Carter Pape

Verizon's 2026 Data Breach Investigations Report finds attackers now break in most often through unpatched software and third-party vendors, not stolen passwords.

Key insight: The investigation makes Belgium the third authority to fault Wise's anti-money-laundering controls, after U.S. state regulators and the CFPB acted last year.

Key insight: Lam's scheme stole directly from TD customers' accounts, unlike the year's earlier TD insider cases, which moved drug money for outside laundering networks.

Key insight : A private-credit fund formerly part of UBS Asset Management is suing the law firm Pillsbury and partner Riaz Karamali, arguing they

Key insight : A community bank disclosed a material cybersecurity incident caused not by a hacker but by its own employee feeding customer data into an unauthorized AI tool.

Key insight: The case is anchored on ads that impersonated a sitting Bank of America executive, Savita Subramanian, to push a fraudulent stock scheme that investors say cost more than $300 million.

Key insight : The same five trade groups are lobbying to kill the SEC's cyber-incident disclosure rule and to preserve a confidential threat-sharing law, which puts their distinction between sharing and disclosing to the test.

Key insight: Banks built their fraud and identity defenses for humans, not for AI agents transacting with a customer's own credentials, the panelists warned.

Major banking trade groups are lobbying the U.S. Securities and Exchange Commission to eliminate a 2023 rule that requires public companies to disclose major cybersecurity incidents within four business days, arguing it can help attackers and harm security. At the same time, the same groups are pushing Congress to preserve a separate law that allows companies to share cyber threat information privately with government agencies, which they say strengthens collective defenses. The industry groups argue that confidential reporting is sufficient for regulators and safer than public disclosure, especially as AI could amplify risks by helping attackers analyze filings.

Key insight : The guidance makes explicit that fraud qualifies for the 314(b) safe harbor, and that a bank need not first identify laundered fraud proceeds to be covered.