Data Privacy Weekly: Your Industry News Series

Data Privacy Weekly is Encryption Consulting’s recurring roundup of the data-privacy and security stories that mattered that week. This edition covers Chrome retiring its padlock icon, a coalition pressing Slack to encrypt direct messages, a US Department of Transportation breach exposing 237,000 records, RPMSG-based phishing against Microsoft 365, and Volt Typhoon’s positioning inside US critical infrastructure. The one action to prioritize: audit who still relies on a visual browser icon, rather than certificate validation itself, to judge a connection’s trustworthiness.

Key Takeaways

• Chrome’s padlock icon is gone for good. It was replaced by a neutral “tune” icon, and the flag that could restore the old padlock has since been removed from current Chrome builds: the change is cosmetic, not a change to how HTTPS or certificate validation works.
• A civil-liberties and privacy coalition publicly pressed Slack to add end-to-end encryption to direct messages, arguing basic message privacy shouldn’t depend on which vendor an employer chose.
• A breach of the US DoT’s TRANServe system exposed personal data on 237,000 current and former employees, landing weeks after a US GAO report flagged unresolved cybersecurity gaps at the agency.
• Attackers used encrypted RPMSG email attachments, a legitimate Microsoft feature, to slip fake Microsoft 365 login pages past filters: a reminder that encryption on a message says nothing about the sender’s intent.
• Volt Typhoon, a China-linked group pre-positioning inside US critical infrastructure, is still active as of 2026 according to Dragos’s annual threat report, despite public disclosure and disruption efforts since 2023.

What Is Data Privacy Weekly, and Why Does This Edition Matter?

Data Privacy Weekly is a curated recap of the week’s most consequential data-privacy, encryption, and security-incident news, each item paired with a plain-language note on what it means for enterprise security teams. Stories are selected from named primary reporting and vendor or government advisories at the time of original publication (June 2023); this edition was reviewed in September 2026 and updated with verified current-status notes where the underlying situation has materially changed since then.

This particular week is worth revisiting because it pairs a cosmetic browser change (the padlock icon) with two very different classes of real risk: administrative-system breaches (the DoT) and long-dwell nation-state pre-positioning (Volt Typhoon) that, as later reporting confirmed, was nowhere close to over when this was first published.

This Week’s Data Privacy and Security Headlines

01. Saying Goodbye to the Lock Icon: Chrome’s Refreshing Approach to Online Security

What happened: Google’s decision to retire the padlock icon aimed to address a common misunderstanding about what the icon actually signals. Google’s own research found the large majority of users misread the padlock as a general safety seal rather than what it actually indicates, a secure HTTPS connection. The replacement, a neutral “tune” icon, gives users a single place to see and adjust a site’s permissions and connection details, and Chrome continues to flag plain-HTTP sites as Not Secure.

Where this stands now: The change shipped later and more gradually than the original Chrome 117 target, reaching most users by Chrome 120, and the tune icon is now permanent; Google has since removed the flag that let users restore the old padlock. HTTPS validation and certificate checking behave exactly as before; only the visual indicator changed.

Why this matters for enterprises: If your security-awareness training still tells employees to “check for the lock icon,” that guidance is now stale and should be retired along with the icon. The underlying control that actually matters, valid, correctly issued, non-expired TLS certificates, is exactly as important as before, and arguably more so as certificate lifetimes keep shrinking under the CA/Browser Forum’s schedule (200 days from March 2026, 100 days from March 2027, 47 days by March 2029).

02. Privacy Advocates Demand Slack: Encrypt and Protect!

What happened: A coalition of tech, civil-liberties, reproductive-justice, and privacy groups, led by Fight for the Future, publicly urged Slack to add end-to-end encryption to direct messages, arguing that basic message privacy shouldn’t hinge on employer policy or government subpoena exposure. Slack was one of the campaign’s least responsive targets among the messaging vendors named.

Why this matters for enterprises: Workplace chat tools sit on a spectrum between “encrypted in transit and at rest” and “end-to-end encrypted so the vendor itself cannot read it,” and most enterprise collaboration suites, Slack included, sit at the former. If your organization handles regulated data, legal privilege, or sensitive HR matters inside chat, know which category your tool falls into before you assume a message is private from everyone, including the vendor and anyone who can compel it.

