Loading story…
California’s Privacy Protection Agency (CalPrivacy) announced a settlement action against Texas-based Rickenbacher Data (doing business as DataMasters), fining the company and banning it from selling Californians’ personal information as part of a broader enforcement crackdown on data brokers. The action was brought by the agency’s enforcement division and its Data Broker Enforcement Strike Force, following CalPrivacy’s stated intent to increase investigations into data broker privacy violations.
Regulators said DataMasters traded in data tied to sensitive health conditions—including lists associated with Alzheimer’s disease, drug addiction, and bladder incontinence—and also bought and sold lists segmented by demographics and inferred attributes such as “Seniors,” “Hispanic,” political affiliation, grocery purchases, banking activity, and health-related purchases for targeted advertising. CalPrivacy stated the company conducted these activities in 2024 without registering with the California Data Broker Registry, a requirement under California’s data broker rules.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
The California Privacy Protection Agency also disclosed a separate $62,600 fine against S&P Global Inc. for failing to register as a data broker on time. S&P said the lapse was caused by an administrative error.
The California Privacy Protection Agency announced that it was banning Rickenbacher Data/DataMasters from selling Californians' personal information and fining it $45,000 for failing to register on time under the Delete Act. The agency said the ban effectively removed the company from the California marketplace.
As part of the enforcement action, California required DataMasters to delete all Californians' data by the end of December and to delete any future California datasets within 24 hours of receipt. The order also imposed compliance obligations lasting five years.
During 2024, Texas-based Rickenbacher Data LLC, doing business as DataMasters, sold Californians' personal information without registering with the California Data Broker Registry. Regulators said the company traded in sensitive audience lists, including health-condition, demographic, political, and behavioral data for targeted advertising.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
govinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A U.S. congressional investigation by the Joint Economic Committee’s Democratic minority estimated that identity theft tied to breaches at **four major data brokers** has cost American consumers roughly **$20 billion**, and highlighted how some brokers obscured legally required “opt-out” pages (including use of `no-index` tactics that made deletion/opt-out pages harder to find). The report, prompted by investigative reporting, said several large brokers subsequently engaged with congressional staff and changed practices to make it easier for consumers to control the collection and sale of their personal data. California regulators separately escalated enforcement of opt-out requirements under state privacy law, with the **California Privacy Protection Agency (CPPA)** fining **PlayOn Sports** **$1.1 million** over allegations that its *GoFan* ticketing platform used tracking technologies for targeted advertising without providing a compliant, easy-to-use opt-out mechanism. The CPPA said users—including large numbers of high school students—were effectively forced to “agree” to tracking to access paid tickets and services, and that directing users to industry opt-out programs (e.g., Network Advertising Initiative / Digital Advertising Alliance) did not satisfy California’s requirement that companies provide their **own** opt-out tool and clear disclosures.
Jun 29, 2026
Multiple healthcare organizations have reported significant data breaches involving unauthorized access to patient information. CareOregon and Health Share of Oregon notified patients of a breach where protected health information, including names, dates of birth, health plan details, and Medicaid/Medicare numbers, was accessed without authorization, raising concerns about potential insurance fraud. Canopy Health, a major New Zealand oncology provider, disclosed a cyberattack that resulted in unauthorized access to administrative systems and possible data exfiltration, with the incident being contained and legal action taken to prevent misuse of the compromised data. Additionally, a Manhattan plastic surgery practice suffered a cyberattack in which sensitive patient images and personal information were stolen and published online, with extortion attempts made directly to patients; this attack is linked to a series of similar incidents targeting plastic surgery practices. In parallel to these incidents, California authorities have taken regulatory action against Datamasters, a marketing firm found to be illegally selling health and personal data of millions of individuals without proper registration as a data broker. The company was fined and banned from selling Californians' personal information after it was discovered to have traded in sensitive data, including health conditions and demographic details, for targeted advertising. These events highlight ongoing risks to health data privacy from both cyberattacks and improper commercial data practices, as well as the increasing regulatory scrutiny and enforcement in this sector.
Jun 29, 2026
California Attorney General Rob Bonta has sued 23andMe over its 2023 breach, alleging the DNA testing company failed to implement reasonable safeguards for highly sensitive customer data and misled consumers about the incident. State investigators said attackers used a credential-stuffing campaign against roughly 14,000 accounts over about five months, ultimately exposing the personal and genetic information of 6.9 million people, including 855,541 California residents. The compromised data reportedly included genetic predispositions, health risk factors, ancestry, ethnicity, and biological-relative information. The complaint alleges 23andMe failed to defend against a well-known attack technique, overlooked warning signs such as spikes in login attempts and public discussion of the breach, and left additional weaknesses in its **DNA Relatives** feature. Bonta also said the stolen data was later advertised for sale on the dark web with references to **Asian American Pacific Islander** and **Jewish** users, heightening concerns about targeted harm. The lawsuit follows a class-action settlement approved in January 2026 for up to **$50 million**, and comes as California separately challenges the sale of consumers’ genetic data and biological samples in 23andMe’s bankruptcy case.
Jun 29, 2026