1. Cybercrime & Cybersecurity
1.1. Cybercrime
Cybercrime Takedown : The OFAC (Office for Combating Cybercrime) announced the first takedown of a data marketplace in France: Reacher/Stryxx, a platform specializing in the resale of stolen data that claimed to have 730 million indexed data records (Press release dated October 8th, 2026).
Cyber Threat Overview : According to the annual cyber threat overview from ENISA (the European Union Agency for Cybersecurity), cybercrime remains a major threat, both within the EU and globally, accounting for 36% of all incidents (Press release dated September 22nd, 2026).
Crypto-assets and crime: In its 2025 activity and impact report, Tracfin highlights the growing use of crypto-assets for money laundering and to circumvent the law. Reports involving crypto-assets notably doubled in 2025. (Press release dated September 28th, 2026)
Cyberattack : Scribd has confirmed that it was the victim of unauthorized access to its systems, resulting in the exposure of data associated with user accounts on Scribd, Everand, SlideShare, and Fable. The exact nature of the compromised data remains unknown. Scribd recommends resetting passwords and remaining vigilant against phishing attempts (Press release dated September 30th, 2026).
Cyberattack : AFPA was the victim of a cyberattack that may have compromised the personal data of nearly 1.7 million people. Banking information is not believed to have been affected, but the exposed data could be used for fraud or phishing (Press release dated September 21th, 2026)
Payment Fraud: The latest report from the Banque de France’s Payment Security Observatory warns of a sharp increase in fraud involving tampering (+34% year-over-year), which is projected to total 516 million euros in 2025 and account for 41.6% of total payment fraud (Press release dated September 7th, 2026).
Organised crime: Europol analyses the most threatening criminal networks in the European Union and highlights their ability to capitalise swiftly on opportunities, diversify their activities and adapt to technological and economic developments. In particular, the report emphasises their increasing use of digital services, legitimate business structures and corruption to facilitate their criminal activities (Europol report of 21 August 2026)
1.2. Cybersecurity
Quantum Threat : Europol warns of the so-called “harvest now, decrypt later” threat, in which criminal actors are currently collecting encrypted data in the hope of decrypting it once quantum computing becomes capable of breaking current asymmetric cryptography (RSA, ECC), and assesses the technical feasibility of this, the data and actors at risk, as well as the specific scenarios law enforcement agencies might face (Press Release dated October 7th, 2026).
Medical Security Breach : CERT-FR, responsible for issuing alerts about cyber threats, and CERT Santé, which specializes in the healthcare sector, are warning of persistent vulnerabilities in healthcare software—some of which have gone unpatched for several years. These practices could face harsher penalties once the Cyber Resilience Act takes full effect in December 2027 (Press release dated October 7th, 2026).
ANSSI : ANSSI has released an initial status update on Operation REACTIV, which was launched on September 1 at the request of the Prime Minister following a surge in cyberattacks linked to data breaches affecting government agencies this summer (Press Release dated September 30th, 2026).
Cybersecurity and public finances: ANSSI has published its incident report on the cyberattacks targeting the French Public Finance Directorate (DGFiP), detailing the attack methods used, the measures implemented to contain the attacks, and the lessons learned to strengthen the security of public-sector information systems (Press release dated September 29th, 2026).
AI Development: Last June, an OpenAI AI agent gained unauthorized access to an Australian government portal. The incident was not discovered until August. The Australian Security Agency (ASD) is investigating whether any other systems were compromised. (Press release dated September 24th, 2026)
AI and Cybersecurity : Google’s Gemini artificial intelligence gained access to the systems of three companies during a cybersecurity test. The model used passwords that it had guessed or retrieved from public repositories to access the systems in question, before ceasing its actions once it identified that they were real companies (Press release dated September 18th, 2026).
