Loading story…
DataBreaches.net and journalist Zack Whittaker launched a survey to document threats faced by cybersecurity researchers and reporters, including legal intimidation, misuse of legal process, and threats of violence from cybercriminals. The call for participation cites a perceived increase in breached organizations seeking court injunctions to restrict downloading or sharing breached data—actions described as ineffective at stopping criminals but potentially chilling for breach reporting and press freedom, including cross-border effects (e.g., a UK injunction impacting an Italian journalist’s work).
Separately, The Citizen Lab reported that senior researcher Marcus Michaelsen testified before the German Bundestag’s Human Rights Committee on digital transnational repression, warning that people in exile and diaspora communities in Germany are increasingly targeted in ways that undermine their security and human rights. The submission provided recommendations for improved monitoring, protection, accountability, and international coordination, and pointed to ongoing patterns of targeted operations (including spearphishing campaigns) used to intimidate or surveil civil society across borders.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
The survey hosted by DataBreaches.net and Zack Whittaker was set to close on January 18, 2026. Participants were urged to respond before the deadline and share it with peers.
DataBreaches.net and Zack Whittaker ran a survey for cybersecurity researchers and journalists about threats they have experienced, including legal threats, legal process, and threats of violence from cybercriminals. The survey was open through January 18, 2026, and was promoted as a way to document growing pressure on independent reporting and research.
On January 14, 2026, Citizen Lab senior researcher Marcus Michaelsen testified before the Human Rights Committee of the German Bundestag about transnational repression. His submission said exiles and diaspora communities in democratic countries such as Germany are increasingly affected and recommended stronger monitoring, protection, accountability, and international coordination.
Citizen Lab investigated a highly customized spearphishing campaign in March 2025 that targeted senior members of the World Uyghur Congress. The operation reportedly weaponized culture-supporting software and websites used by the same marginalized communities it sought to compromise.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The reporting and resources focus on **privacy and surveillance risk** rather than a single discrete cyber incident. WIRED highlighted operational-security concerns ranging from exposed metadata in government documents to broader identity-theft risk from an **internet-exposed database containing billions of records**, and separately published guidance on *surveillance-resistant organizing* that emphasizes minimizing sensitive data held by major platforms and planning for legal process (e.g., subpoenas) when selecting collaboration tools. Separately, DataBreaches.Net covered Codamail’s release of a **Privacy Law Directory** spanning 21 jurisdictions, mapping data protection and surveillance-related regimes (including intelligence-sharing frameworks such as **Five/Nine/Fourteen Eyes**) and noting a recurring pattern: many privacy laws provide stronger protections for a country’s own residents than for foreigners due to intelligence-collection exemptions. A SentinelOne weekly roundup primarily covered **law-enforcement actions against cybercrime** (including arrests tied to **Phobos RaaS** and large-scale fraud crackdowns), which is substantively cybersecurity-related but not part of the same privacy/surveillance guidance and resource theme.
Jun 29, 2026
German lawmakers are advancing draft legislation to significantly expand the Bundesnachrichtendienst’s (**BND**) hacking and surveillance authorities, including intercepting full internet communications (not just metadata), retaining collected data for up to six months, and extending the agency’s offensive mandate to hack foreign internet service providers to obtain target information when companies do not cooperate. Reporting indicates the proposal is partly aimed at reducing reliance on the US **NSA** for threat intelligence and bringing Germany’s capabilities in line with other European services; it would also broaden who can be surveilled, including foreigners inside Germany and certain journalists tied to foreign state-run media, and would enable intrusive operations such as deploying a “federal trojan.” Separately, Ukrainian and German law enforcement reported disrupting a Russian-affiliated ransomware operation, identifying and searching two suspects in Ukraine alleged to have served as “hash cracker” specialists who extracted/cracked password hashes, used stolen credentials for lateral movement and privilege escalation, and supported ransomware deployment and data exfiltration for extortion. Authorities seized digital devices and cryptocurrency assets and said an alleged Russian organizer has been identified, with foreign partners suggesting possible links to the **Conti** ransomware ecosystem. A third item—a *Citizen Lab* job posting—does not report a specific incident and is primarily recruitment content, despite referencing prior research on targeted phishing and spyware threats.
Jul 2, 2026
Governments are broadening digital surveillance through a mix of network interception, lawful intercept platforms, deep packet inspection, mandatory data retention, endpoint spyware, platform monitoring, and public-space surveillance, according to a new risk assessment. The report highlights Russia’s opaque `SORM` model as a prominent example of state interception architecture and says Chinese and Russian surveillance technologies are being exported to multiple countries, extending these capabilities beyond their domestic markets. The assessment says commercial spyware including **Predator**, **Candiru**, **Pegasus**, and **Paragon** has been used against journalists, activists, and civil society, while newer laws and policies in countries such as Ecuador, Myanmar, Nicaragua, Vietnam, Cambodia, Kyrgyzstan, Russia, and Kazakhstan are expanding state access to communications, metadata, biometric records, and internet infrastructure. It also points to growing use of **Safe City** platforms, facial recognition, `IMSI` catchers, national messenger apps, digital ID systems, and centralized biometric databases, warning that weak oversight raises risks ranging from privacy abuses and human-rights violations to corporate espionage, zero-day exploitation, and exposure of sensitive personal data.
Jun 29, 2026