Carter Pape

Banking professionals recently named AI fluency the top skill their organizations need as AI takes hold and ranked pure software-development skill last.

Key insight: Washington's Data Breach Disclosure Law sets a 30-day ceiling on notification, measured from discovery; Columbia's delay was nearly four times that.

Key insight: The credit union says it caught a post-Hurricane Milton account-takeover spike on its fraud vendor's dashboards before members noticed anything was wrong.

| Key insight: Yotta's own executives privately distrusted Synapse before moving customer money there; the consent order quotes CEO Adam Moelis predicting Synapse would "f*** everything up."

Key insight: Anthropic's NDA carve-out lets JPMorganChase, the only bank among Project Glasswing's named launch partners, formally share Mythos-surfaced vulnerabilities with community and regional banks for the first time.

Key insight: This is the second OCC enforcement action against Community Federal Savings Bank since 2020, and the 2020 order had specifically required the bank to write a strategic plan that controlled BSA/AML risk.

| Key insight: Device-code phishing bypasses multifactor authentication by stealing the session token a user receives after passing the multifactor check.

Key insight : The ECB is the first eurozone supervisor to lean on banks directly over the cyber threat from frontier AI models like Mythos, pressing for far faster patching.

Verizon's 2026 Data Breach Investigations Report finds attackers now break in most often through unpatched software and third-party vendors, not stolen passwords.

Key insight: The investigation makes Belgium the third authority to fault Wise's anti-money-laundering controls, after U.S. state regulators and the CFPB acted last year.