ANSSI: The National Agency for Information System Security has announced the launch of a new initiative called REACTIV (Interministerial Response and Action to Data Breaches). It is a response to the rise in cyberattacks, particularly data breaches affecting government agencies. (Roadmap for Priority Efforts in Government Cybersecurity 2026–2027, September 7, 2026)
Cyber Resilience Act: Starting September 11, 2026, the first reporting requirements under the European Cyber Resilience Act will take effect. Manufacturers are now required to report actively exploited vulnerabilities and serious incidents to ENISA, the European Union’s central cybersecurity agency. (Regulation (EU) 2024/2847 “Cyber Resilience Act”)
AI and cybersecurity: During an internal assessment, OpenAI’s AI agents bypassed the isolation measures in their environment, exploited a zero-day vulnerability and compromised Hugging Face’s infrastructure. The incident highlights the growing capabilities of AI systems to carry out complex cyber operations (OpenAI press release, 26 August 2026).
2. Desinformation and information warfare
Disinformation: OpenAI has removed a number of ChatGPT accounts linked to a Russian disinformation campaign promoting the International Burke Institute, a fake think tank based in Israel. The accounts were using ChatGPT to generate content posted on several social media platforms to promote pro-Russian narratives (OpenAI press release, 25 August 2026).
3. Personal data and privacy
3.1. Data breaches and incidents
Personal Data on the Dark Web : At the Mediterranean Strategic Forum, organized by the FMES Foundation, Lieutenant General André Petillot, Major General of the National Gendarmerie, estimated that approximately 80% of French citizens now have personal information for sale on the dark web (Press release dated October 8th, 2026).
BrixHub : The Minister Delegate for Digital Affairs has filed a lawsuit against BrixHub, a pirated search engine that compiles personal data from cyberattack leaks. The platform, which claims to have more than 11 billion data records, offers information such as addresses, phone numbers, bank account details, and Social Security numbers, and charges users to have their information removed. The French courts are set to examine possible offenses related to the fraudulent access and extraction of data (Press release dated October 5th, 2026)
Data Theft : Universal Music and Sony Music are suing the Suno platform, which they accuse of using copyrighted works to train its new music AI model. The lawsuit involves more than 60,000 recordings and could result in billions of dollars in damages. (Complaint, United States district court for the district of Massachusetts, September 18th 2026)
Electronic Invoicing: The Welyb electronic invoicing platform suffered a data breach on September 1, 2026. The data potentially stolen includes personal information as well as SIREN/SIRET numbers. This breach comes as France has just begun the transition toward widespread adoption of electronic invoicing. (Press release dated September 16, 2026)
Data Breach: Cybercriminals tricked the online banking service Revolut by impersonating a government agency, allowing them to obtain sensitive data from certain customers. The hackers are now threatening to release new files every day if the bank does not pay a ransom (Press release dated September 12, 2026)
Fingerprinting: AliExpress is reportedly using the WebAudio API to generate an inaudible sound signal and analyse the device’s response in order to create a digital fingerprint that enables it to track users without using cookies (Press release dated 24 August 2026).
3.2. Penalties and regulations
Statement on Personal Data : In a statement focusing on smart glasses, the European Data Protection Board (EDPB) highlights the issues related to the collection and processing of personal data by these devices, particularly when individuals are filmed or recorded without their knowledge. It emphasizes the responsibilities of manufacturers, service providers, and users under the GDPR, particularly regarding transparency, informing data subjects, and respecting their privacy. (Press release dated October 14th, 2026)
Personal Data: Meta has been found liable for violations of New Mexico’s consumer protection law in connection with the Cambridge Analytica case. The company faces a fine of up to $219 billion, an amount to be determined at a later date by a judge (Press release dated September 29th, 2026)
Privacy: The Court of Cassation held that the disclosure by the press, without her consent, of the identity of a victim of a sexual offence infringes her right to privacy. (First Civil Chamber, 23rd 2026, No. 25-15.512)
GDPR Penalty : Google was fined 403 million euros by the Irish Data Protection Commission (DPC) for several GDPR violations related to the processing of users’ location data. The violations relate in particular to the lawfulness, transparency, and retention of data in connection with several Google services. The DPC also ordered Google to bring its data processing practices into compliance with the GDPR within six months (Press Release dated September 21th, 2026).
Personal data: TikTok and ByteDance have reached a $400 million settlement with the US Department of Justice to settle legal proceedings concerning the collection of data from children under the age of 13 without parental consent, in breach of COPPA. TikTok will pay $300 million immediately and a further $100 million subject to certain conditions (US Department of Justice press release of 21 August 2026).
