The US Federal Trade Commission (FTC), together with Utah and California, has filed a lawsuit against telehealth provider Hims & Hers.

The FTC alleges that the company shared consumers’ sensitive health information with third‑party advertising platforms despite promising strong privacy protections.

Hims & Hers is a telehealth and digital health platform that connects users with licensed medical providers for online consultations, prescription medications, and personal care products.

The complaint also accuses Hims & Hers of deceptive billing and subscription practices that made it hard for users to avoid charges or cancel subscriptions.

According to the FTC’s complaint, filed in federal court in California, Hims & Hers:

• Shared sensitive health data, including details about medical conditions, with ad platforms such as Meta and Snap despite privacy promises.
• Charged before consultations. The company promised users they could consult a medical provider before being charged, but the FTC says many consumers were enrolled in recurring prescription subscriptions shortly after they submitted an intake form, often without first having a consultation.
• Made cancellation difficult. Before 2023, cancellation reportedly required contacting customer service by phone, email, or chat. Even after an online cancellation option appeared, the FTC alleges the button was hidden behind multiple steps and confusing options.

From a cybersecurity and privacy research perspective, this isn’t just about a single telehealth brand. It highlights three broader trends we see repeatedly in consumer programs:

Privacy policies versus reality. A company can market itself as privacy‑focused while still integrating third‑party advertising and analytics software development kits (SDKs) that leak sensitive information. This becomes especially concerning when health‑related events are linked to user accounts or tracking cookies.

Friction as a feature. Hard‑to‑find cancellation flows and unclear billing practices are examples of “dark patterns” that nudge users into paying for services they might not have chosen given all relevant information.

Regulatory pressure is growing. Health‑related services are under increasing scrutiny, especially when they handle sensitive data and combine it with advertising platforms.

The court will ultimately decide whether Hims & Hers violated the law, but the FTC’s action sends a clear signal: regulators are paying close attention to how health‑related services collect, use, and share sensitive data.

For anyone who values online privacy, the Hims & Hers case is a reminder that “health tech” does not automatically mean “privacy first.”

How to stay safe

More often than not, the privacy loopholes are hidden in the privacy policy somewhere.

Pro tip: one thing AI is good at is reading between the lines. Ask an AI chatbot to summarize a privacy policy and identify when your information may be shared with third parties. AI makes it much easier to understand lengthy privacy policies without reading every word yourself. If companies fail to follow their own privacy policies, regulators and consumers can hold them accountable.

Other than that:

• Don’t share sensitive information unless it’s genuinely needed to provide the service.
• Use strong, unique passwords and multifactor authentication (MFA). Even if a company is compliant, breaches happen. Unique passwords and two‑factor authentication limit the damage if your account details are exposed.
• Check your browser and app permissions. Disable unnecessary tracking features where possible, and consider privacy‑focused browser settings or extensions that limit third‑party cookies and trackers.

---

Your name, address, and phone number may already be for sale.  

Data brokers collect and sell your personal details to anyone willing to pay. Malwarebytes Personal Data Remover finds them and gets your information removed, then keeps watch so it stays that way. 

Reddit users found that by using a specific Google search query, it was possible to find Claude conversations that users had shared.

This exposed sensitive material, including crypto wallet keys, names, addresses, work notes, and even erotic or otherwise policy-violating chats. Fortune says Anthropic appears to have fixed the Google indexing issue, but the shared links themselves were still live for people who already had them.

The exposure was tied to Claude’s Share feature, which creates a public web link to a snapshot of a conversation rather than leaving it inside a user’s private account. Reddit users found a search query that surfaced many of these shared chats, plus Claude Artifacts (interactive documents, apps, and other content created by Claude) in Google results. Wired reports that this is still true for Bing.

The main risk is that people use chatbots to think through work, health, legal, or personal matters without realizing that a shared link can behave like ordinary public web content.

This isn’t unique to Claude. We’ve previously seen Grok chats show up in Google search results, and Meta AI conversations can also become public by design. We have also written about the share option in ChatGPT that was swiftly removed after users unintentionally made thousands of conversations searchable.

