Loading story…
Amazon agreed to nearly $1 billion in refunds and settlement payments tied to a class action over allegedly mishandled returns, with eligibility generally covering customers who returned items after Sept. 5, 2017 and requested refunds that were not received. Separately, Google agreed to a $68 million class-action settlement over allegations that Google Assistant recorded private conversations without the “Hey Google” wake phrase and shared collected conversations with advertisers; the proposed settlement would allow consumer claims for up to three devices and also covers attorneys’ fees and related costs.
In parallel, the U.S. FTC warned of IRS tax-refund impersonation scams delivered via text/email that attempt to trick recipients into clicking links and providing sensitive data such as bank account details or Social Security numbers. While the Amazon and Google items are legal/consumer-privacy settlements and the IRS item is generic fraud-prevention guidance, all three reflect ongoing consumer risk around refunds and data handling, with the IRS-themed lures specifically designed to harvest credentials and enable identity theft and fraudulent refund claims.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Following the settlement and review, some affected Amazon customers began receiving unexpected refunds, in some cases exceeding $1,000. Claim filing for separate settlement funds had not yet opened pending a final fairness hearing.
Google agreed to a $68 million preliminary settlement in Northern California federal court to resolve a class-action lawsuit alleging Google Assistant recorded private conversations without the 'Hey Google' wake phrase and shared collected conversations with advertisers. The settlement would let consumers submit claims for up to three devices, with Google covering claims payments, attorneys' fees, and other expenses.
In 2023, Amazon agreed to a class-action settlement over return refunds it failed to issue, providing nearly $1 billion in value including $600 million in refunds and $309.5 million for a common fund. The deal also included more than $363 million in non-monetary relief to improve return and refund processes.
Amazon said an internal review found a very small subset of customer returns that had not been properly resolved with refunds. This review led to remediation and the later settlement terms.
Customers who requested refunds for returned Amazon items began falling into the affected class period for mishandled returns. The settlement covers unresolved return-refund cases dating back to September 5, 2017.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Comcast agreed to pay **$117.5M** to settle a class action tied to a large-scale breach disclosed in late 2023 that potentially affected **31M+** people. Comcast attributed the intrusion to **CitrixBleed** (Citrix NetScaler ADC/Gateway), a vulnerability that can enable **session hijacking** and credential theft; researchers warned stolen session tokens could remain valid even after patching, extending attacker access. The proposed settlement (preliminarily approved) provides reimbursement for documented losses (up to **$10,000** per person) and compensation for time spent responding, while Comcast denies wrongdoing. Separately, Google agreed to pay **$135M** to settle Android users’ claims that devices transmitted data to Google servers over **cellular networks** in the background without meaningful consent, with individual payouts capped (reported up to **$100**) and additional **injunctive relief** requiring clearer disclosures and express consent during setup. Two dermatology practices also reached settlements over cybersecurity incidents exposing patient data; one New Jersey practice reported unauthorized network access spanning **Dec 2023–Mar 2024** and exposure of **PHI/PII** (including SSNs and treatment/insurance data) affecting **373,630** individuals, offering cash benefits plus credit monitoring/identity protection while denying liability.
Jun 29, 2026
Consumer-facing warnings described a surge of **taxpayer-targeting impersonation scams** using fake entities such as the “**National Tax Executive Office**” and “Tax Resolution Oversight Department,” alongside broader **IRS-themed phishing** via calls, emails, and SMS. Reported lures include urgent claims of tax debts or refunds, links to spoofed “official” sites, and **AI-enabled impersonation** (voice mimicry and deepfake-style video calls) to pressure victims into immediate payment. Common indicators include threats of arrest or license revocation and demands for nonstandard payment methods such as **gift cards, wire transfers, prepaid debit cards, cryptocurrency, or P2P apps**; guidance emphasized that the IRS generally initiates contact via **postal mail** and that suspected scams should be reported through official IRS/TIGTA channels. Separately, the IRS leadership told Congress it is conducting a **thorough cybersecurity review** as lawmakers scrutinize the agency’s **taxpayer data protections** and a contested **data-sharing agreement with Immigration and Customs Enforcement (ICE)**. Congressional questioning cited multiple privacy controversies, including litigation over the ICE agreement, allegations of inappropriate access to personally identifiable information, and historical disclosures (including a prior contractor leak affecting high-profile taxpayers). A federal judge’s opinion was also referenced alleging the IRS violated federal law **tens of thousands of times** by improperly sharing taxpayer addresses with the Department of Homeland Security via a flawed matching process; IRS leadership acknowledged responsibility for improving controls while declining detailed comment due to ongoing litigation.
Jun 29, 2026
Multiple legal actions highlighted ongoing **privacy and data-protection risk** across healthcare and consumer platforms. Epic Systems sued health information exchange implementer **Health Gorilla** and several provider organizations, alleging improper access to roughly **300,000 patients’ records** and claiming some participants abused interoperability frameworks (including **Carequality** and **TEFCA**) to obtain and monetize sensitive health data without appropriate consent or authorization. Separately, pharmacy services provider **PharMerica** agreed to a **$5.2 million** class-action settlement tied to a **2023** hacking incident attributed to the **Money Message** ransomware group, which claimed exfiltration of **4.7 TB** and later leaked data affecting **5.8 million** people (including SSNs and medication/insurance details), alongside commitments to invest further in security. Outside healthcare, California’s Attorney General opened a probe into **xAI** after **Grok** was used to generate and post non-consensual sexualized deepfakes, while Google agreed to pay **$8.25 million** to settle claims that its **AdMob SDK** collected data from children’s devices in “Designed for Families” apps in alleged violation of **COPPA**; a separate YouTube children’s-data settlement was also noted. A HIPAA Privacy Rule update was also reported as moving closer to finalization following an HHS OCR tribal consultation notice, but it is a regulatory development rather than a specific incident.
Jun 29, 2026