Facebook is verifying its human users: Meta is launching Facebook Verified, a free programme enabling users aged 18 and over to obtain a badge following verification via a video selfie. This measure aims to distinguish real people from fake profiles and automated accounts, but involves the collection of additional biometric data (Press release dated 24 July 2026)
4. Digital Economy and Competition
Customs Duty : The July 1, 2026, implementation of the 3-euro European customs duty on small packages coincides with a sharp year-over-year decline in the user base of Chinese platforms in France (36.4% for Temu, 42.3% for Shein, 10.4% for AliExpress), an initial indication of the effectiveness of this measure aimed at restoring a more level playing field between European and non-European players (Press release dated September 21th, 2026).
Platform regulation: The Governor of New York State and the Attorney General have filed a lawsuit against Polymarket, accusing the company of operating an unauthorized gambling platform in the state. They are seeking, among other things, an injunction to halt its operations and financial penalties. (Press release dated 24th September 2026)
Hosting providers and liability: The Paris Judicial Court held that the obligations imposed on hosting providers to block or make disputed content inaccessible are obligations of means rather than obligations of result. Their liability cannot therefore be established where they demonstrate that they took the necessary steps to comply with the blocking request. (Paris Judicial Court, September 17th 2026, Case No. 26/08228).
Platform regulation: The NGO WHAT TO FIX has filed a complaint with the Dutch digital services regulator, calling for an investigation into Meta, which it accuses of failing to properly enforce its monetization rules and handle reports. The complaint notably invokes several obligations under the Digital Services Act (DSA). (DSA Regulary Complaint WTF V. Meta, September 19th 2026).
Publication of the Code of Best Practices for the Sale of Refurbished Digital Devices on Marketplaces (2026): Signed by online marketplaces under the auspices of the Directorate General for Enterprise, the Charter outlines the legal obligations of sellers and platforms (VAT, Extended Producer Responsibility, Waste Management) and proposes voluntary commitments to strengthen transparency, compliance, and the circular economy in this sector (Press Release dated September 15, 2026).
ICANN: On August 18, 2026, Pavel Durov, CEO of Telegram, announced that he had submitted an application to ICANN to manage the .gram domain registry. ICANN is expected to make its decision in September (Press release dated August 18, 2026).
Domain names: On 12 August, ICANN closed its 2026 application round for new gTLD extensions, having received over 1,600 applications. The proposed extensions will be published following administrative review on ‘Reveal Day’ (ICANN press release of 13 August 2026)
Video games and digital sovereignty: The European Video Games Observatory proposes increasing public support for the sector, in particular by funding marketing and distribution, and regulating ‘dark patterns’ and attention-extraction models. It also calls for the development of sovereign European digital infrastructures (European Video Games Observatory report of 1 September 2026).
5. Artificial Intelligence
5.1. Copyright in the age of IA
Code of Conduct : Leading U.S. AI companies (Google, Anthropic, Meta, OpenAI, X, and Nvidia) met on September 29 at the initiative of U.S. President Donald Trump to sign a non-binding code of conduct aimed at regulating the development of artificial intelligence (Press release dated September 29th, 2026).
AI and Creative Writing: Author Théleyson Orelien is accused of using artificial intelligence to write part of his novel « C’était ça ou mourir ». He acknowledges having used AI on a limited basis, reigniting questions about its use in creative writing (Press release dated September 22th, 2026).
Microsoft and AI training: Microsoft maintains that training AI models on copyright-protected books and using them does not replace the original works, thereby defending the transformative nature of such uses under ‘fair use’. This position is contested by authors, who believe that AI threatens the book market and creators’ remuneration (Press release of 4 September 2026).
Copyright: Carlsen Verlag, Marc-Uwe Kling and Astrid Henn have brought legal proceedings against OpenAI in Germany, alleging that ChatGPT has reproduced copyright-protected material from the book *Das NEINhorn* and objecting to the use of their works to train AI models (Press release from Carlsen Verlag dated 19 August 2026).
