This Week in Privacy: Oct 12-18, 2026
This week brought a particularly unsettling reminder that the infrastructure we trust to protect our data can become the very pathway for attackers. From backup services turned breach vectors to tracking widgets that overshare, the gap between privacy promises and reality remained frustratingly wide.
Top Stories
Backup Software Becomes Attack Vector in Microsoft 365 Breach
Between October 15 and 17, hackers exploited ConnectWise's Cloud Backup service to compromise at least 162 Microsoft 365 customer accounts. The attackers stole application credentials that the backup software uses to access customer data, then authenticated directly as the backup application itself, bypassing the need for individual user logins entirely. ConnectWise suspended its Cloud Backup service while investigating, though the company claims the backup archives themselves weren't compromised. This incident highlights a growing vulnerability: third-party tools with broad access privileges can become single points of failure, giving attackers keys to multiple kingdoms at once.
Google's Package Tracking Widget Allegedly Shared Data with Dozens of Companies
A class action lawsuit filed October 9 accuses Google of misleading users about what happens when they track packages through Google's interface. According to the complaint, clicking the track button for UPS packages triggered 415 network requests that shared tracking numbers, IP addresses, device details, Facebook account IDs, and advertising identifiers with at least 28 third-party companies, including Meta, Adobe, and Microsoft. Google's interface told users only tracking numbers would be sent to UPS. The lawsuit also alleges that code on UPS's website recorded users' screens, mouse movements, and keyboard inputs in real time, sending these recordings to analytics company Quantum Metric. If proven, this represents a stark example of how simple, everyday actions can trigger extensive data sharing far beyond what users reasonably expect.
LinkedIn's €310 Million Fine Heads to Ireland's Supreme Court
The legal battle over LinkedIn's €310 million GDPR fine escalated this week when Ireland's Supreme Court agreed to hear the Data Protection Commission's appeal. LinkedIn challenged the October 2024 penalty in High Court, arguing Ireland's DPC exceeded its constitutional authority with such a severe fine. The Supreme Court's decision to take up the case acknowledges it raises issues of general public importance, potentially setting precedent for how EU member states can enforce data protection laws and what limits exist on regulatory penalties.
In Brief
* MIT sued Amazon Web Services for allegedly infringing two university patents related to physical unclonable function technology used in AWS cloud security systems.
* A federal appeals court blocked 185 Chrome users from joining a six-year-old lawsuit about Google collecting browsing data in Incognito mode, ruling their intervention attempt came too late in the litigation process.
* WhatsApp made a formatting-only change to how its message retention policy appears in documents, with no actual change to the policy itself.
The Big Picture
This week's events underscore a persistent structural problem: the complexity of modern digital infrastructure creates countless opportunities for privacy failures, whether through technical vulnerabilities, opaque data sharing practices, or simply the difficulty of knowing who has access to what. The ConnectWise breach demonstrates how third-party service providers can become attractive targets precisely because they hold keys to multiple organizations. Meanwhile, the Google tracking lawsuit illustrates how data sharing has become so routine and automated that even simple actions trigger hundreds of connections users never see or approve. As companies continue building interconnected systems where data flows freely between partners, the challenge of maintaining meaningful privacy protections only grows steeper.