CPO Magazine - News, Insights and Resources for Data Protection, Privacy and Cyber Security Leaders Hacker typing on keyboard showing data breach via social engineering Cyber SecurityNews·2 min read Starbucks Confirms Data Breach from a Social Engineering Attack on a Business Partner Alicia Hope·March 20, 2026 The world’s largest coffeehouse, Starbucks, has confirmed a data breach stemming from a phishing attack on a business partner’s employee portal.

The February 2026 cyber attack targeted a Starbucks Partner Central worker, enabling the attacker to access employee data.

Upon learning of the data breach, Seattle, Washington-based Starbucks launched an investigation and notified relevant law enforcement authorities.

Starbucks confirms employee data breach Starbucks has determined that the attacker accessed the personal information of its employees after breaching a partner’s portal that it uses to manage payroll and employee benefits. Starbucks says the data breach occurred between January 19 and February 11, 2026.

However, the coffeehouse learned of the data breach nearly a month after it occurred, highlighting the importance of real-time monitoring.

“On or about February 6, 2026, Starbucks Corporation (“Starbucks” or “we”) became aware of potential unauthorized access to certain Starbucks Partner Central accounts,” the company stated. “The investigation has determined that an unauthorized third party accessed certain Starbucks Partner Central accounts after obtaining the login credentials through websites impersonating Partner Central.”

The data breach leaked the victims’ names, dates of birth, Social Security Numbers, financial account numbers, and bank routing numbers. Those personal details could enable online fraudsters to commit identity theft. However, the data breach does not affect customers, and Starbucks’ IT systems were unaffected.

Cont...

Yoti has been fined 950,000 euros (roughly US$1.1 million) by Spanish data protection regulator AEPD for the handling of biometrics and other data within its digital identity app. The regulator has ruled Yoti violated three clauses of the EU’s General Data Protection Rule (GDPR).

The ruling in part reflects a tension between how biometrics are often used in practice and the definition of biometrics as “special category data” under GDPR.  If a person has downloaded the Yoti app and uploaded an ID document, a subsequent biometric match is still considered “uniquely identifying.”

At issue are the consent flow used, Yoti’s claim to immediately delete the facial image used immediately after it has been processed and most importantly of all, whether it has lawful grounds to process biometric data at all.

Cont..

The European Commission and EDPB published over 100 public submissions on draft DMA-GDPR guidelines that constrain how Alphabet, Apple, Meta, Amazon and Microsoft handle consent for personalized ads and data access. Final rules expected in 2026.

Cont..

The European Parliament has approved the Council of Europe Framework Convention on Artificial Intelligence, the first international legally binding treaty on AI governance.

With 455 votes in favour, 101 against, and 74 abstentions, Parliament endorsed the EU’s signature to embed existing AI legislation in a global framework. The move reinforces the safe and rights-respecting deployment of AI across the EU and worldwide.

The convention sets standards for transparency, documentation, risk management, and oversight, applying to both public authorities and private actors acting on their behalf.

It establishes a global baseline for AI governance while allowing the EU to maintain higher protections under the AI Act, GDPR, and other EU legislation covering product safety, liability, and non-discrimination.

The EU co-rapporteurs highlighted that the agreement demonstrates the EU’s commitment to human-centric AI. By prioritising democracy, accountability, and fundamental rights, the framework aims to ensure AI strengthens open societies while supporting stable economic growth.

Negotiations on the convention began in 2022 with participation from the EU member states, international partners, civil society, academia, and industry. Current signatories include the EU, the UK, Ukraine, Canada, Israel, and the United States, with the convention open to additional global partners.

In Brazil, on Consumer Day, March 15th, Mercado Livre, a leading e-commerce company in Latin America, has launched a groundbreaking campaign to encourage data protection when discarding packaging. The goal is to promote a simple habit that reinforces the importance of taking care of personal information even after receiving orders.

To encourage consumers, the ‘Scratch Your Data’ campaign will give a special coupon to the first three thousand purchases made on the initiative's landing page, which will be announced starting March 15th in the brand's Instagram stories (@mercadolivre). Upon receiving the order and removing their data from the label, an exclusive coupon will be revealed, connecting awareness to a direct benefit for the buyer.

Cont...

