Loading story…
A New Jersey court ordered the transfer of radaris.com and 13 related people-search domains to Atlas Data Privacy Corp. after the Radaris network did not defend claims that it failed to remove protected individuals’ personal data under Daniel’s Law. The statute requires commercial data brokers to remove, within 10 days of a request, the personal information of covered New Jersey law-enforcement personnel, government employees, judges, and their families; violations can draw $1,000 penalties. Atlas alleges that Radaris operators used changing foreign corporate entities and procedural delays to evade accountability, and that records link at least 25 people-search sites to a small Boston-area operating group.
Radaris counsel is seeking to vacate the default judgment and appeal the domain transfer, contending that radaris.com is not a legal entity and that the order constitutes an unconstitutional forfeiture. The case unfolds as data brokers separately challenge Daniel’s Law in federal court. The New Jersey Supreme Court has ruled that the law imposes strict liability without requiring proof that a broker acted knowingly or negligently, an interpretation legal observers say may heighten constitutional concerns before the Third Circuit.
See the reporting duties and controls this puts on the clock.
11 events from the most recent confirmed update back to the earliest known activity.
A federal district court ruled that West Virginia's version of Daniel's Law was facially unconstitutional under the First Amendment.
After defendants challenged service on purported owners and operators, Atlas refiled and expanded its Radaris lawsuit to include additional associated data-broker entities.
Atlas Data Privacy Corp. sued Radaris, alleging violations of Daniel's Law, which requires covered personal information to be removed following qualifying requests and permits $1,000 fines per violation.
The New Jersey Legislature removed language that had tied liability under Daniel's Law to what a reasonable person would have believed about disclosure risks. The state Supreme Court later found that this removal intentionally changed the law's substance.
Andtop Company was formed in the Marshall Islands. Following the earlier Radaris litigation, it was listed as the purported Radaris operator in place of Bitseller Expert Limited.
Daniel Anderl, the son of U.S. District Judge Esther Salas, was fatally shot by a disgruntled attorney who located the judge's home address online. New Jersey enacted Daniel's Law, enabling covered officials to require data brokers to remove their personal information.
A class action against Radaris resulted in a $7.5 million default judgment after the company did not contest the claim. A court initially ordered radaris.com transferred, but halted the transfer on appeal after arguments that Cyprus-based Bitseller Expert Limited, the claimed domain owner, had not been named.
Radaris counsel Victor Worms said the defendants moved to vacate the default judgment, arguing that radaris.com is not a legal entity capable of being sued. The defendants also plan to appeal, characterizing the domain transfer as an unconstitutional forfeiture.
After finding that defendants had repeatedly failed to appear and defend the claims, a New Jersey court transferred radaris.com and 13 other Radaris-family domains to Atlas Data Privacy. Radaris.com subsequently stopped selling detailed dossiers and redirected visitors to an Atlas notice about the transfer.
The New Jersey Supreme Court unanimously held that data brokers may be liable under Daniel's Law without proof of negligence, knowledge, recklessness, or another mental state. The court concluded that the statute contains no mens rea requirement.
A federal district court denied data brokers' motions to dismiss their constitutional challenge to Daniel's Law, and the brokers appealed to the Third Circuit. The Third Circuit asked the New Jersey Supreme Court whether the statute requires a mental state for liability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcekrebsonsecurity.com
Open sourcenj.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
California’s **Privacy Protection Agency (CalPrivacy)** announced a settlement action against Texas-based **Rickenbacher Data (doing business as DataMasters)**, fining the company and **banning it from selling Californians’ personal information** as part of a broader enforcement crackdown on data brokers. The action was brought by the agency’s enforcement division and its **Data Broker Enforcement Strike Force**, following CalPrivacy’s stated intent to increase investigations into data broker privacy violations. Regulators said DataMasters traded in data tied to **sensitive health conditions**—including lists associated with **Alzheimer’s disease, drug addiction, and bladder incontinence**—and also bought and sold lists segmented by demographics and inferred attributes such as **“Seniors,” “Hispanic,” political affiliation, grocery purchases, banking activity, and health-related purchases** for targeted advertising. CalPrivacy stated the company conducted these activities in **2024 without registering with the California Data Broker Registry**, a requirement under California’s data broker rules.
Jun 29, 2026
A federal judge in New Jersey dismissed a proposed class action against background check company **TABB Inc.** stemming from a 2024 data leak, finding that the plaintiff failed to allege a sufficiently concrete injury to establish Article III standing in federal court. The suit had been brought by Arthur Ojo on behalf of himself and others allegedly affected by the incident. The ruling marks another setback for breach-related litigation where plaintiffs cannot show tangible harm beyond exposure of data. Reporting on the case tied the lawsuit to a leak reportedly discovered in 2024 by researcher **JayeLTee**, who said efforts to responsibly disclose the issue to TABB were difficult and frustrating before the legal challenge was later filed.
Aug 16, 2026