{ "datasetName": "Syntony PolBench", "edition": "Pilot evidence collection", "researchedOn": "2026-10-20", "scope": "Fourteen selected responses to security and privacy incidents or AI evaluations, with follow-up searches through October 20, 2026. The records describe particular responses and do not rate current organizational security.", "statusDefinitions": { "documented": "Directly available operative policy text, a legal instrument, or an external public record supports the narrow checkpoint claim. This does not verify every underlying allegation or later effectiveness.", "reported": "The organization states the action or finding occurred; this collection does not independently verify it.", "planned": "The relevant assignment, operation, or test is promised or required but not established as completed. An explicit chosen commitment can establish the separate decision checkpoint.", "unknown": "This checkpoint is not established by the evidence collected. Missing public evidence is not evidence of inaction." }, "cases": [ { "id": "microsoft-sfi-2024", "org": "Microsoft", "title": "Secure Future Initiative governance changes", "triggerType": "security-incident", "eventDate": "2024-03-20", "eventDateLabel": "Date printed on CSRB report; not incident or public-release date", "observationEnd": "2026-07-10", "governanceChange": "Microsoft assigned cyber-risk decisions to Deputy CISOs, created a CISO-led council, and tied security performance to leadership rewards and board oversight.", "limitation": "Microsoft reports these changes itself. Neither its technical progress metrics nor the CSRB investigation measures the effect of the council, decision rights or compensation rules. SFI began before the CSRB review.", "checkpoints": { "finding": { "status": "documented", "summary": "An external CSRB review identified organizational and security failures associated with the 2023 intrusion.", "sourceIds": [ "ms-csrb" ] }, "decision": { "status": "reported", "summary": "Microsoft explicitly connected expanded SFI goals and a new governance framework to CSRB recommendations and incident lessons.", "sourceIds": [ "ms-expansion" ] }, "ownership": { "status": "reported", "summary": "The July 2026 report assigns Deputy CISOs responsibility for reviewing, prioritizing, mitigating and accepting risks in their domains.", "sourceIds": [ "ms-progress-2026" ] }, "implementation": { "status": "reported", "summary": "Microsoft reports continued council reviews, a central risk register, executive and board reporting, and security contributions considered in performance rewards.", "sourceIds": [ "ms-progress", "ms-progress-2026" ] }, "validation": { "status": "unknown", "summary": "The sources describe governance operation and technical progress, but do not test whether the accountability changes improved security.", "sourceIds": [ "ms-progress-2026" ] } }, "summary": "After the 2023 Exchange Online intrusion, the Cyber Safety Review Board identified security and organizational failures. Microsoft cited that review and the separate Midnight Blizzard attack when it expanded SFI in May 2024.", "logo": "/assets/logos/microsoft.png", "mechanism": "accountability", "causalBasis": { "type": "organization-attributed", "summary": "Microsoft attributes the SFI expansion to CSRB recommendations and lessons from Midnight Blizzard.", "sourceIds": [ "ms-expansion" ] }, "responseKind": "new-or-revised-policy", "decisionState": "adopted", "validationDetails": null, "searchedThrough": "2026-10-20", "followUp": { "summary": "The July 2026 report describes continued council reviews and Deputy CISO risk decisions, supported by a central risk register. It also describes a new system for tracking SFI ownership and progress. These are company reports of operation; they do not isolate the reforms’ effect.", "sourceIds": [ "ms-progress-2026-release", "ms-progress-2026" ], "searchNote": "Searched Microsoft, regulator and external-assessment sources through October 20, 2026. No direct published outcome assessment of the selected governance changes was located." }, "sources": [ { "id": "ms-csrb", "title": "CSRB: Review of the Summer 2023 Microsoft Exchange Online Intrusion", "url": "https://www.cisa.gov/sites/default/files/2024-04/CSRB_Review_of_the_Summer_2023_MEO_Intrusion_Final_508c.pdf", "date": "2024-03-20", "kind": "external review", "note": "The cover is dated March 20, 2024. This is the report date, not the intrusion date or public-release date. The Executive Summary was rechecked in an indexed official PDF excerpt; direct PDF retrieval returned HTTP 403 in this review.", "locator": "Cover and Executive Summary, printed page iii", "origin": "external", "retrievedOn": "2026-10-20" }, { "id": "ms-expansion", "title": "Security