Loading story…
Google won a $10 million bankruptcy auction to acquire a large de-identified dataset and internal software assets from Spirit Airlines, including roughly 100 million emails, 500 million Microsoft Teams chats, spreadsheets, calendars, workflow records, business application data, and about 30 million lines of code. Court filings and company statements said the sale excludes customer data, loyalty records, and other personal information, and requires that Google not attempt to re-identify individuals; Google also said a third party will scrub personally identifiable information before any data is transferred.
The deal has drawn objections from labor representatives, with the flight attendants’ association warning that extensive employee and worker records could still expose confidential information even after sanitization. Critics said the arrangement relies too heavily on trust in Google and the third-party scrubbing process, while pointing to the company’s past privacy controversies, including settlements tied to alleged collection of incognito browsing, geolocation, search, and biometric data.
See the reporting duties and controls this puts on the clock.
6 events from the most recent confirmed update back to the earliest known activity.
In 2024, Google settled a class action lawsuit brought by Incognito users. As part of the settlement, Google agreed to delete billions of records reflecting users' private browsing activities.
The flight attendants' association objected to the proposed sale, arguing that it excludes most consumer-facing data while retaining extensive employee records such as payroll, tax forms, training, travel, and time card information. The association said the sanitization approach relies too heavily on removing identifiers from structured fields and requires excessive trust in Google and its third-party processor.
Google made binding commitments in court that it would not intentionally re-identify the acquired data. Google also said a third party would scrub personally identifiable information before it receives the dataset.
Google outbid Mercor and another bidder to acquire part of Spirit Airlines' de-identified enterprise dataset and software assets for $10 million. The sale reportedly covers about 100 million emails, 500 million Microsoft Teams chats, 30 million lines of code, and related software components and documentation.
Spirit Airlines entered bankruptcy proceedings, and some of its assets were put up for sale through an auction process. The assets included a large de-identified enterprise dataset and internally developed software assets.
Google later agreed to pay Texas $1.4 billion to settle a lawsuit alleging unlawful collection of geolocation, incognito search, and biometric data. The article says Texas Attorney General Ken Paxton described it as the highest recovery nationwide against Google for any attorney general's enforcement of state privacy laws.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
arstechnica.com
Open sourceitpro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google is expanding its *Search* “Results about you” removal tools to let users request takedowns of additional sensitive content appearing in search results, including **government-issued IDs** (e.g., passport, driver’s license, and Social Security number) and **explicit images**. The feature is rolling out in the US first and requires users to provide the same categories of personal data to Google so it can proactively scan for matches and notify users when the information appears, enabling a removal request. Separately, reporting said Google provided **personal, account, and financial metadata** about a student journalist to **U.S. Immigration and Customs Enforcement (ICE)** in response to an **administrative subpoena** that was not judge-approved and reportedly included a gag order. The disclosed data allegedly included usernames, physical addresses, IP addresses, phone numbers, subscriber identifiers, and linked payment details (credit card and bank account numbers), highlighting how administrative subpoenas can be used to obtain identifying information from tech providers even when they cannot compel disclosure of content like emails or search history.
Jun 29, 2026
Google received approval from the US Department of Justice to proceed with its $32 billion acquisition of cloud security company Wiz, marking a significant milestone in the tech giant's largest-ever deal. Wiz CEO Assaf Rappaport confirmed the antitrust clearance at a Wall Street Journal event, emphasizing that while the DoJ's decision is crucial, the acquisition process is not yet complete and further steps remain before the deal officially closes. Google initially attempted to acquire Wiz in 2024 for $23 billion, but the offer was declined; negotiations resumed in early 2025, resulting in the current agreement announced in March. Wiz's unified cloud security platform, which provides comprehensive visibility and risk assessment across multiple cloud environments, is expected to complement and extend Google Cloud's existing security offerings. The platform connects via API to customer environments, enabling full-stack inventory and threat intelligence integration. Google plans to integrate Wiz into its cloud division upon completion of the acquisition, which is anticipated to close in early 2026, pending final regulatory and procedural steps.
Jun 29, 2026A court has ordered Google to pay $425 million in a class action lawsuit for misleading users about its 'Web & App Activity' privacy setting. Despite users disabling data collection, Google continued to gather app usage data via Firebase, affecting 98 million users. Google plans to appeal the decision, maintaining that its privacy tools are transparent and effective.
Jun 29, 2026