03. Security Breach Shakes US Department of Transportation

What happened: The US Department of Transportation’s TRANServe system, an administrative system used for transit-benefit processing, was breached, exposing personal information on 237,000 current and former employees. The DoT said the breach did not affect transportation-safety systems and suspended access to TRANServe while it investigated. The timing was notable: a US Government Accountability Office report shortly before had already flagged unresolved cybersecurity and workforce gaps at the agency.

Why this matters for enterprises: Administrative and HR-adjacent systems are routinely treated as lower priority than customer-facing or safety-critical systems, yet they hold exactly the personal data (SSNs, banking details, benefits records) that triggers breach-notification obligations and identity-theft risk. An agency or company can have a strong safety record on its primary mission and still carry serious exposure in the systems nobody is watching.

04. Unmasking Stealthy Phishing: RPMSG Attachments Target Microsoft Credentials

What happened: Attackers sent encrypted RPMSG attachments, a legitimate Microsoft rights-managed message format, from compromised Microsoft 365 accounts. Opening the attachment routed victims through genuine-looking Microsoft pages to a fake SharePoint document, hosted on Adobe’s InDesign service, that harvested system information and login credentials. Because volumes were low and targeted, the campaign was hard to catch with signature-based filtering.

Why this matters for enterprises: Encryption on an attachment or message format tells you nothing about the sender’s intent, only that the content is protected in transit. Security awareness training and email filtering both need to account for legitimate encrypted formats being used as a delivery wrapper, and multi-factor authentication remains the most effective backstop when a credential does get phished.

05. China-Based Group Infiltrates Critical US Infrastructure Undetected

What happened: Microsoft and the “Five Eyes” intelligence alliance disclosed that Volt Typhoon, a China state-sponsored group, had infiltrated critical-infrastructure organizations in the US and Guam, focused on communications, manufacturing, utility, transportation, and government sectors. The group relied on living-off-the-land (LOTL) techniques, using legitimate admin tools and stolen credentials instead of malware, specifically to avoid detection. Microsoft assessed the activity was likely pre-positioning for disruption in a future crisis rather than conventional espionage alone.

Where this stands now: Volt Typhoon has not been eradicated. Operational-technology security firm Dragos reported the group continued targeting US electric utilities through 2025 and remains active, and NSA and FBI officials, while noting some intrusions have been found and removed, have cautioned that the true scope of compromise across US critical infrastructure is still unknown. This is a multi-year, unresolved threat, not a one-time 2023 incident.

Why this matters for enterprises: LOTL techniques leave little or no malware to scan for, which means detection depends on hardening what a valid account can do and hunting for behavioral anomalies, not signature matching. Any organization operating industrial, utility, or critical-infrastructure-adjacent systems should assume a capable, patient adversary may already have a foothold and plan detection and credential hygiene accordingly.

Story-to-Action Decision Table

How to Turn This Week’s Headlines Into Action

1. Map each story to your own exposure. Match each headline to a system or process you actually run: public HTTPS certificates, encrypted collaboration tools, administrative databases, email authentication, and monitoring for stealthy credential-based intrusions.
2. Check current control coverage. Confirm whether an existing control already addresses each mapped exposure: automated certificate lifecycle management, end-to-end encryption on sensitive channels, access logging on administrative systems, and MFA on email and identity platforms.
3. Prioritize by likelihood and impact. Rank the gaps you find by how likely they are to be exploited against your organization and how damaging a successful exploit would be, not by how much media attention the underlying story received.
4. Assign an owner and a deadline. Every gap that makes the priority list gets a named owner and a date.
5. Verify the fix, don’t just ship it. Confirm the control actually closes the gap, whether that’s an access review, an MFA enforcement check, or a detection tabletop exercise, before marking the item closed.

Encryption Consulting’s Take

The Chrome icon change is the least important story in this edition, and it’s the one most likely to get repeated in security-awareness slide decks anyway. That’s the actual risk: teams keep coaching users to look for a visual cue instead of relying on the certificate infrastructure underneath it. The DoT breach and Volt Typhoon are the stories that deserve the attention. Both point to the same root issue, credential and identity systems that were treated as secondary to a primary mission (transportation safety, grid operations) are exactly where a patient attacker goes first. If your organization runs anything resembling critical infrastructure, the working assumption in 2026 should be that Volt Typhoon or a comparable actor may already have a foothold, and detection strategy should be built on that assumption rather than on hoping disclosure alone solved the problem.

