Tech
Meta fined $101.5M for 2019 breach that exposed hundreds of millions of Facebook passwords
Reset your clocks: Meta has been hit with yet another privacy penalty in Europe. On Friday, Ireland’s Data Protection Commission (DPC) announced a reprimand and a €91 million fine — around $101.5 million at current exchange rates — after concluding a multiyear investigation into a 2019 security breach by Facebook’s parent company.
The DPC opened a statutory inquiry into the incident in question in April 2019 under the bloc’s General Data Protection Regulation (GDPR) after Meta, or Facebook as the company was still called back then, notified it that “hundreds of millions” of users’ passwords had been stored in plaintext on its servers.
The security incident is a legal issue in the European Union because the GDPR requires that personal data is appropriately secured.
After investigating, the DPC has concluded that Meta failed to meet the bloc’s legal standard since the passwords were not protected with encryption. It created a risk as third parties could potentially access people’s sensitive information stored in their social media accounts.
The regulator, which leads on oversight of Meta’s GDPR compliance, also found Meta broke the rules by failing to notify it of the breach within the required time frame (the regulation generally stipulates breach reporting should take place no later than 72 hours after becoming aware of it). Meta also failed to properly document the breach, per the DPC.
Commenting in a statement, deputy commissioner Graham Doyle wrote: “It is widely accepted that user passwords should not be stored in plaintext, considering the risks of abuse that arise from persons accessing such data. It must be borne in mind, that the passwords the subject of consideration in this case, are particularly sensitive, as they would enable access to users’ social media accounts.”
Reached for a response to its latest GDPR sanction, Meta spokesperson Matthew Pollard emailed a statement in which the company sought to play down the finding by claiming it took “immediate action” over what had been an “error” in its password management processes.
“As part of a security review in 2019, we found that a subset of FB [Facebook] users’ passwords were temporarily logged in a readable format within our internal data systems. We took immediate action to fix this error, and there is no evidence that these passwords were abused or accessed improperly,” Meta wrote. “We proactively flagged this issue to our lead regulator, the Irish Data Protection Commission, and have engaged constructively with them throughout this inquiry.”
Meta had already racked up a majority of the largest GDPR penalties handed out to tech giants so the latest sanction merely underscores the scale of its problems with privacy compliance.
The penalty is notably stiffer than a €17 million fine the DPC handed to Meta in March 2022 over a 2018 security breach. The Irish regulator has had a change of senior management since then. However the two incidents are also different: Meta’s earlier security lapses affected up to 30 million Facebook users compared to the hundreds of millions whose passwords were said to have been exposed as a result of its failure to secure passwords in 2019.
The GDPR empowers data protection authorities to issue fines for breaches where the amount of any penalty is calculated based on factors such as the nature, gravity and duration of the infringement; the scope or purpose of the processing; and the number of data subjects affected and level of damage suffered, among other considerations.
The highest possible penalty under the GDPR is 4% of global annual turnover. So, in Meta’s case, a €91 million fine may sound like a significant chunk of change — but it remains a tiny fraction of the billions the company could theoretically face, given its annual revenue for 2023 was a staggering $134.90 billion.
Tech
Cosmetics giant Rituals confirms data breach of customer membership records
Netherlands-based cosmetics giant Rituals has confirmed a data breach affecting customers’ personal information after hackers stole reams of data from its membership database.
The company disclosed the breach on Wednesday, according to an email sent to customers that TechCrunch has viewed and verified.
Rituals said it identified an “unauthorized download” of members’ data in April that contained customers’ full name, date of birth, gender, postal and email address, and phone number, as well as their preferred Rituals store and account type.
When reached by TechCrunch, Rituals spokesperson Eline van Malssen said the hacker stole membership data about customers in Europe and the United Kingdom.
TechCrunch has learned that some customers notified by Rituals are based in the United States. The spokesperson confirmed the incident also affects some U.S. customers.
Rituals did not describe the nature of the cyberattack and the company said its investigation was underway to understand how the data breach happened.
The cosmetics giant is the latest retailer to have customer membership data stolen in the past year, following a string of intrusions at U.K. grocery and shopping chain Co-op and Marks & Spencer, among others. Customer records can be attractive targets for hackers who steal the data and extort the company for a ransom in exchange for not publishing the information online.
