Mozilla research found that period tracker Stardust shares users' health data with an analytics company, revealing significant privacy gaps among menstrual health apps. The findings highlight inconsistent data protection practices across the category.
Mozilla's privacy testing identified stark differences in how period tracker apps handle sensitive user information. Stardust was found sharing health data with an analytics firm, raising concerns about user consent and data security.
In contrast, another app tested by Mozilla maintained stronger privacy protections, described as "squeaky clean" in its data handling practices.
The research underscores the need for greater transparency in period tracking applications, which collect intimate health information. Users often have limited visibility into where their data goes or how it's used.
Period trackers have faced heightened scrutiny following the 2022 U.S. Supreme Court decision overturning federal abortion protections. Privacy advocates warned that menstrual data could potentially be accessed by law enforcement or used against individuals in states with abortion restrictions.
The Mozilla findings suggest that privacy protections among period tracker apps remain inconsistent, leaving some users vulnerable to unexpected data sharing with third parties.
An SQL injection vulnerability in the All-in-One WP Migration and Backup plugin exposes WordPress sites to remote code execution and complete takeover by unauthenticated attackers.
An identity theft search site claimed to possess over 150 million driver's license photos stolen from a major ID verification service. The crime site has since been shut down.
Iran-linked hackers have compromised approximately 100 American water utilities in a sustained campaign targeting critical infrastructure. The EPA is allocating $11 million in funding to strengthen cybersecurity defenses across water systems.
Attackers exploited BGP routing vulnerabilities to redirect Virtualizor VPS management software update requests to malicious servers. The compromise affected users attempting to download legitimate updates for the widely-used hosting control panel.