July–September 2026 · October 2026 Edition

The Information Behind a Convincing Approach

A home address in a financial firm’s records. A donation history held by a charity. A personal mobile number sold with an executive’s job title. Each can give a stranger enough context to make an approach sound familiar.

Q3 brought breaches affecting financial and charitable records, new evidence of automated profiling, and the first processing of California’s centralised broker-deletion requests. For principals and their advisers, the task is to establish what has changed and which decisions follow.

Top Breach Analysis

Apollo: personal information inside a financial institution. In its 21 August notification, Apollo reported unauthorised access to certain cloud platforms between 6 and 10 July following a social engineering incident. Potentially affected information included names, dates of birth, contact details, home addresses, and Social Security numbers. The notice did not identify the affected population as investors or give a victim count. At notification, Apollo reported no evidence of public posting or identity fraud. Apollo’s notice.

If you received a notice, establish which fields concern you. An address, identifier, or contact record calls for a different response from a compromised password. Information can remain exposed before any misuse becomes visible.

Beacon: charitable relationships inside a shared database. Beacon’s September final report describes an intruder using a stolen access key on 27 July to copy its customer database. Data-transfer evidence suggested substantial downloads, although the exact contents could not be established. The provider found no evidence that a particular charity had been deliberately targeted. Beacon’s final report.

One affected charity, Langham, identified potentially involved information including contact details, donation and Gift Aid records, and event registrations. Those fields describe a relationship as well as a person. Langham’s notification.

For donors, trustees, and their advisers, the concern is what a caller could know about a genuine charitable relationship. Donation and event details could support a plausible request for further funds. When reviewing a notification, identify which requests your office should independently verify. Our guide to reading a breach notice explains how to separate confirmed findings from precautionary language.

OSINT Technique Watch

Public fragments can become a personal dossier. Anthropic’s September report documented social-media profiling and dossier preparation in activity observed between December 2025 and August 2026. Many surveillance cases involved state-linked targeting of dissidents and diaspora communities. The findings demonstrate methods; they do not measure the prevalence of executive targeting. Anthropic’s report.

The relevant capability is connecting information across sources. A biography establishes a role. A foundation page adds relationships. An event programme supplies a date and place. Together, those references can support a more informed approach than any one page permits.

An exposure review needs to test those connections. Automated profiling can also produce mistaken identities and unsupported associations. A convincing dossier is still a collection of claims requiring evidence.

Before a public appointment, transaction, or increase in visibility, review what the combined record reveals. Where a specific concern warrants investigation, The Shield scopes the assessment around that concern and distinguishes sourced findings from interpretation.

Data Broker Developments

Read the removal result. Our August special examined what removal can change. California’s DROP platform now gives eligible residents results to inspect, with different meanings attached to each status.

Broker processing obligations began on 1 August. Official guidance allows up to 90 days for status reporting and distinguishes several outcomes. “Deleted” concerns matched, non-exempt information. “Record not found” can mean no record exists or that the identifiers supplied did not locate it. “Exempted” means information is retained under a statutory exemption. Official DROP guidance.

These are materially different results. Keep the response, date, and identifiers used alongside any independent check. A public listing disappearing and a broker confirming deletion are different forms of evidence; neither establishes that every copy has gone.

DROP eligibility depends on California residency. For clients elsewhere, the same discipline applies to the removal routes available in their jurisdiction. This is also how outcomes are distinguished in The Eraser: unresolved, partial, or refused requests remain visible in the record.

Regulatory & Legal Updates

Europe: AI transparency obligations now apply. Article 50 of the EU AI Act became applicable on 2 August, including obligations concerning certain AI interactions and synthetic content. Requirements differ between providers and deployers, with defined scope and exceptions. Communications teams using synthetic representations of a principal should check which duties apply. European Commission guidance.

An absent AI label provides no assurance that a message is authentic. Verify sensitive instructions through an established contact route, regardless of how convincing the content appears.

