Ahold Delhaize says 2.2M affected after cyberattack

Multinational grocery and retail megacorp Ahold Delhaize says upwards of 2.2 million people had their data compromised during its November cyberattack with personal, financial and health details among the trove.

Ahold Delhaize operates a network of stores in Europe and the US via brands including Food Lion, Stop & Shop and Giant. It also has a substantial web business. It employs more than 400,000 staff and serves around 63 million customers a week.

The digital break-in late last year caused disruption across its organization, with some Stop & Shop stores struggling to fill prescriptions due to IT issues, while Food Lion employees took to social media complaining about delayed and missing deliveries.

Now Ahold Delhaize has confirmed more details via a notification filed with the Office of the Maine Attorney General, revealing the data of more than 2.24 million individuals was exposed.

Different people will have had different data points compromised, it added, and said the following may be in the wrong hands:

  • Names
  • Contact information (postal address, email address, and telephone number)
  • Dates of birth
  • Government-issued identification numbers (Social Security, passport and driver’s license numbers)
  • Financial account information (including bank account numbers)
  • Health information (workers’ compensation information and medical information contained in employment records)
  • Employment-related information

In a “Notice of Data Breach” letter sent to impacted individuals, Ahold Delhaize made no reference to customer data, saying only that investigations revealed “personal information contained in employment records related to you or your family member” may have been accessed.

This indicates the breach involved current and former staff.

[…]

Source: Ahold Delhaize says 2.2M affected after cyberattack • The Register

Android 16 can warn you that you might be connected to a fake cell tower

[…] Google has been working on ways to warn Android users or prevent them from sending communications over insecure cellular networks.

Win $5,000!

See all deals

  • Limited Time!

With the release of Android 12, for example, Google added support for disabling 2G connectivity at the modem level. In Android 14, the company followed up by supporting the disabling of connections that use null ciphers — a form of unencrypted communication. More recently, Android 15 added support for notifying the OS when the network requests a device’s unique identifiers or tries to force a new ciphering algorithm. These features directly counter the tactics used by commercial “stingrays,” which trick devices into downgrading to 2G or using null ciphers to make their traffic easier to intercept. Blocking these connections and notifying the user about these requests helps protect them from surveillance.

2G network protection toggle in Android 16
The toggle to disable 2G networks in Android 16 on a Pixel 9a.

Unfortunately, only one of these three features is widely available: the ability to disable 2G connectivity. The problem is that implementing these protections requires corresponding changes to a phone’s modem driver. The feature that notifies the OS about identifier requests, for example, requires a modem that supports version 3.0 of Android’s IRadio hardware abstraction layer (HAL). This dependency is why these security features are missing on current Pixel phones and other devices, and it’s also likely why Google delayed launching the dedicated “mobile network security” settings page it planned for Android 15.

Since upcoming devices launching with Android 16 will support version 3.0 of Android’s IRadio HAL, Google is reintroducing the “mobile network security” settings page in the Safety Center (Settings > Security & privacy). This page contains two subsections:

  • Notifications
    • This subsection contains a “Network notifications” toggle. When enabled, it allows the system to warn you if your device connects to an unencrypted network or when the network requests your phone’s unique identifiers. This toggle is disabled by default in Android 16.
  • Network generation
    • This subsection features a “2G network protection” toggle that enables or disables the device’s 2G connectivity. This is the same toggle found in the main SIM settings menu, and it is also disabled by default in Android 16.
Mobile network security settings in Android 16

The “Mobile network security” page will only appear on devices that support both the “2G network protection” toggle and the “network notifications” feature. This is why it doesn’t appear on any current Pixel devices running Android 16, as they lack the necessary modem support for the network notifications feature.

When the “Network notifications” feature is enabled, Android will post a message in the notification panel and the Safety Center whenever your device switches from an encrypted to an unencrypted network, or vice versa. It will also post an alert in both places when the network accesses your phone’s unique identifiers, detailing the time and number of times they were requested.

[…]

Source: Android 16 can warn you that you might be connected to a fake cell tower – Android Authority

The Conservatives On The Supreme Court Are So Scared Of Nudity, They Threw Out The First Amendment

he Supreme Court this morning took a chainsaw to the First Amendment on the internet, and the impact is going to be felt for decades going forward. In the FSC v. Paxton case, the Court upheld the very problematic 5th Circuit ruling that age verification online is acceptable under the First Amendment, despite multiple earlier Supreme Court rulings that said the opposite.