Anthropic says Claude chats are private by default, and only conversations users explicitly chose to share were affected. But the incident is a reminder that a “share” button on an AI chat can be more like publishing than messaging, especially if search engines can discover the resulting URL.

How to stay safe

The easy way out here is not to share your AI chatbot conversations with anyone, because you could end up reaching more people than you intended.

That’s because it’s harder to stop pages from being indexed than you might expect. And you don’t have those controls aren’t in your hands. The AI provider should take care of that.

But there are a few things you can do:

• Don’t share Personally Identifiable Information (PII) with a chatbot, so that if a conversation is ever exposed it can’t be easily linked back to you.
• To review or stop sharing conversations in Claude, go to Settings > Privacy > Shared chats.
• If you’re using an AI service from a social media company, such as Meta AI, Grok, or Gemini), remember that your conversations could be tied to your account—which might contain a lot of personal information.
• When using AI, make sure you understand how to keep your conversations private. Many services offer temporary or incognito chats that aren’t saved to your history, but they aren’t a guarantee against bugs, leaks, or data breaches. Only use the share feature when you’re comfortable with anyone potentially seeing that conversation.
• Read the privacy policy so you understand how your conversations are stored and shared. If it’s too long, you can always ask an AI to summarise the important points.

---

Let’s face it, an incognito window can only do so much. 
 
Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance. 

A prayer app launched by Pope Francis in 2019 contained a security flaw that exposed the personal information of hundreds of thousands of users before it was finally fixed this year.

The app, Click To Pray, was developed by La Machi Communication for Good Causes for the Pope’s Worldwide Prayer Network. Pope Francis endorsed the service and had an account on it. The app offers a “digital community of prayer” by guiding people through three prayers each day.

In January this year, independent researcher BobDaHacker discovered a flaw in the app’s API endpoint. An API is an online service that responds to requests for data. Typically, only the mobile app should send such requests, and the API should only return information about the specific person using that app. However, BobDaHacker found it was giving out information about any of the app’s users to anyone who asked.

Apps typically query an endpoint by sending it a specific ID for the person using it. In this case, those IDs were simply sequential numbers. According to BobDaHacker, there were 719,517 registered IDs for the app, meaning over 700,000 users had information stored in the system.

The problem was that the API didn’t check whether someone requesting a record was actually authorised to see it. Anyone could request information for any ID, from 1 through to 719,517. The API would then return that user’s record, including:

• Email address
• First and last names
• Country
• Date of birth

This kind of flaw is known as an Insecure Direct Object Reference (IDOR) and we’ve seen it before. Stalkerware-type app TheTruthSpy was found leaking details on its victims via an IDOR vulnerability in 2022, and it still hadn’t been fixed two years later. The web server for the MiCODUS MV720 vehicle-tracking GPS device also had the vulnerability in 2022, putting 1.5 million people at risk.

A second flaw in the Click To Pray API made things worse. When people register with an app, the service typically sends a link to their email address containing a unique code known as a validation hash. Clicking the link proves they have access to that inbox and therefore own the email address they registered with.

Unfortunately, the Click To Pray API also returned the validation hash in its response when someone clicked the verification link. These responses are easy to inspect using a web browser’s developer tools, meaning an attacker could register an account using an email address they didn’t control and verify it before the real owner even saw the verification email.

Six months, nine contacts, zero replies

BobDaHacker first reported the bug on January 3, 2026, eventually emailing nine addresses spanning the Click To Pray service, the Pope’s Worldwide Prayer Network, and a general information address. They got no response. It was only fixed more than six months later after the researcher contacted a journalist, who filed a query with the Vatican.

Responsible disclosure only works when the recipient has a functioning intake process. Nine unanswered emails were a strong signal that no such process existed.

Not the first security flaw in a Vatican app

This isn’t the first security flaw involving a Vatican app. In 2019, UK firm Fidus Information Security found a flaw in the app for the Vatican’s Bluetooth eRosary device. It didn’t use a conventional password for logins. Instead, users entered their email address and the app sent a four-digit PIN to that address. They then entered the PIN to log in.

However, when the user entered their email address, the app also returned the PIN in plain text in its web response. That enabled an attacker to take over anyone’s account simply by inspecting the response.

