Digital Risk Report, October 2026

Welcome to the October edition of Shumaker’s Digital Risk Report.

October is Cybersecurity Awareness Month, a timely reminder that cyber resilience depends on people, processes, and vendors as much as technology. This month’s developments show why. The past several weeks have been some of the busiest of the year for cybersecurity, data privacy, and artificial intelligence (AI). A cyberattack on a federal contractor shut down the system that serves notices for every U.S. bankruptcy court. Federal and state regulators kept up their enforcement pace, from an FTC action against a “sextortion assistance” company to a Texas settlement with Temu over data practices. In Europe, a regulator fined Microsoft’s Xandr €8.5 million after a complaint from noyb. California also closed its 2026 legislative session with a sweeping package of privacy and AI laws. That package includes SB 690, which changes the landscape for website-tracking litigation under the California Invasion of Privacy Act (CIPA).

In this issue, we summarize these developments and what they mean for your organization. As part of Cybersecurity Awareness Month, we encourage organizations to refresh employee training on phishing and social engineering, test incident response plans, confirm that multifactor authentication is in place, and review the security practices of critical vendors and contractors.