Compliance Pulse

France's national cybersecurity agency, ANSSI, has announced it will halt certification of security products that lack quantum-resistant encryption (encryption designed to resist attacks from quantum computers, which can break many current standards) starting in 2027, as reported by Schneier on Security. Government agencies and critical infrastructure operators in France are required to use ANSSI-certified products, making this a practical phase-out deadline. Businesses supplying the French public sector should begin evaluating quantum-safe alternatives now — 2027 is closer than it sounds.

A case study by Ransom-ISAC points to a US county government that quietly paid roughly $1 million in bitcoin to prevent stolen files from being published, according to The Hacker News. No systems were locked. No encryption was involved. The attackers stole data and charged for silence. The payment was never publicly disclosed. This case reinforces why public sector bodies need data exfiltration (unauthorised theft of data) response plans that are distinct from ransomware playbooks, and why paying does not guarantee files are deleted.

The Citizen Lab's findings about MEP Stelios Kouloglou carry a direct policy implication: Pegasus was apparently deployed against a member of the EU's own investigative committee while it was actively probing Pegasus abuse. The PEGA Committee ran from March 2022 to mid-2023 and produced formal recommendations for restricting commercial spyware across the bloc. If committee deliberations were accessed during drafting, the integrity of that process is now a live question for EU regulators. Read the full Citizen Lab report here.

A US Supreme Court ruling that allows presidents to remove members of independent agencies at will has thrown the EU-US Data Privacy Framework (DPF) — the legal agreement that permits European personal data to flow to US companies — into doubt. Privacy advocate Max Schrems, who has successfully invalidated two previous versions of this agreement in European courts, has announced plans to sue again, arguing the FTC (Federal Trade Commission) can no longer be considered independent. The DPF underpins an estimated $1.9 trillion in annual transatlantic trade. If it collapses, businesses transferring EU user data to US servers would need to find alternative legal mechanisms fast. Full story at The Record.

CISA has added CVE-2026-45659, a remote code execution flaw in Microsoft SharePoint Server, to its Known Exploited Vulnerabilities (KEV) catalog, according to The Hacker News. Any authenticated user with basic site access can exploit it — no admin privileges needed. Microsoft patched it in May 2026. Federal agencies must apply the fix by 4 July 2026. If your organisation runs SharePoint Server on-premises, this is not optional.

The US Federal Trade Commission has fined Amazon $2.25 million for violating the Fair Credit Reporting Act by withholding transaction records from identity theft victims, according to Bleeping Computer. The law requires companies to hand over fraud records within 30 days of a request. Amazon repeatedly refused, cited "privacy" as justification, and in some cases blocked law enforcement requests made on victims' behalf. Under the settlement, Amazon must now comply with requests within 30 days and notify affected consumers who were denied records since April 2024.

If you have ever been a victim of fraud involving an Amazon account, you are now entitled to request those records.

CISA has updated its Known Exploited Vulnerabilities (KEV) Catalog to confirm that ransomware groups are actively exploiting CVE-2026-33825, a Microsoft Defender privilege escalation flaw known as BlueHammer, according to Bleeping Computer. The flaw allows a local attacker to access password data and escalate to full system control. Microsoft patched it on 14 April 2026. Federal agencies were ordered to patch by 7 May. If your Windows devices have not received the April Patch Tuesday update, that changes today.

The National Association of Insurance Commissioners (NAIC), the US body that coordinates insurance regulation across states, has confirmed a breach via a zero-day vulnerability (a flaw unknown to the developer at the time of exploitation) in Oracle PeopleSoft, the software it uses for internal financial reporting, according to Infosecurity Magazine. The breach was first detected on June 11 and publicly disclosed on June 17. Credit rating agency data was accessed and published by the attacker. Personal information of policyholders and payment data were not compromised. The NAIC says FBI coordination is underway and operations have largely returned to normal.

The education sector logged 1,252 data breaches last year, according to Verizon's 2026 Data Breach Investigations Report, with 65% of malware-related attacks involving ransomware. The core problem, as Dark Reading reports, is third-party software risk. A single breach of a widely used platform can hit thousands of schools at once — as happened with Canvas and MOVEit.

For schools and universities, the regulatory implication is clear: vendor contracts must include security requirements and breach notification terms. If your institution relies on third-party platforms, ask your vendors what their incident response plan looks like — before you need to find out the hard way.

CISA has added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog and given federal agencies until June 28 to patch both, per Bleeping Computer.

The first is CVE-2026-20230, a server-side request forgery (SSRF) flaw (where an attacker tricks a server into making requests on their behalf) in Cisco Unified Communications Manager. The second is CVE-2026-12569, a critical flaw in PTC Windchill, a product lifecycle management platform used by manufacturers. Both are under active exploitation right now. Federal agencies must act by Sunday. Private organisations using either product should treat that deadline as their own.