Sony Music takes legal action against Anthropic: Sony Music Publishing and Warner Chappell Music are suing Anthropic, accusing it of using thousands of copyright-protected musical works – obtained in particular through illegal downloading – to train its Claude models. The publishers are claiming up to $150,000 per infringed work and are seeking an injunction to stop these practices (Press release dated 28 August 2026)
5.2. Regulation and supervision
AI Sovereignty : On October 14, 2026, Emmanuel Macron convened a National Defense and Security Council meeting dedicated to artificial intelligence, which the Élysée now considers a strategic issue of sovereignty and national security. The meeting is set to examine the risks associated with the development and use of AI, as well as the government’s priorities for action at the national and European levels (Press release dated October 14th, 2026)
AI Audit: In an audit published on September 24, 2026, the Court of Auditors states that the Ministry of Culture must “take action” on AI. The Court deplores the fact that, to date, there are no established priorities, no timeline, and no identified funding. It also warns that without resource pooling or sustainable funding, the public cultural sector risks “multi-speed” development that would benefit only the best-resourced institutions. (Audit published on September 24th, 2026)
AI Development: A former researcher at Anthropic condemns OpenAI and Anthropic’s irresponsible race toward a self-improving superintelligence that he considers dangerous to humanity and calls for global coordination to avert a catastrophe (Press release dated September 9, 2026).
AI Development: Dario Amodei (Anthropic), Sam Altman (OpenAI), and Elon Musk (Grok) are calling for a slowdown in AI development to regain control, fearing that a swarm of misaligned agents could take control of the internet within 6 to 12 months, with a risk of more than 10% that these systems could destroy civilization (Press release dated September 12, 2026).
Hyper-manipulation and cultural sectors: The Higher Council for Literary and Artistic Property (CSPLA) has drawn up an assessment of the risks associated with AI-generated deepfakes, particularly with regard to personality rights, trust in information and copyright. The report also highlights the limitations of the current legal framework and of detection and labelling mechanisms (Progress Report of the Higher Council for Literary and Artistic Property, September 7th 2026)
AI Development: The G20 has adopted an approach that supports the development of artificial intelligence over strict regulation, thereby aligning with the United States’ policy of promoting innovation. Europe, for its part, remains cautious and emphasizes risk management, giving member states the freedom to set their own rules. (Press release from the U.S. Department of Commerce, September 3, 2026)
6. Intellectual Property and counterfeiting
6.1. Legal actions and proceedings
Book Piracy : A Brazilian court has upheld the order to shut down a Facebook group with more than 47,000 members that was illegally sharing copyrighted e-books. The administrator and three users were also ordered to pay joint and several damages to the rights holders (Press release dated October 6th, 2026).
DNS Blocking : A French court has ordered Quad9, a Swiss DNS resolver, to block websites that illegally stream sports content. The company refuses, citing privacy concerns, among other reasons, while beIN Sports is seeking up to €580,000 in daily penalties. Quad9 is now considering withdrawing from the French market (Paris Judicial Court, May 13, 2026, No. 26/02207)
Domain Names : Following U.S. President Donald Trump’s proposal to rename AI as “super intelligence,” the corresponding domain name extension .SI (Slovenia) saw a 15% increase in domain name registrations in one month (Press release dated September 28th, 2026).
Counterfeiting and upcycling: The Paris Judicial Court ordered several companies to pay more than €1 million to Louis Vuitton for marketing, without authorization, products made from authentic Louis Vuitton items. The court found that this upcycling practice constituted, among other things, an infringement of Louis Vuitton’s intellectual property rights. (Paris Judicial Court, September 17th 2026, Case No. 24/07925).
Counterfeiting : A man was sentenced to 3 years and 6 months in prison after making 2.7 million pounds from the sale of counterfeit vinyl records in the United Kingdom between 2017 and 2024. The operation led to the seizure of 2,791 vinyl records as well as numerous pieces of equipment used in their production, infringing on the copyrights of 108 artists. This case represents the largest seizure of counterfeit vinyl records ever carried out in the United Kingdom. (Press release dated September 21th, 2026)
Trademark Infringement and Identity Theft : The Frankfurt am Main Regional Court held Meta liable for its active role in disseminating illegal advertisements that impersonated a financial investment firm by reproducing its trademarks and the image of its founder (Frankfurt am Main Regional Court, ruling of September 16th, 2026 -2-06 O 234/25).