Justice Thomas wrote the 6-3 majority opinion, with Justice Kagan writing the dissent (joined by Sotomayor and Jackson). The practical effect: states can now force websites to collect government IDs from anyone wanting to view adult content, creating a massive chilling effect on protected speech and opening the door to much broader online speech restrictions.

Thomas accomplished this by pulling off some remarkable doctrinal sleight of hand. He ignored the Court’s own precedents in Ashcroft v. ACLU by pretending online age verification is just like checking ID at a brick-and-mortar store (it’s not), applied a weaker “intermediate scrutiny” standard instead of the “strict scrutiny” that content-based speech restrictions normally require, and—most audaciously—invented an entirely new category of “partially protected” speech that conveniently removes First Amendment protections exactly when the government wants to burden them. As Justice Kagan’s scathing dissent makes clear, this is constitutional law by result-oriented reasoning, not principled analysis.

[…]

The real danger here isn’t just Texas’s age verification law—it’s that Thomas has handed every state legislature a roadmap for circumventing the First Amendment online. His reasoning that “the internet has changed” and that intermediate scrutiny suffices for content-based restrictions will be cited in countless future cases targeting online speech. Expect age verification requirements to be attempted for social media platforms (protecting kids from “harmful” political content), for news sites (preventing minors from accessing “disturbing” coverage), and for any online speech that makes moral authorities uncomfortable.

And yes, to be clear, the majority opinion seeks to limit this just to content deemed “obscene” to avoid such problems, but it’s written so broadly as to at least open up challenges along these lines.

Thomas’s invention of “partially protected” speech, that somehow means you can burden those for which it is protected, is particularly insidious because it’s infinitely expandable. Any time the government wants to burden speech, it can simply argue that the burden is built into the right itself—making First Amendment protection vanish exactly when it’s needed most. This isn’t constitutional interpretation; it’s constitutional gerrymandering.

The conservative justices may think they’re just protecting children from pornography, but they’ve actually written a permission slip for the regulatory state to try to control online expression.

[…]

By creating his “partially protected” speech doctrine and blessing age verification burdens that would have been unthinkable a decade ago, Thomas has essentially told state governments: find the right procedural mechanism, and you can burden any online speech you dislike. Today it’s pornography. Tomorrow it will be political content that legislators deem “harmful to minors,” news coverage that might “disturb” children, or social media discussions that don’t align with official viewpoints.

The conservatives may have gotten their victory against online adult content, but they’ve handed every future administration—federal and state—a blueprint for dismantling digital free speech. They were so scared of nudity that they broke the Constitution. The rest of us will be living with the consequences for decades.

Source: The Conservatives On The Supreme Court Are So Scared Of Nudity, They’ll Throw Out The First Amendment | Techdirt

Denmark to tackle deepfakes by giving people copyright to their own features

The Danish government is to clamp down on the creation and dissemination of AI-generated deepfakes by changing copyright law to ensure that everybody has the right to their own body, facial features and voice.

The Danish government said on Thursday it would strengthen protection against digital imitations of people’s identities with what it believes to be the first law of its kind in Europe.

[…]

It defines a deepfake as a very realistic digital representation of a person, including their appearance and voice.

[…]

“In the bill we agree and are sending an unequivocal message that everybody has the right to their own body, their own voice and their own facial features, which is apparently not how the current law is protecting people against generative AI.”

He added: “Human beings can be run through the digital copy machine and be misused for all sorts of purposes and I’m not willing to accept that.”

[…]

The changes to Danish copyright law will, once approved, theoretically give people in Denmark the right to demand that online platforms remove such content if it is shared without consent.

It will also cover “realistic, digitally generated imitations” of an artist’s performance without consent. Violation of the proposed rules could result in compensation for those affected.

The government said the new rules would not affect parodies and satire, which would still be permitted.

[…]

Source: Denmark to tackle deepfakes by giving people copyright to their own features | Deepfake | The Guardian

An interesting take on it. I am curious how this goes – defending copyright can be a very detailed thing, so what happens if someone alters someone else’s eyebrows in the deepfake by making them a mm longer? Does that invalidate the whole copyright?