October is Cybersecurity Awareness Month, and this year it came with a fitting backdrop. A court put a record price on misleading people about their data, California held its first Delete Week, and several of the month’s largest breaches started with something as ordinary as a stolen login.
This issue covers the news worth knowing, recaps what we published on the Priwall blog in October, and closes with the basic protections I recommend to everyone: a credit freeze, a locked mobile number, multifactor authentication, a password manager, the Do Not Call Registry and, for Californians, DROP. Each one has step-by-step instructions and a link to the official site.
October’s privacy news
A $25 billion verdict against Meta in New Mexico
On October 21, a New Mexico judge ordered Meta to pay $25 billion after a jury found the company had misled consumers about its data privacy practices, including claims that users controlled how their information was shared and that it didn’t sell or share personal information with advertisers (CBS News). The case stems from allegations that a political consulting firm involved in the 2016 Trump campaign obtained data from millions of Facebook users without their consent (Michigan Lawyers Weekly). New Mexico’s attorney general called it possibly the largest state verdict against a company in American history; Meta says it expects to win on appeal (CBS News).
Whatever happens on appeal, the case is a reminder that privacy settings describe what a company says it does, not necessarily what happens to your data once it leaves your hands.
California holds its first Delete Week
CalPrivacy ran its first Delete Week from October 12 to 16 to promote DROP, the state’s free Delete Request and Opt-out Platform. The agency reported that more than 560,000 Californians have registered and that a single DROP request now reaches more than 660 data brokers (CalPrivacy). Brokers active in DROP must complete at least one full processing cycle by October 29 (CIPAWorld).
More changes arrive on January 1, 2027. AB 883 shortens brokers’ deadline to process DROP deletion requests from 45 days to 30 (CIPAWorld). SB 923, the Expanding Privacy Rights Act signed in late September, requires businesses to honor deletion requests even for personal information bought from third parties, lets them keep suppression lists so deleted data stays deleted, and requires online businesses to offer a web form for privacy requests rather than just an email address (CalPrivacy).
Breaches that began with stolen credentials
California families got their own breach notice this month. The California Department of Education said on October 16 that a hacker used compromised login credentials to copy student files from Educational Testing Service, a state testing contractor, between May 22 and September 18; the files included names, birth dates, addresses and disability status (Kaseya). Privacy Guides reported that as many as 5.7 million students could be affected (Privacy Guides); the final count has not been confirmed.
Quest Diagnostics confirmed unauthorized access to its Quanum lab-ordering system, including “certain patient records,” and has not yet said how many patients were affected (TechCrunch). Capcom disclosed exposure of more than 11.7 million CAPCOM ID email addresses, and attackers changed the passwords on 196 accounts to lock their owners out (Privacy Guides).
The pattern matters more than any single incident. Names, birth dates, addresses and email addresses rarely stay in one breach. They get combined with what data brokers already sell, and the result is an identity profile good enough to pass a help-desk check or a carrier’s account verification. That’s why the steps at the end of this issue focus on locking the accounts attackers try to take over first.
Texas makes Temu move Texans’ data
On October 16, Texas announced a $3 million settlement with Temu that requires the company to store Texans’ personal data on U.S.-based, American-owned and controlled servers and to restrict access from China-based individuals and entities (Texas Attorney General). The agreement adds an $8 million penalty for each year a data-security violation occurs (Texas Attorney General).
Recently on the Priwall blog
October was our busiest publishing month yet. In case you missed them:
AI Gave Every Attacker Nation-State Capabilities. Data Brokers Supply the Targets. How AI-driven reconnaissance turns broker records into targeted attacks, and why accurate personal data is becoming the limiting factor for attackers.
California DROP After 3 Months: What the Results Mean for Employers What the first three months of DROP results show, what they don’t, and where employers still have gaps for executives and employees outside California.
The Midterms Will Decide Your Privacy Rights, and the Irony Is States’ Rights Why federal preemption and the coming election could reshape state privacy protections like California’s.
Lock Your Phone Number Before Someone Else Moves It A step-by-step guide to port-out and SIM locks at Verizon, T-Mobile and AT&T.
Bruce Schneier Told Congress: Deleting Broker Data Is a Matter of National Security What Schneier’s congressional testimony means for enterprise security teams today.
After the FBI Breach, Employee Data-Broker Exposure Is an Enterprise Emergency Why reducing employees’ broker exposure belongs in every breach response plan.
Five protections everyone should have in place
None of these replaces the others. A credit freeze won’t stop an account takeover, and MFA won’t stop someone from opening a loan in your name. Together they close the most common doors.
1. Freeze your credit at all three bureaus
A credit freeze stops lenders from pulling your report, which blocks most new-account fraud. It’s free to place and lift, and you need to do it separately at each bureau. Online or phone requests take effect within one business day, and you can lift a freeze within an hour when you need to apply for credit (USAGov).