When reached with questions about the incident, a Rituals spokesperson declined to comment on whether the company received any communication from the hackers, to share a more precise timeline of the breach, or to provide the exact number of affected members, citing unspecified “security reasons.”
According to its website, Rituals has over 41 million customers in its membership database. The retail giant made €2.4 billion euros ($2.8 billion) in revenue in 2025.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Tech
Rivian R2 production has started despite tornado damage to factory
Rivian has rolled the first customer-ready R2 SUVs off the production line at its factory in Normal, Illinois, just days after it was hit by an EF-1 tornado that tore off part of the roof.
Despite the damage, founder and CEO RJ Scaringe told Bloomberg Television on Wednesday morning that Rivian doesn’t expect any delays to the R2’s rollout, which is crucial to the company’s survival.
“The tornado went through the south end of the plant, and ripped the roof off the building, and knocked down some of the plant as well, and so the last 72 hours have been around the clock,” he said. Scaringe explained that Rivian has had to change how and where it brings some materials into the factory to build the R2.
But “we’re not making any changes to the plan,” he said, referring to the company’s production roadmap.
Scaringe wasn’t asked when Rivian will make the first R2 deliveries during the interview. The company has previously said it will start shipping R2 SUVs before the first half of 2026 comes to an end.
Getting the R2 into production is a major milestone for the company. It’s the first production vehicle Rivian has made that has a chance to reach mass-market customers, as it costs far less than the company’s current R1 EVs. It’s also supposed to help the company finally reach profitability after years of losing money on every vehicle it sold.
The company has big expectations for the R2. Rivian told investors earlier this year that it expects to deliver between 20,000 and 25,000 of the SUVs by the end of 2026. If Rivian achieves that, it would become one of the fastest-scaling new EVs ever launched in the U.S., second only to Tesla’s Model Y.
Techcrunch event
San Francisco, CA
|
October 13-15, 2026
That said, Rivian is launching with a version of the R2 that costs nearly $13,000 more than the $45,000 price tag the company spent years promoting. The launch edition R2 starts at $57,990, with a slightly cheaper $53,990 variant coming by the end of this year. Rivian won’t sell an R2 for under $50,000 until the first half of 2027, and a true base model starting at $45,000 won’t hit the market until late 2027.
And that’s if the $45,000 R2 ever arrives at all. When Rivian announced pricing for the SUV in March, the company said the base model price will start “around $45,000” — not “at $45,000” as it had promoted on its website as recently as February.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Tech
AI Overviews are coming to your Gmail at work
During its Google Cloud Next conference on Wednesday, the company announced a slew of Workspace-focused updates, including the addition of its AI Overviews feature to Gmail. The feature, which today uses AI to summarize Google Search results, will now do the same for Gmail users in the workplace.
According to Google, this will allow Gmail users to ask questions in search using natural language and then get concise answers without having to open and read different emails.
The company suggests the feature could be used to ask business-related questions about topics typically shared in emails, like those about performance improvements, project milestones, invoices, comments on decks, trip details, and more with straightforward answers.
The AI Overview will create an instant summary pulled from across multiple emails and conversations.
While not everyone prefers to have AI as their first step to finding an answer, it is rapidly becoming the norm, both within Google’s products and elsewhere on the web.
In this case, Google says the AI Overviews in Gmail will be the default setting if the company has Gemini for Workspace in Gmail enabled, and if Workspace Intelligence access to Gmail is enabled. (End users must have “Smart features in Gmail, Chat, and Meet” and “Google Workspace smart features” enabled, too.)
The feature was previously available to consumers with Google AI Pro and Ultra subscriptions. Google says it will also now come to business, enterprise, and education customers as well through the following products:
Techcrunch event
San Francisco, CA
|
October 13-15, 2026
- Business: Business Starter, Standard, and Plus
- Enterprise: Enterprise Starter, Standard, and Plus
- Consumers: Google AI Pro and Ultra
- Other Editions: Frontline Plus
- AI Add-ons: Google AI Pro for Education
Alongside the launch, Google said it’s also making AI Overviews in Drive broadly available to eligible Workspace and Google AI plans. It was previously in beta.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Cosmetics giant Rituals confirms data breach of customer membership records
Rivian R2 production has started despite tornado damage to factory
