GRC Report Staff

On Tuesday, Europe's three financial supervisory authorities publicly endorsed the European Systemic Risk Board's warning that frontier artificial intelligence models are creating systemic cyber risks for the financial sector, lending the combined authority of the continent's banking, insurance, and securities regulators to a concern that has been gathering force for months. Their message was not that artificial intelligence introduces a new category of risk. It was that the pace at which the technology is changing offensive cyber capabilities is beginning to test assumptions that were reasonable only yesterday.

There were 1,205 data breaches reported to the Australian privacy regulator in 2025. The new figures, released by the Office of the Australian Information Commissioner, show an 8% increase over the 1,112 notifications received in 2024. They do not necessarily mean organizations have become less secure; they do show that serious breaches remain a persistent feature of Australian business and government, and that reporting obligations under the Notifiable Data Breaches (NDB) scheme continue to generate a steady stream of disclosures whenever individuals are likely to face serious harm.

The U.S. Federal Trade Commission on Monday issued warning letters to eight companies whose advertising appears to overstate where their products were made. Seven companies were told their products may have been falsely marketed as "Made in the USA," while another received a warning over products advertised as "Made in Texas," despite indications they were imported, either entirely or in significant part.

Artificial intelligence is poised to become one of the defining forces in retail financial services over the next decade, according to a review published Monday by the UK's Financial Conduct Authority, which argues that regulators, industry and government must begin preparing now for a financial system increasingly shaped by autonomous AI.

A cyberattack that corrupts data presents a different kind of crisis from one that simply takes systems offline. Restoring servers is one challenge. Restoring confidence that the information inside them can still be trusted is another. Denmark's financial authorities chose that distinction as the foundation for a new operational resilience exercise whose conclusions reached well beyond the fictional attack itself.

For years, cybersecurity has rested on a bargain that most organizations scarcely questioned. Not every asset could receive the same level of protection, so security leaders concentrated their attention where the consequences of failure would be greatest. The systems most critical to the business became the crown jewels. Everything else received what time, people and budgets allowed. It was an imperfect arrangement, but for a long time it was a practical one.

There is a familiar rhythm to businesses that promise financial independence. The details change with technology but the promise remains durable. There is a system, the system works, and ordinary people need only follow it. The Federal Trade Commission argues that Publishing.com sold precisely that story, and on Thursday the agency formally closed the case with a final order designed to ensure the company cannot tell it the same way again.