Create an account (or call) at each bureau:
Equifax: equifax.com credit freeze or 888-298-0045
Experian: experian.com freeze center or 888-397-3742
TransUnion: transunion.com credit freeze or 800-916-8800
Verify your identity and request the freeze.
Save your login or PIN for each bureau in your password manager. You’ll need it to lift the freeze later.
Repeat for your children if they’re minors; child identities are a common target because the fraud can go unnoticed for years.
2. Lock your mobile number with your carrier
Your phone number is the recovery key for your bank, email and work accounts. In a SIM swap or port-out attack, someone convinces your carrier to move your number to their device and then receives your text-message security codes. Turn on both a transfer (port-out) lock and a SIM-change lock, and set a strong account PIN that isn’t your birthday, address or the last four digits of your number (Priwall guide).
Verizon: In the My Verizon app, tap Me, then Edit profile and settings, then Security. Turn on Number Lock and SIM Protection for each line (Verizon).
T-Mobile: In the T-Life app, add Port Out Protection under Manage add-ons for each line, then turn on SIM Protection under Security settings. You can also review T-Mobile’s port-out PIN guidance (T-Mobile).
AT&T: In the AT&T app, tap the person icon, scroll to Wireless Account Lock and swipe to lock. This blocks number transfers, SIM swaps and billing changes (AT&T).
Other carriers and prepaid brands: Look for settings called port protection, number lock or SIM lock, or call and ask for both a port-out block and a SIM-change block.
3. Turn on multifactor authentication, starting with email
Start with your primary email account, because it resets everything else, then move on to banking, your password manager, social media and your mobile carrier account. CISA ranks the options from strongest to weakest: a physical security key, an authenticator app with number matching, an authenticator app with one-time codes, biometrics, and finally text or email codes, which should be a last resort (CISA). Where a site offers passkeys, they’re a good alternative to passwords plus codes.
Open the account’s Security or Login settings.
Look for “two-step verification,” “two-factor authentication” or “passkeys.”
Choose a security key or authenticator app if offered, and move off SMS once a stronger option is set up.
Save the backup codes in your password manager.
4. Use a password manager
Reused passwords are how one breach becomes five. CISA recommends passwords of at least 16 characters, random and unique for every account, generated and stored by a password manager. You only have to remember one long passphrase for the manager itself (CISA).
Choose a reputable password manager; the one built into your phone or browser is a reasonable start.
Protect it with a long passphrase and turn on MFA for the manager.
Import saved browser passwords, then use the manager’s security report to replace weak or reused ones, starting with email, banking and your carrier account.
If you get a breach notice, such as from the Capcom incident above, change that password right away and anywhere you reused it.
5. Register with the FTC’s National Do Not Call Registry
Registration is free and never expires (FTC). It won’t stop scammers, who ignore the law anyway, but it cuts down legitimate telemarketing so suspicious calls are easier to spot.
Go to DoNotCall.gov/register and enter up to three numbers plus an email address, or call 1-888-382-1222 (TTY 1-866-290-4236) from the phone you want to register (FTC).
If you register online, open the confirmation email and click the link to finish.
Give it about a month. Telemarketers must check the registry at least every 31 days (DoNotCall.gov).
Report unwanted sales calls at DoNotCall.gov after that.
California residents: Sign up for DROP
If you live in California, DROP is the single most efficient privacy step available to you. It’s free, most people finish in under 10 minutes, and one request goes to more than 660 registered data brokers (CalPrivacy).
-
Visit the official DROP website. Go to consumer.drop.privacy.ca.gov and accept the terms of use.
-
Verify your California residency. Complete verification through the California Identity Gateway, which uses Login.gov or Socure (DROP).
-
Add your personal identifiers. Enter the name, date of birth, email addresses and phone numbers you want brokers to match against. More identifiers usually mean more matches. Enter information about yourself only. Each household member needs their own request.
-
Submit your request. Save your DROP ID so you can check the status of your request later.
-
Check your request status. Brokers must process requests at least every 45 days (DROP), dropping to 30 days in January 2027.
The takeaway
Most of October’s breaches didn’t need a sophisticated exploit. They needed a working password or enough personal details to pass as someone else. Pick the step on this list you haven’t done yet and finish it this week. Your credit freeze and carrier lock take less time than reading this newsletter.
Your personal data is exposed. It's time to take it back.
Priwall by mePrism continuously finds and removes personal information from data brokers and people-search sites, and monitors for reappearance. Whether you're protecting yourself, your family, or an entire workforce, reducing exposure starts here.
Explore more from Our Team
Browse more posts written by our team to help you stay in control.
Be Part of the Conversation
