FTC says prospective 23andMe buyers must uphold privacy commitments.

Summary

By the CyberWire staff

At a glance.

FTC says prospective 23andMe buyers must uphold privacy commitments.
UK reveals scope of its planned cybersecurity bill.
Sam's Club investigates breach claims.

FTC says prospective 23andMe buyers must uphold privacy commitments.

The US Federal Trade Commission (FTC) has sent a letter informing 23andMe's bankruptcy trustees that any buyer of the company or its assets must uphold the firm's previous privacy and security pledges, BankInfoSecurity reports. The DNA testing firm's bankruptcy had raised privacy concerns about the future of the company's massive trove of customers' genetic data.

FTC Chairman Andrew Ferguson said in the letter, "[A]ny bankruptcy-related sale or transfer involving 23andMe users’ personal information and biological samples will be subject to the representations the Company has made to users about both privacy and data security, and which users relied upon in providing their sensitive data to the Company. Moreover, as promised by 23andMe, any purchaser should expressly agree to be bound by and adhere to the terms of 23andMe’s privacy policies and applicable law, including as to any changes it subsequently makes to those policies."

Enhance Your Network Security with Zero Trust!

IT pros, are you ready to fortify your defenses? Discover ThreatLocker® Network Control, a powerful Zero Trust host-based firewall with dynamic ACLs. Gain full visibility, granular control, and advanced filtering to secure your network like never before. Learn how to stop breaches, implement microsegmentation, and integrate seamlessly with the ThreatLocker Platform. Download the whitepaper now and get the insights you need to enhance your organization’s defenses!

UK reveals scope of its planned cybersecurity bill.

The UK government has published details on its upcoming Cyber Security and Resilience (CSR) Bill, which will be introduced to Parliament later this year, the Register reports. Notably, the bill would impose daily £100,000 fines for organizations that fail to act against specific threats within a government-specified deadline.

UK technology secretary Peter Kyle stated in a foreword, "This Bill will make substantial improvements to this existing framework by bringing more entities into scope and putting regulators on a stronger footing so that they can carry out their important duties. The measures acknowledge the need for increased visibility over cyber threats, and the importance of simple and clear reporting requirements across different frameworks, including those under consultation by the Home Office to counter ransomware. The Bill will also allow the Government to act against emerging threats without the need for new primary legislation."

Many Voices. One Community.

Join Us at the RSAC 2025 Conference. Join us at RSAC, April 28 - May 1 in San Francisco and gain access to cybersecurity innovators, expert-led sessions, and hands-on workshops. Leave with new strategies, insights, and connections to elevate your cybersecurity journey.

Sam's Club investigates breach claims.

US retail giant Sam's Club is investigating claims of a breach by the Clop ransomware group, BleepingComputer reports. The Clop gang added the company to its leak site, though it hasn't provided any proof of the attack. A Sam's Club spokesperson stated, "We are aware of reports regarding a potential security incident and are actively investigating the matter. Protecting the privacy and security of our members' information is a top priority at Sam's Club. We take these concerns seriously and will communicate further as appropriate."

Notes.

Today's issue includes events affecting , and the United Kingdom the United States.

Attacks, Threats, and Vulnerabilities

Check Point confirms breach, but says crim posted old data (The Register) : Explanation leaves a 'lot of questions unanswered,' says infosec researcher

Apple Warns of Three 0-Day Vulnerabilities Actively Exploited in Attacks (Cyber Security News) Apple has issued an urgent security advisory concerning three critical zero-day vulnerabilities CVE-2025-24200, CVE-2025-24201, and CVE-2025-24085 that have been actively exploited in sophisticated attacks.

Litigation, Investigation, and Law Enforcement

Student pleads guilty to smuggling software out of GCHQ (The Register) : Not exactly Snowden levels of skill

Canadian hacker arrested for allegedly stealing data from Texas Republican Party (The Record) The prominent hacker Aubrey Cottle is accused of hacking into a third-party hosting company for the websites for the Texas Republican Party and the Texas Right to Life anti-abortion group.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Protecting CISOs From Increasing Personal Liability Risk-Civil & Criminal Insurance Considerations (Columbia, Mar, USA, Apr 17, 2025) An in-depth discussion of CISO Liability to include the following: · Increasing accountability and claims events and trends facing CISOs · How D&O and Cyber policies differ · How CISOs are covered under one or both policies · Risk Management and best practices to maximize the value of the D&O policy and optimize policy performance in a claims scenario.

Events

WICYS 2025 (Dallas and Virtual, Texas, USA, Apr 2 - 5, 2025) WiCyS 2025 is the go-to event for cybersecurity professionals, students, and organizations. The conference is the flagship event to recruit, retain and advance women in cybersecurity.

40th Space Symposium (Denver and Virtual, Colorado, USA, Apr 7 - 10, 2025) Bringing together leaders from commercial, government and military space from around the world, the Space Symposium provides a forum to discuss, address and plan for future achievements in space. The Space Symposium program delivers exclusive networking and engagement opportunities with influential participants in one convenient and extraordinary venue. Space Symposium luncheons and dinners provide additional contact with influential participants.

Community Event with The Cyber Guild - Book Club (Reston, Virginia, USA, Apr 17, 2025) Join the growing Cyber Guild Community - "where everyone wants to know your name " The Cyber Guild community is a growing network of cyber enthusiasts who are invested in building a sustainable cyber ecosystem.

RSA Innovation Sandbox 2025 (San Francisco, California, USA, Apr 28, 2025) RSA Conference 2025 marks 20 years for cybersecurity’s top innovation startup competition: RSAC Innovation Sandbox contest. The contest puts the spotlight on cybersecurity’s boldest new innovators while highlighting their potentially game-changing ideas. Hundreds of submissions are reviewed and narrowed down to only 10 finalists. The Top 10 Finalists will take the stage during RSA Conference 2025 and will have three minutes to make their award-winning pitch to a panel of leading industry experts. Since the start of the contest, the Top 10 Finalists have collectively seen over 90 acquisitions and over $16.4 billion in investments.*

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 04.01.25

At a glance.

FTC says prospective 23andMe buyers must uphold privacy commitments.

UK reveals scope of its planned cybersecurity bill.

Sam's Club investigates breach claims.

Notes.

Attacks, Threats, and Vulnerabilities

Litigation, Investigation, and Law Enforcement

Newly Noted Events

Events