Zack Whittaker

In 2025, I found 3 popular apps leaking sensitive user data thanks to simple security bugs. In this *very* deep-dive for subscribers, this is how I use network analysis tools (like Burp) to understand how apps and websites work & share your data — and how you can, too!

I explain how to get started with Burp and similar browser tools, we'll explore API basics, how to understand network requests, and how to get started. I'll also include examples for you to follow along.

https://this.weekinsecurity.com/a-beginners-guide-burp-suite-analyzing-network-traffic-of-apps-and-websites/

Meta is facing a new lawsuit over its AI smart glasses, after a news investigation found subcontractors are reviewing footage from customers' glasses, which "included sensitive content, like nudity, people having sex, and using the toilet."

https://techcrunch.com/2026/03/05/meta-sued-over-ai-smartglasses-privacy-concerns-after-workers-reviewed-nudity-sex-and-other-footage/

U.S. and EU police say they've taken down LeakBase, “one of the world’s largest online forums for cybercriminals” for sharing stolen passwords and hacking tools.

The site now displays a seizure notice.

https://techcrunch.com/2026/03/04/u-s-and-eu-police-shut-down-leakbase-a-site-accused-of-sharing-stolen-passwords-and-hacking-tools/

It's absolutely insane to me that in this day and age a company would reject end-to-end encryption so that cops and feds can actively read people's messages. It also puts that same data at risk from hackers. But that's TikTok, under new U.S. ownership.

https://www.bbc.com/news/articles/cly2m5e5ke4o

If you like my reporting, you might also like my free weekly cyber newsletter ~ this week in security ~ which packs in all the news you can use from the week, plus sections dedicated to good news and a reader-submitted cyber-cat. Goes out on Sundays by email & RSS. Newsletter archive & blog online. 🐈‍⬛

https://this.weekinsecurity.com

In 2020, the FBI came to my house to try to ask me questions about a story I'd written. I declined.

I wrote about the back-story of what happened that day and after, my outstanding questions, and why press freedoms have taken a major step back under Trump's second term.

More: https://this.weekinsecurity.com/fbi-agents-visited-my-home-about-an-article-i-wrote-and-now-i-cannot-go-to-mexico/

Uhh, whoops. https://techcrunch.com/2026/02/18/microsoft-says-office-bug-exposed-customers-confidential-emails-to-copilot-ai/

Prosecutors have confirmed for the first time that Peter Williams, the former boss of L3Harris' Trenchant unit (which makes hacking and surveillance tools for the U.S. govermment and its allies), sold the company's exploits to a Russian broker that were capable of accessing "millions of computers and devices" around the world. Williams, who pleaded guilty, is expected to be sentenced in the next two weeks. https://techcrunch.com/2026/02/11/doj-says-trenchant-boss-sold-exploits-to-russian-broker-capable-of-accessing-millions-of-computers-and-devices/

New, by @lorenzofb@infosec.exchange: Google sent personal and financial data about a student and journalist, who attended a pro-Palestine protest in 2024, to ICE agents in response to an "administrative subpoena," which had not been approved by a judge.

https://techcrunch.com/2026/02/10/google-sent-personal-and-financial-information-of-student-journalist-to-ice/

For my newsletter and blog, I wrote about how Apple's Lockdown Mode, once billed as an "extreme" security protection for iPhones, iPads, Macs and Watches, has passed a major real-world test by blocking the feds from accessing a journalist's phone.

Free to read; with additional words, advice, and guidance for paying subscribers: https://this.weekinsecurity.com/apple-lockdown-mode-once-an-extreme-security-protection-now-a-necessity-for-americans/

Sign up/RSS for the weekly newsletter: https://this.weekinsecurity.com

SCOOP: A hacktivist has scraped more than half a million payment records from a company that makes consumer-grade spyware and other phone tracking apps, exposing customers' email addresses and partial card payment numbers. TechCrunch verified the scraped data is authentic. By @lorenzofb@infosec.exchange and me: https://techcrunch.com/2026/02/09/hacktivist-scrapes-over-500000-stalkerware-customers-payment-records

The world is on fire, but here's a nice thing. A few months ago, a pigeon laid two eggs under our outdoor furniture on our balcony. We put a camera in there to keep an eye. The eggs hatched, survived, grew up, flapped their wings, and left the nest. :) Here's what happened & what we learned.