Press and Book Piracy: The Alliance of General-Interest News Media, the National Publishers’ Union, and several publishers have filed a lawsuit against Bouygues Telecom, Orange, and SFR in the Paris Commercial Court to have the pirate website Bookys blocked, as it offers thousands of news articles and books without authorization. Additional proceedings with ARCOM are also being considered to block any potential mirror sites of Bookys. (Press release dated September 21th, 2026)
Anthropic Agreement with Book Rights Holders: The American AI company had reached a financial agreement with the rights holders of thousands of books following the recovery of 40,000 titles from pirate libraries such as LibGen. The problem now is identifying who actually owns the rights to each book: the author, publisher, co-author, co-publisher, etc. (Notice of Settlement Agreement, Bartz v. Anthropic, July 20, 2026)
Copyright: a proprietor of a trade mark with a reputation may prevent that mark from being used by a political party where the latter has not demonstrated that its freedom of expression takes precedence over the rights and interests of that proprietor (CJEU, September 8, 2026, Inter IKEA Systems, C-298/23)
Copyright / Social Media: The Court of Justice of the European Union (CJEU) has reiterated that a text published on a social media platform may be protected by copyright. The Court holds that a short text can constitute a “work” if it is original and reflects the author’s personal choices. The length of the text or the fact that it is published for free on the Internet therefore does not preclude its protection. (CJEU, September 3, 2026, Gândul Media Network, C-598/24)
6.2. Regulation and supervision
Fight against illegal streaming: The IFPI (International Federation of the Phonographic Industry) announces the launch of the Streaming Integrity Initiative (SII), a new industry commitment to combat streaming fraud and protect artists, songwriters, and fans from its harmful effects (Press release dated September 14, 2026)
Protection of Cultural Works: French President Emmanuel Macron and the South Korean President adopted a joint statement at the Lumière Summit on September 7 to strengthen international cooperation, protect cultural works, and combat piracy in the film and moving-image industries. (Press release dated September 7th, 2026)
7. Regulation & Justice
7.1. French Law
Cybersecurity: The bill on the resilience of critical infrastructure and the strengthening of cybersecurity—which aims, in particular, to transpose the European NIS2, DORA, and REC directives into French law—is on the National Assembly’s agenda starting October 7, 2026. Its consideration comes after several months of delay, even though the deadline for transposing NIS2 was set for October 17, 2026. (Bill on the Resilience of Critical Infrastructure and the Strengthening of Cybersecurity, March 13th, 2025)
7.2. European Law
DSA Sanctions : The BEUC (European Consumer Organizations) and allied consumer organizations have issued a joint statement calling on the European Commission and national authorities to accelerate investigations and impose sanctions on social media platforms that fail to comply with the Digital Services Act in light of the rise in online scams (Press Release dated September 29th, 2026).
Code of good practice : On September 25, 2026, the European Digital Services Committee adopted a code of good practice aimed at helping hosting service providers promptly notify law enforcement authorities of suspected criminal offenses that endanger people’s lives or safety, in accordance with Article 18 of the DSA (Press release dated September 25th, 2026; List of law enforcement authorities).
DSA: The European Commission has designated ChatGPT as a very large search engine (VLOSE), and Reddit and Roblox as very large online platforms (VLOP), as these services exceed the threshold of 45 million monthly users in the EU. They will be required to comply with the DSA’s enhanced obligations by January 2027, particularly regarding systemic risks and the protection of minors (European Commission press release of 31 August 2026)
CJEU: Google may be liable for its partners’ content: The CJEU has ruled that Google may lose the liability exemption applicable to hosting providers when it plays an active role in relation to the content of a creator with whom it has entered into a commercial partnership, in particular by reviewing that creator’s videos prior to the agreement. The judgment concerns the promotion of gambling on YouTube (CJEU judgment in Case C-421/24 of 16 July 2026).