Limitations of This Roundup

This edition reflects public reporting available at the time each story was originally covered (June 2023), reviewed and fact-checked in September 2026. Where a story’s status has materially changed since original publication, we’ve added a “Where this stands now” note sourced to named reporting; where we could not verify a material change, the original reporting is presented as-is and should not be read as current status. This roundup is informational, not legal, compliance, or incident-response advice, and does not represent an exhaustive account of any referenced incident.

Key Terms in This Edition

• HTTPS: the encrypted version of HTTP, confirmed by a valid TLS certificate.
• TLS certificate: a digital credential that proves a website’s identity and enables encrypted connections.
• End-to-end encryption: encryption where only the sender and recipient, not the platform provider, can read the content.
• RPMSG: Microsoft’s Rights-Protected Message format, a legitimate encrypted-email feature that can be abused as a phishing delivery wrapper.
• MFA (multi-factor authentication): requiring a second proof of identity beyond a password.
• LOTL (living-off-the-land): an attack technique that uses an environment’s own legitimate tools and valid credentials instead of malware, to avoid detection.
• APT (advanced persistent threat): a well-resourced, typically state-linked group that maintains long-term, stealthy access to a target.

Frequently Asked Questions

What is Data Privacy Weekly?
Data Privacy Weekly is Encryption Consulting’s recurring roundup of the data-privacy, encryption, and security-incident stories that mattered in a given week, drawn from named primary reporting and vendor advisories, with an enterprise-impact note added to each item.

Did Chrome actually remove the padlock icon?
Yes. Google’s tune icon fully replaced the padlock in the Chrome address bar, with the rollout completing by Chrome 120 after an initial delay from the original Chrome 117 target. As of the current Chrome release, the flag that could restore the old padlock has been removed, making the tune icon permanent.

Is Volt Typhoon still active inside US critical infrastructure?
Yes. Threat-intelligence firm Dragos reported Volt Typhoon continued targeting US electric utilities through 2025 and remains active. NSA and FBI officials have said some intrusions have been found and eradicated, but investigators caution the true scope of compromise across critical infrastructure is still unknown.

Does the padlock removal or tune icon change mean a site is less secure?
No. The icon change is cosmetic. HTTPS, certificate validation, and the underlying TLS handshake work exactly as before; only the visual indicator in the address bar changed, from a padlock to a neutral tune icon, and Chrome still flags plain-HTTP sites as Not Secure.

What should enterprise security teams do in response to a week like this one?
Map each headline to your own exposure (public-facing certificates, encrypted messaging, administrative system access, email authentication, and living-off-the-land detection), check whether existing controls cover that exposure, then prioritize fixes by likelihood and business impact rather than by how alarming the headline sounds.

How Encryption Consulting Can Help

Two threads run through this edition: certificate-backed trust (the padlock story) and credential-based intrusion into systems that were assumed to be secondary (the DoT breach, Volt Typhoon). PKI-as-a-Service gives you managed, automated certificate issuance and renewal so trust doesn’t depend on anyone eyeballing a browser icon, and CertSecure Manager gives you centralized visibility and automated lifecycle management across every certificate in your environment, public and private, so nothing quietly expires or goes unmonitored. For the credential and key-protection side of stories like these, HSM-as-a-Service keeps signing and encryption keys in hardware-backed, access-controlled storage rather than in systems a Volt-Typhoon-style intrusion could reach.

See PKI-as-a-Service and CertSecure Manager in action, or talk to an expert about hardening credential and key management with HSM-as-a-Service.

Conclusion

This edition’s headline change, Chrome’s new tune icon, is cosmetic and shouldn’t distract from the two stories that actually matter: an administrative-system breach at the US DoT and a nation-state actor pre-positioning inside US critical infrastructure that, three years later, still hasn’t been fully rooted out. The lesson holds regardless of which week you’re reading this in: treat identity, credential, and certificate infrastructure as first-class security surface, not the boring part of the stack.

Continue the series with the next edition of Data Privacy Weekly.