Privacy Intelligence Quarterly — Q2 2026

April – June 2026

Q2's defining pattern was not a single breach, actor, or platform. It was the way exposed personal, corporate, and family data has become working material for attackers: used to select a target, time an approach, and make an impersonation credible. The privacy problem and the security problem now overlap: the same exposed data that compromises an individual can also enable account takeover, supplier compromise, executive targeting, and board-level risk.

Top Exposure Events

Three Q2 analyses show the shift.

The European Commission was breached through its own security tooling. On April 2, CERT-EU confirmed that the Commission's cloud infrastructure had been compromised via a poisoned version of Trivy, a widely trusted open-source vulnerability scanner, used to steal AWS credentials from its CI/CD pipelines. CERT-EU attributed the initial access to a group tracked as TeamPCP; ShinyHunters, the group behind the Odido breach, later published 91.7 GB of the data: an SSO user directory, DKIM signing keys, and material from the EU's military financing mechanism. The institution drafting Europe's cybersecurity laws was reached through the supply chain beneath it.

LexisNexis confirmed its second breach in fourteen months. A company whose business is selling identity verification and risk intelligence confirmed a March 2026 incident, roughly a year after a 2025 breach of its Risk Solutions arm. The point is not that brokers are uniquely careless. It is that they are exposed to the same breach dynamics while holding data you never chose to give them.

One consulting firm's GitLab exposed hundreds of client organisations. A breach of Red Hat's self-managed consulting GitLab instance reached roughly 28,000 internal repositories of engagement material. The Nissan downstream disclosure three months later confirmed the pattern: organisational exposure now includes the systems of firms retained to build, advise, host, or manage it.

Data Broker Developments

The broker layer spent the quarter getting quieter and more capable.

Data clean rooms now merge data about you, build a profile sharp enough to target you, then decline to store it, a design that sidesteps the usual breach and retention questions while still assembling the profile. AI tools inside sales stacks work from the other direction: some take a licence to absorb the contacts you upload and resell them, turning the buyer into the supplier. And the friction you hit trying to opt out is structural rather than accidental: working removal links lower subscription revenue.

The legal position is more favourable than the friction suggests. Removal is enforceable across the EU under GDPR Articles 17 and 21, where the "legitimate interest" brokers rely on rarely survives a proper balancing test, and the UK's Data (Use and Access) Act 2025 leaves individual GDPR action doing what the ICO increasingly does not. The data broker ecosystems hub maps who holds what, and where removal is possible.

Technique Watch

Two credential shifts are worth understanding this quarter.

First, stealer logs sit beyond what dark-web alerts catch. A single infected device can yield a password-manager vault, a corporate VPN credential, and a live session in one package, and a live session cookie lets an attacker skip the password and the MFA prompt entirely. SpyCloud recaptured 642.4 million exposed credentials from 13.2 million infostealer infections in a single year. Monitoring catches part of the commodity layer; it does not reliably catch the operator who buys fresh access before it appears in a broadly visible feed.

Second, targeting has moved from a gamble to a calculation. A breached lead database hands over a working org chart, and a findable footprint tells an attacker who to approach and when. The starting key is often just an email address; our credential leaks hub covers what circulates and how to read it.

Three Actions for Q3

1. Audit the account layer. For primary email, messaging, financial, cloud, SSO, and password-manager accounts, review linked devices, recovery emails and phone numbers, passkeys, OAuth grants, and active sessions. Remove anything unrecognised and revoke unknown sessions. Treat a live session cookie as a credential in its own right.

2. Run a broker and enrichment check. For executives, key staff, principals, and family members, check major people-search and address platforms for home addresses, phone numbers, family relationships, employer details, and director records. This is the material that makes a cold approach credible.

3. Reduce timing signals. Public posts, press, event pages, hiring announcements, travel notes, conference schedules, transaction activity, and board appointments can tell an attacker when to move. The issue is not publicity itself; it is predictable timing attached to a reachable person.

For Organisations and Their Advisers

For organisations, the practical question is not whether this belongs to privacy, security, legal, or risk. It touches all four. Third-party exposure now runs in both directions: when a law firm or supplier is breached, the data exposed is its clients'; when outside firms are retained, their internal systems can become part of the organisation's exposure surface. Alongside it, the executive and staff data that makes social engineering credible is the human layer no infrastructure scanner maps. For boards, that exposure is a duty-of-care and third-party risk input under NIS2 in the EU and SEC disclosure expectations in the US, and the half of the surface most programmes under-audit.

For teams reviewing this at organisational level, the relevant starting point is not a tool feed. It is an exposure assessment: which people, vendors, credentials, and public records make the organisation easier to target than it appears from inside the perimeter.

The Quarter in One Line

The extortion economy has industrialised around named-individual exposure: Qilin alone claimed 141 organisations in a single thirty-day window, more than any other operation. Whether the reader is a principal, an adviser, or a board, the exposed material is the same input the attacker works from.

The work is not to disappear. It is to reduce the parts of the profile that make you easy to select, easy to time, and easy to pressure.

If you want an external read of what's currently exposed rather than another self-checklist, start with a free Snapshot Scan. Or reply to this email if a specific development here affects you or your organisation.

— Privacy Insight Solutions