United States: professional-contact brokers are within enforcement scope. On 1 September, CalPrivacy announced a $36,400 penalty against SalesIntel Research for late registration. The decision also required changes including DROP participation. The regulator described a business selling professional contacts, mobile numbers, and career-change inferences. CalPrivacy’s announcement.

An executive’s mobile number and current role belong in an exposure assessment, including when they are held in a commercial database rather than displayed on a public people-search page. Enforcement against a broker is a reason to check your position; any deletion outcome still needs its own evidence.

Threat Landscape Overview

Private equity and law firms drew targeted approaches. Google Threat Intelligence Group’s 6 August report described July targeting by UNC6671 focused on private equity firms, law firms, and financial rating agencies. Its reporting links several extortion brands to overlapping activity. Google’s investigation.

In this campaign, callers posing as IT support approached employees on personal mobile numbers. Some used urgent passkey or authentication-enrolment instructions to direct people to false login pages. Apollo’s notification does not name this group.

An executive office’s verification process must cover requests arriving outside corporate email and remain usable when the principal is travelling or unavailable. A caller’s knowledge of the organisation is insufficient authority to change access.

Practical Recommendations

1. Give breach notifications an owner. The private office or relevant adviser should record which fields concern the individual, what remains uncertain, and who will follow up. Include personal service providers and charities where relevant. Brief the people who handle requests on the principal’s behalf without circulating unnecessary sensitive detail.

2. Rehearse the unexpected security call. The executive assistant and security lead should agree how to verify account-enrolment, recovery, and payment instructions through an independently established contact route. Staff need explicit permission to pause, including when a request appears to come from the principal. Verification should not depend on recognising a voice or detecting a visual flaw; our executive verification guide sets out the process.

3. Review what has changed since the last assessment. A new role, address, event, adviser, or household connection can change which information matters. Compare with the report you retained or the reference profile agreed for a current engagement. Review outstanding removal outcomes and assign a next check where necessary.

Looking Ahead: Q4 and Early 2027

Three confirmed milestones will change the privacy controls available over the coming months. Each warrants a specific check.

November 2026: review the first DROP cycle. CalPrivacy’s timetable says brokers should have completed their initial download-and-upload cycle by November. Early applicants should review the reported outcomes, check unresolved statuses, and distinguish completed processing from confirmed deletion. CalPrivacy’s timetable.

By year-end: EU digital identity wallets are due. Member States must provide wallets by the end of 2026 under the European framework. Selective disclosure is a central feature: the ability to prove a particular attribute without handing over every detail on an identity document. European Commission framework.

Use is voluntary. Before relying on a wallet, check which services accept the credentials you need. Where accepted, it may reduce routine copying of identity documents. Private offices should also check the issuer, requested information, and recovery arrangements before adoption. Commission’s wallet guidance.

1 January 2027: California’s browser opt-out requirement arrives. The Opt Me Out Act requires browsers to offer an opt-out preference signal, making it easier for Californians to communicate a sale-and-sharing preference across websites. Some browsers already support such signals. This control complements deletion requests; it does not erase historical breach copies or prevent every form of collection. CalPrivacy’s explanation.

Our expectation: removal will face closer scrutiny of outcomes. As centralised requests become easier to submit, we expect more attention to matching failures, exemptions, and records that remain accessible. Clients should judge a removal service by its relevant coverage and documented outcomes as well as the work it saves. We will watch for published enforcement findings and measured results before drawing conclusions about DROP’s effectiveness.

Our security outlook: accurate context will become a weaker signal of legitimacy. We expect the profiling methods documented this quarter to make a convincing approach easier to prepare. Check who is asking, through which channel, and whether they have authority to give the instruction. A familiar voice, face, or detail cannot settle those questions on its own.

For Q4, the priority is a current picture of exposure and a verification process that the people around you can actually use.

If a development here affects you or someone you advise, reply with the concern. We can assess whether your existing work covers it or a further review is warranted.

— Privacy Insight Solutions

Sources checked 3 October 2026.