Following a string of incidents where AI models hacked websites and breached government systems during testing phases, the Federal Trade Commission is officially probing Anthropic and OpenAI over consumer harms, an insider told Axios.

On Wednesday, the FTC sent out civil investigative demands seeking a wide range of information from the AI firms on recent safety incidents.

The FTC did not respond to Ars’ request to review the subpoena demands. However, Axios’ source said the requests spanned more than 50 pages of questions and sought documents related to the incidents, internal security measures taken, and marketing materials that may suggest consumers were misled.

Read full article

Comments

© Tom Williams / Contributor | CQ-Roll Call, Inc.

The Federal Trade Commission (FTC) has filed a complaint accusing Digital Forensics Corporation of exploiting people already targeted by sextortionists.

We have talked about sextortion and recovery scams in the past, but we never looked specifically at the combination. Apparently, there is a lot of money to be made for those ruthless enough to take money from victims already in a state of panic.

The FTC has accused Digital Forensics Corporation, its owner Dmitry Belkin, and affiliated companies of misleading sextortion victims into paying at least $60 million for assistance that, in numerous instances, they did not provide. A federal court has temporarily halted the defendants’ activities while the case proceeds.

Most of the time, sextortion emails are a bluff sent to a large number of targets to see if one takes the bait. But sextortion can also involve intimate images that someone really possesses. In those cases, a criminal threatens to share the material unless the victim pays, sends more images, or complies with other demands.

In those cases, victims can feel desperate, especially when the demands keep coming, and may look for help to make it stop. According to the FTC, Digital Forensics targeted people searching for that help through advertisements on Google, YouTube, X, and other platforms. The company allegedly claimed it could track down criminals worldwide, identify perpetrators, and provide law enforcement with evidence needed to make arrests.

Digital Forensics allegedly charged between $1,499 and $20,000 for a “Phase 1” package. That was supposed to include communicating with the sextortionist, tracking their location, producing an investigative report, and reporting the crime to law enforcement.

According to the FTC, Digital Forensics Corporation changed the victims’ account settings to block the sextortionist, fabricated chat transcripts, and presented pre-saved coordinates, often in Nigeria or the Philippines, as the sextortionist’s location.

After collecting the first payment, the company allegedly pressured customers to purchase “Phase 2” services, supposedly providing ongoing account monitoring and further assistance. The FTC says the company did not follow through on those promises either.

Another huge red flag was that the company also allegedly discouraged victims from blocking their blackmailers, contrary to law enforcement and expert advice.

The allegations against Digital Forensics Corporation have not yet been decided by the court.

How to stay safe

Be wary of anyone who promises to stop the threats or pressures you to pay immediately. Help should offer clear information and realistic options. It should not turn your fear into another payment deadline.

If someone is threatening to share intimate images, you do not have to handle it alone.

• Preserve the threats and account details. Keep the messages, usernames, and payment demands. Block the offender but do not delete your account or the messages, since they may help real investigators.
• Stop communicating and block the blackmailer. Do not pay them or give them access to your devices or financial accounts. Report the account using the platform’s safety tools.
• Tell someone you trust about the sextortion. A friend, family member, counselor, or other trusted adult can provide support while you decide what to do next.
• Report the crime. Contact local police. In the US, you can also report sextortion to the FBI. If it involves a minor, report it through the National Center for Missing and Exploited Children’s CyberTipline.

If you have already paid a service that you believe misled you, keep its ads, messages, contract, and receipts, and report your experience to the FTC through ReportFraud.ftc.gov.

If you’re unsure whether something is a scam or not, ask Malwarebytes Scam Guard. It can help you assess it and provide advice on next steps.

---

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

The US Federal Trade Commission (FTC), together with Utah and California, has filed a lawsuit against telehealth provider Hims & Hers.

The FTC alleges that the company shared consumers’ sensitive health information with third‑party advertising platforms despite promising strong privacy protections.

Hims & Hers is a telehealth and digital health platform that connects users with licensed medical providers for online consultations, prescription medications, and personal care products.

The complaint also accuses Hims & Hers of deceptive billing and subscription practices that made it hard for users to avoid charges or cancel subscriptions.

According to the FTC’s complaint, filed in federal court in California, Hims & Hers:

• Shared sensitive health data, including details about medical conditions, with ad platforms such as Meta and Snap despite privacy promises.
• Charged before consultations. The company promised users they could consult a medical provider before being charged, but the FTC says many consumers were enrolled in recurring prescription subscriptions shortly after they submitted an intake form, often without first having a consultation.
• Made cancellation difficult. Before 2023, cancellation reportedly required contacting customer service by phone, email, or chat. Even after an online cancellation option appeared, the FTC alleges the button was hidden behind multiple steps and confusing options.

From a cybersecurity and privacy research perspective, this isn’t just about a single telehealth brand. It highlights three broader trends we see repeatedly in consumer programs:

Privacy policies versus reality. A company can market itself as privacy‑focused while still integrating third‑party advertising and analytics software development kits (SDKs) that leak sensitive information. This becomes especially concerning when health‑related events are linked to user accounts or tracking cookies.

Friction as a feature. Hard‑to‑find cancellation flows and unclear billing practices are examples of “dark patterns” that nudge users into paying for services they might not have chosen given all relevant information.

Regulatory pressure is growing. Health‑related services are under increasing scrutiny, especially when they handle sensitive data and combine it with advertising platforms.

The court will ultimately decide whether Hims & Hers violated the law, but the FTC’s action sends a clear signal: regulators are paying close attention to how health‑related services collect, use, and share sensitive data.

For anyone who values online privacy, the Hims & Hers case is a reminder that “health tech” does not automatically mean “privacy first.”

How to stay safe

More often than not, the privacy loopholes are hidden in the privacy policy somewhere.

Pro tip: one thing AI is good at is reading between the lines. Ask an AI chatbot to summarize a privacy policy and identify when your information may be shared with third parties. AI makes it much easier to understand lengthy privacy policies without reading every word yourself. If companies fail to follow their own privacy policies, regulators and consumers can hold them accountable.

Other than that:

• Don’t share sensitive information unless it’s genuinely needed to provide the service.
• Use strong, unique passwords and multifactor authentication (MFA). Even if a company is compliant, breaches happen. Unique passwords and two‑factor authentication limit the damage if your account details are exposed.
• Check your browser and app permissions. Disable unnecessary tracking features where possible, and consider privacy‑focused browser settings or extensions that limit third‑party cookies and trackers.

---

Your name, address, and phone number may already be for sale.  

Data brokers collect and sell your personal details to anyone willing to pay. Malwarebytes Personal Data Remover finds them and gets your information removed, then keeps watch so it stays that way.