That flaw was similar to the account verification issue that BobDaHacker discovered more than six years later. Although the incidents involved different apps, they show how the same type of security mistake can reappear years apart.

BobDaHacker also noted that Vatican City State introduced its own data protection regulation, Decree No. DCLVII, on April 30, 2024. The regulation requires appropriate safeguards for personal data. However, it’s not clear whether it applies directly to Click To Pray or the organisations that operate it.

What users can do now

Thankfully, someone on the Vatican side has now fixed the flaws, but the vulnerability meant that user data was exposed for a long time. If you registered an account, assume your email, name, date of birth, and country are potentially in circulation. Watch for phishing that references the app, and be especially skeptical of messages claiming to come from Vatican-affiliated services asking you to click, verify, or log in.

This is particularly important because BobDaHacker also reported that emails from the service failed standard email authentication checks. These checks help receiving email providers verify that a message really came from the domain it claims to represent. According to the researcher, this could make it easier for phishing attackers to impersonate the organisation.

---

Your name, address, and phone number may already be for sale.  

Data brokers collect and sell your personal details to anyone willing to pay. Malwarebytes Personal Data Remover finds them and gets your information removed, then keeps watch so it stays that way. 

This week on the Lock and Code podcast…

Twenty years ago, a British mathematician named Clive Humby popularized a phrase that came to describe data’s relationship with the entire global economy: “Data is the new oil.”

Pithy as the phrase sounds, it is undeniably true.

Data steers decisions at businesses of every size. Data created entirely new industries built around its capture. And, for a select number of companies, data has produced billions—if not trillions—of dollars in value.

So how is it that, on the dark web, your stolen identity can be purchased for just 95 cents?

That’s what a Malwarebytes researcher found last month after spending 48 hours inside the dark web to investigate cybercrime. Across a variety of forums and directories, he found subscription plans for malware that steals information once implanted on a device. He found guides for deploying social engineering scams. He found people selling their services to build fake websites that trick people into handing over their usernames and passwords. And he found one of the dark web’s most traded commodities—personal data, packaged together about individual people, to help a cybercriminal commit identity fraud.

These packages are called “fullz.” For victims in the United States, a fullz contains a full name, Social Security Number, date of birth, address, and other personal details. That is enough, on its own, for a cybercriminal to potentially open a bogus line of credit, file a fake tax return, access financial accounts, or obtain medical services under someone else’s name.

As we wrote on Malwarebytes Labs:

“For less than the cost of a cup of coffee, a cybercriminal can buy enough information to devastate someone’s financial life.”

It’s the kind of risk that could scare anyone, especially considering the scale behind it. In just the first six months of 2026, Malwarebytes found more than 7,500 compromised data sets on the dark web containing more than 8.4 billion records.

And yet, even today, cybersecurity professionals still get asked why anyone should bother protecting their data.

The public, understandably, are exhausted. With data breaches happening every week—if not every day—cybersecurity can start to feel pointless. With young people unable to build financial security, they start believing that they have nothing worth stealing. And with Big Tech already collecting our every movement, behavior, click, and concern, people understandably feel powerless to fight any kind of data abuse, be it corporate or criminal.

So today’s episode approaches the question from a different direction. This isn’t about why you should protect yourself—plenty of company websites will tell you that, and most of them rely on fear. This is about why hackers want your data in the first place.

Today, on the Lock and Code podcast, host David Ruiz explains how cybercriminals turn a single repeated password into account takeover, how a screenshot of your house from Google Maps became a tool in extortion emails, and why the most benign information about you—an address, an age, one public photo—is often the most useful data a stranger can buy.

Tune in today to listen to the full episode.

Show notes and credits:

Intro Music: “Spellbound” by Kevin MacLeod (incompetech.com)
Licensed under Creative Commons: By Attribution 4.0 License
http://creativecommons.org/licenses/by/4.0/
Outro Music: “Good God” by Wowa (unminus.com)

---

Listen up—Malwarebytes doesn’t just talk cybersecurity, we provide it.

Protect yourself from online attacks that threaten your identity, your files, your system, and your financial well-being with our exclusive offer for Malwarebytes Premium for Lock and Code listeners.