breach.
Jul 12, 2026
A recent large-scale analysis of 50,000 mobile applications has revealed that over 77% of these apps leak personally identifiable information due to insecure data handling and insufficient privacy controls. The study found that many iOS applications fail to include required privacy manifests, while Android apps often circumvent explicit data-safety disclosures, creating significant blind spots in user privacy protections. These vulnerabilities are particularly concerning given the central role mobile devices play in daily communications and financial transactions, making users susceptible to tracking, profiling, and data theft. The research underscores the systemic nature of privacy risks in the mobile app ecosystem, with both platforms exhibiting gaps in transparency and compliance. In parallel, regulatory efforts to protect minors online are introducing new privacy challenges, as exemplified by Texas's SB 2420 law, which mandates age assurance for app store users and developers. Apple has voiced strong concerns that such laws require the collection and storage of sensitive personal information, such as government IDs, even for benign app downloads, thereby increasing the risk of data breaches. Starting January 1, 2026, Apple will require new account holders to confirm they are over 18, and minors will need parental consent for app downloads and purchases, further expanding the amount of sensitive data collected. Apple argues that these requirements should be limited to apps where age verification is truly necessary, warning that blanket mandates could have unintended privacy consequences. The complexity is heightened by the patchwork of state-level laws, with similar regulations set to take effect in Utah and Louisiana, compelling developers to adapt to varying compliance standards. The risks of such data collection are not theoretical; a recent breach at a third-party provider for Discord, which handled age verification, resulted in the exposure of sensitive government ID images. This incident illustrates the tangible dangers of accumulating large repositories of personal data for regulatory compliance. The convergence of insecure app data practices and regulatory-driven data collection amplifies the threat landscape for mobile users. Both industry and regulators face the challenge of balancing user safety, especially for minors, with the imperative to minimize unnecessary data exposure. The findings highlight the urgent need for stronger privacy-by-design principles in app development and more nuanced regulatory approaches that do not inadvertently increase user risk. As mobile platforms continue to evolve, ongoing vigilance and collaboration between stakeholders will be essential to safeguard user privacy. The situation calls for immediate action from app developers, platform providers, and policymakers to address these multifaceted privacy threats. Users are advised to remain cautious about the permissions they grant and the information they share with mobile applications. The broader industry must prioritize transparency, user control, and robust security measures to restore trust in the mobile app ecosystem.
Jun 29, 2026