Surveillance at MSG, Smartglasses Privacy Concerns, and Major Data Breaches: This Week in Security
This week's security roundup covers a range of topics, from invasive surveillance practices at **Madison Square Garden** to concerns about privacy with AI-powered smartglasses. We also delve into significant data breaches affecting major companies and a DDoS attack on **Bluesky**.
## MSG's Surveillance State Raises Privacy Alarms
Going to **Madison Square Garden**? Be aware of the extensive surveillance measures in place. A **WIRED** investigation uncovered details about the comprehensive surveillance system implemented by **MSG** owner **Jim Dolan** and head of security, **John Eversole**. This includes facial recognition, social media monitoring, and in-person surveillance, raising significant privacy concerns for visitors.
## US Government's Warrantless Wiretap Powers Face Resistance
Efforts to reauthorize Section 702 of the US government's spy program faced a setback this week. A group of 20 Republican lawmakers opposed a full reauthorization, leading to a mere 10-day extension of the program. This highlights ongoing debates about the balance between national security and individual privacy.
## Civil Society Groups Demand Privacy Protections for Smartglasses
**Meta's** Ray-Ban and Oakley AI smartglasses are under scrutiny due to potential privacy risks. Over 70 civil society groups, including the **ACLU** and the **National Organization for Women**, have urged **Meta** to abandon plans to equip these glasses with facial recognition. Concerns are mounting that these devices could be used for surreptitious recording and stalking, further eroding privacy.
## Deepfake Nudes Plague Schools Worldwide
A joint investigation by **WIRED** and Indicator revealed a disturbing trend: the use of deepfake "nudify" technology against middle and high school girls. The analysis identified over 600 victims in 28 countries, highlighting the global crisis of nonconsensual deepfake images.
## Telegram Continues Hosting Sanctioned Crypto Scammer Black Market
Despite sanctions from the UK government, **Telegram** continues to host **Xinbi Guarantee**, a platform facilitating human trafficking and crypto scams. A **WIRED** investigation found that **Xinbi** processed another $505 million in transactions even after the sanctions were imposed, raising questions about **Telegram's** commitment to combating illicit activities.
## AI Enters the Cybersecurity Arena
The AI race now extends to cybersecurity. Following **Anthropic's** unveiling of its **Mythos** model, **OpenAI** announced its new cybersecurity strategy and **GPT-5.4-Cyber** model. This marks a significant step towards leveraging AI for enhanced security measures.
## European Commission's Age Verification App Riddled with Security Flaws
The European Commission's newly released age verification app has been found to be a security disaster. Security consultant **Paul Moore** demonstrated how the app could be hacked in under 2 minutes, citing vulnerabilities in how it stores user PINs. This raises serious concerns about the app's security and potential for large-scale breaches.
## A Gym Chain and a Hotel Giant Disclose Major Data Breaches
Europe's largest gym chain, **Basic-Fit**, confirmed a data breach impacting approximately one million customers, including around 200,000 in the Netherlands. Stolen data includes bank details, names, addresses, phone numbers, and dates of birth.
Similarly, **Booking.com** confirmed that hackers accessed customer data, including names, email addresses, phone numbers, and booking details. While the company stated that no financial information was compromised, the scope of the breach remains unclear.
## Bluesky Buckles Under DDoS Attack
**Bluesky's** site and app experienced significant disruptions due to a distributed denial-of-service (DDoS) attack. The attack caused intermittent failures across feeds, notifications, and search. However, the company stated that there was no evidence of unauthorized access to user data.