New, by me: I wrote some words for TechCrunch about Sen. Ron Wyden's recent unclassified letter to the CIA director, citing his "deep concerns" about the agency's activities. This isn't the first time Wyden has sounded his "siren" — and history tells us why this new letter is likely a big deal.

https://techcrunch.com/2026/02/06/senator-who-has-repeatedly-warned-about-secret-u-s-government-surveillance-sounds-new-alarm-over-cia-activities/

NEW, by me: Govtech giant Conduent says a January 2025 data breach (ransomware) now affects significantly more people than first disclosed, with the number of victims who had personal and medical data stolen now stretching to tens of millions of people across the United States.

Conduent says its business operations support over 100 million people.

https://techcrunch.com/2026/02/05/data-breach-at-govtech-giant-conduent-balloons-affecting-millions-more-americans/

🚨 This is what we call a "Wyden siren." For those who don't know, Ron Wyden (D-OR) is one of the longest serving members of the Senate Intelligence Committee. https://www.wyden.senate.gov/imo/media/doc/wyden_letter_to_d-ciapdf.pdf

I wrote a story about how Homeland Security is using administrative subpoenas, which aren't subject to judicial oversight, to seek data from tech giants about Trump critics and anonymous accounts of ICE trackers. Features some really great reporting by Bloomberg & Washington Post. https://techcrunch.com/2026/02/03/homeland-security-is-trying-to-force-tech-companies-to-hand-over-data-about-trump-critics/

ICE and Homeland Security are abusing its authorities to tap Google for information with administrative subpoenasa about Trump critics. https://www.washingtonpost.com/investigations/2026/02/03/homeland-security-administrative-subpoena/

NEW, by me: A security and privacy feature rolled out to select models of the latest iPhones and iPads this week will make it more difficult for law enforcement, spies, and malicious hackers to obtain a person's precise location data from their phone provider.

https://techcrunch.com/2026/01/29/apples-new-iphone-and-ipad-security-feature-limits-cell-networks-from-collecting-precise-location-data/

Daily Beast reports that a DHS whistleblower has leaked the personal details of around 4,500 ICE and Border Patrol employees. The data is said to include about 1,800 on-the-ground agents and 150 supervisors. https://www.thedailybeast.com/personal-details-of-thousands-of-border-patrol-and-ice-goons-allegedly-leaked-in-huge-data-breach/

Betterment was hacked and users' personal data compromised, but you might not know it because the company hid its data breach notice with a "noindex" tag in its web page source code. This tells search engines to ignore the page so people won't see it in search results.

More from TechCrunch: https://techcrunch.com/2026/01/12/fintech-firm-betterment-confirms-data-breach-after-hackers-send-fake-crypto-scam-notification-to-users/

Mac users found their Logitech mice stopped working because someone at Logitech forgot to renew an expired app certificate. * pinches bridge of nose and sighs loudly for the rest of time * https://www.theverge.com/news/857377/logitech-macos-logi-options-mouse-certification-fix

Business Insider reports that Oura is planning to expand its Oura wearable rings beyond health tracking to allow for payments, authentication, and more. Well, Capitan Buzzkill (me) here wrote about Oura's security and privacy practices earlier this year, and found: • Oura rings *don't* end-to-end encrypt users' health data; • As such, Oura *can* access its users' data; • Oura told me that the company *has* received U.S. government demands for users' data. More: https://this.weekinsecurity.com/oura-ring-deal-raises-valid-concerns-about-users-health-data-security/

NEW: Cellebrite, maker of phone unlocking tech, to buy mobile testing startup Corellium for $170 million.

https://techcrunch.com/2025/06/05/phone-unlocking-firm-cellebrite-to-acquire-mobile-testing-startup-corellium-for-170m/