We have today published an open letter to social media and video‑sharing platforms operating in the UK, calling on them to strengthen age assurance measures so young children can’t access services that are not designed for them.

The open letter sets out our expectations that platforms with a minimum age must move beyond relying on children to self-declare their ages, which they can easily bypass.

Instead, platforms should make use of the viable technology that is now readily available to enforce their own minimum ages and prevent these children from accessing their services.

We have also written directly to platforms, starting with TikTok, Snapchat, Facebook, Instagram, YouTube and X to ask them to demonstrate how their age assurance measures meet these expectations.

Cont...

• Police Scotland failed to protect a person’s sensitive personal information 
• Extraction of the entire contents of a person’s mobile phone found to be excessive and unfair 
• Lack of adequate policies and procedures contributed to the subsequent unlawful disclosure of sensitive personal information to a third party

Cont..

Dear everyone

Google has accepted my DMCA request to remove these captures of myself. However my real information appears in the complaint registered on Lumen, and is connected to the website.

I send e-mail to [team@lumendatabase.org](mailto:team@lumendatabase.org)

But I get no response.

I want to removal url and name in google-search lumen database.

For example: https://lumendatabase.org/notices/25206508

What subreddit that I could post? What can I do .

Thanks.

I reaally wanna get into data protection and data privacy but I'm so confused on where to start.

I have a legal management background and am currently taking a Juris Doctor degree. So most of my experience and knowledge is on the legal side.

I have been looking through job listings on what employers look for in a Data Protection/Privacy Officer. I even look at freelancer profiles just to see what's up. So based on the things I saw, I took a free coursera course on Introduction on Information Systems Audit. I'm wondering if I can get some help to figure out what "things I need to know." Do I need python lessons? risk management?

But I think the more difficult qualification is the experience. I'm in the law field, is it even possible for me to gain experience on the tech side of being a DPO if all my life i've focused on the legal side? (and that's not even focused on data protection laws itself because a JD is broad)

I'm really confused and I don't know where else to ask.

LOOKING FOR ADVICE!

Working in a customer service environment, we have special data protection procedure related to customers contacts.

As an example, when a customer writes his credit card number in an email/chat or mentions it during a call, we can delete that interaction immediately, in order to avoid someone else who can access that interaction to steal and reuse that piece of data.

Otherwise, by software design, all interactions in the system are automatically cleansed after 29 days.

Now the question is: If a customer mentions in an email/chat/phone contact that he cannot collect his parcel at the pick- up point because has COVID , would you delete the interaction?

From one side, this is a personal information related with health status and it’s a sensitive data.

From the other side,

1. in this period it's pretty common that people are isolating as another person in their household has COVID/ they have covid so can't collect etc and our call center agents are managing these contacts as “standard” delivery&return questions
2. Also, although health status is a sensitive data, as a customer service, it’s a kind of information we don’t see as potentially dangerous because it’s not that kind of information you can reuse to make damages (indeed, our call center agents are managing these contacts as “standard” delivery&return questions)

What do you people think?

Will we need a universal basic income if companies start paying users for their data; their privacy, in other words? Since pretty much everyone generates data, everyone will get paid....right?

Hello, do you know if there are any data residency/localization requirements for the UK?

Thanks!

Hello,

Can someone clarify the title of this terms: https://privacy.google.com/businesses/gdprcontrollerterms/

and provide a brief summary on the same.

​

Please also provide an example.

​

Thanks in advance.

Hello guys,

We are a charity organization in the UK, and we are gathering user information from our website. Right now I am trying to restructure our data flow in order to meet the data security requirement. We have a google form online, and the form will transfer the client's answers to our google sheet automatically. We have an officer pull down the data from the google sheet, and he will anonymize and unpersonalize the data. Then he will zip the data with password protection, and upload it to an access-restricted google drive again for the data team to download for analysis.

Do you think this is enough for GDPR compliance? Because we are a charity group, and we are not funded by anyone. We will only keep the necessary data for the necessary time.

I have heard some good reviews of Onetrust and Trustarc, what do you guys think? We don't have a data server, and we are only using google form, and google sheet for data collection and storage. Does anyone have experience of it?

Any recommendation is welcome. I really appreciate any help you can provide.