[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRYZSe9LQL6zK3AWP3i4gpI9pFk6CjW7CZsqDziSyUJk":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":130},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"6cbebf65-1a8d-4a8b-afe5-40c2a1af618e","Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation","xandr-fined-a-record-8-6-million-for-relaying-grindr-data-revealing-sexual-orien-88ba1d","The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying ​Grindr users' sensitive data to advertisers. The administrative penalty is the largest issued by the data protection watchdog, arguing the case merited a high fine because of the \"very serious\" nature of the breach. The infringements","The Norwegian Data Protection Authority (DPA) has imposed a record €8.6 million fine on Xandr, a Microsoft-owned advertising unit. The penalty stems from Xandr illegally relaying sensitive Grindr user data, including sexual orientation, to advertisers. The DPA deemed the breach \"very serious,\" warranting the largest administrative penalty ever issued by the watchdog.","Xandr fined €8.6M for illegally relaying Grindr users' sensitive data.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fxandr-fined-record-86-million-for.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhGjfJJaKUMdLoNBTH2AYUmelL_XonLcf93p8hSgMXRbLGJwReAYV-BUZ2jpBPuvUQktW0PTKi1-21oFnBJF8PfECgT7t5r-S-iMUxjrdoWPf3EDxa2IVrQYjT98HG6s-LfPlJqm8mArrfEOEZS_scT7EYG8eXxMrUaII0UaQ3kAmWDJ3mRTR4JyIJhj-5S\u002Fs1600\u002Fgrindr-data.jpg","2026-10-13T13:12:32+00:00","2026-10-13T16:00:21.830316+00:00",8,[17,20,22],{"name":18,"type":19},"Xandr","vendor",{"name":21,"type":19},"Microsoft",{"name":23,"type":24},"Grindr","product","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":25,"icon":27,"name":28,"slug":29},null,"Privacy Fines","privacy-fines",[31,36,41,46],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":42},{"id":43,"icon":27,"name":44,"slug":45},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":47},{"id":25,"icon":27,"name":28,"slug":29},[],[21,18,23],{"controls":51,"vendors":126},[52,81,109],{"slug":53,"name":54,"problem":55,"products":56},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"slug":82,"name":83,"problem":84,"products":85},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[86,93,101],{"vendor_slug":87,"vendor_name":21,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"slug":110,"name":111,"problem":112,"products":113},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[114,120],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":115,"product_name":116,"url":118,"description":119},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":121,"product_name":122,"url":124,"description":125},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",[127],{"slug":87,"name":21,"logo_path":88,"roles":128},[129],"affected",{"slug":131,"title":132,"body":133,"framework_refs":134,"framework_notes":146},"xandr-fined-86m-for-unlawfully-sharing-grindr-users-sexual-orientation-data","Xandr Fined €8.6M for Unlawfully Sharing Grindr Users' Sexual Orientation Data","Xandr, a Microsoft-owned ad-tech platform, was found to have relayed highly sensitive personal data — specifically users' sexual orientation derived from Grindr — to third-party advertisers without a lawful basis under GDPR. This constitutes a critical failure in data minimization, purpose limitation, and third-party data handling controls. Sexual orientation is classified as a 'special category' of personal data under GDPR Article 9, requiring explicit consent and heightened protection. The case highlights how ad-tech supply chains routinely transmit sensitive inferences about individuals far beyond what users would reasonably expect, creating systemic privacy risks at scale.",[135,136,137,138,139,140,141,142,143,144,145],"GDPR Article 9 — Processing of special categories of personal data","GDPR Article 5(1)(b) — Purpose limitation principle","GDPR Article 5(1)(c) — Data minimisation principle","GDPR Article 28 — Processor obligations and contracts","GDPR Article 35 — Data Protection Impact Assessment (DPIA)","NIST Privacy Framework PR.DS-P1 — Data minimization in processing","NIST SP 800-53 PT-2 — Authority to process PII","NIST SP 800-53 SA-9 — External Information System Services (supply chain)","CIS Control 3 — Data Protection","CIS Control 15 — Service Provider Management","ISO\u002FIEC 27701 — Privacy Information Management System (PIMS)",{}]