above all else: expanding Microsoft's Secure Future Initiative", "url": "https://www.microsoft.com/en-us/security/blog/2024/05/03/security-above-all-else-expanding-microsofts-secure-future-initiative/", "date": "2024-05-03", "kind": "organization announcement", "locator": "Opening paragraphs; 'Instituting new governance', paragraphs 1–3", "origin": "organization", "retrievedOn": "2026-10-20" }, { "id": "ms-progress", "title": "September 2024 progress update on Microsoft's Secure Future Initiative", "url": "https://www.microsoft.com/en-us/security/blog/2024/09/23/securing-our-future-september-2024-progress-update-on-microsofts-secure-future-initiative-sfi/", "date": "2024-09-23", "kind": "organization progress report", "locator": "'A focus on security above all else', first and fourth bullets", "origin": "organization", "retrievedOn": "2026-10-20" }, { "id": "ms-progress-2026-release", "title": "July 2026 progress report on the Secure Future Initiative", "url": "https://www.microsoft.com/en-us/security/blog/2026/07/10/securing-our-future-july-2026-progress-report-on-microsofts-secure-future-initiative/", "date": "2026-07-10", "kind": "organization progress announcement", "locator": "Byline date; introduction and link to the July report", "origin": "organization", "retrievedOn": "2026-10-20" }, { "id": "ms-progress-2026", "title": "Microsoft July 2026 Secure Future Initiative Progress Report", "url": "https://go.microsoft.com/fwlink/?LinkId=2371112&clcid=0x409&country=us&culture=en-us", "date": "2026-07", "kind": "organization progress report", "locator": "Printed pages 13–14, Culture and Governance", "origin": "organization", "retrievedOn": "2026-10-20", "dateType": "report-date", "note": "Cover gives July 2026; the release announcement is dated July 10. The report was read through its official download link." } ] }, { "id": "cloudflare-code-red-2023", "org": "Cloudflare", "title": "Code Red remediation staffing", "triggerType": "security-incident", "eventDate": "2023-11-23", "eventDateLabel": "Detection date", "observationEnd": "2024-02-01", "governanceChange": "From November 27, 2023, Cloudflare made Code Red its top priority and redirected much of its technical staff to remediation.", "limitation": "The immediate mobilization ended January 5, 2024. CrowdStrike checked the intrusion’s reach and persistence; that work does not assess whether the staffing decision was effective.", "checkpoints": { "finding": { "status": "reported", "summary": "Cloudflare identified unrotated credentials as the entry point.", "sourceIds": [ "cf-postmortem" ] }, "decision": { "status": "reported", "summary": "From November 27, technical staff were redirected to Code Red.", "sourceIds": [ "cf-postmortem" ] }, "ownership": { "status": "unknown", "summary": "The report identifies participating teams, but not explicit accountability for the Code Red resourcing decision.", "sourceIds": [] }, "implementation": { "status": "reported", "summary": "Cloudflare reports rotating credentials, separating systems and examining equipment during Code Red.", "sourceIds": [ "cf-postmortem" ] }, "validation": { "status": "unknown", "summary": "No assessment of the Code Red staffing decision or its effectiveness was found. The reported outside investigation concerned the intrusion.", "sourceIds": [ "cf-postmortem" ] } }, "summary": "Cloudflare reported that attackers entered its Atlassian systems with credentials left unrotated after the Okta compromise.", "logo": "/assets/polbench/logos/cloudflare.svg", "mechanism": "accountability", "causalBasis": { "type": "organization-attributed", "summary": "Cloudflare explicitly attributes Code Red to this intrusion.", "sourceIds": [ "cf-postmortem" ] }, "responseKind": "temporary-reprioritization", "decisionState": "adopted", "validationDetails": null, "searchedThrough": "2026-10-20", "followUp": { "summary": "The February 2024 postmortem remains the latest source retained for this staffing decision.", "sourceIds": [ "cf-postmortem" ], "searchNote": "Searched Cloudflare publications, Code Red follow-ups and external review terms through October 20, 2026. A later Cloudflare TV result could not be retrieved; no later assessment of the staffing decision was established." }, "sources": [ { "id": "cf-postmortem", "title": "Thanksgiving 2023 security incident", "url": "https://blog.cloudflare.com/thanksgiving-2023-security-incident/", "date": "2024-02-01", "kind": "organization postmortem", "locator": "'Code Red' section, first two and final paragraphs; introductory incident timeline", "origin": "organization", "retrievedOn": "2026-10-20" } ] }, { "id": "okta-support-2023", "org": "Okta", "title": "Restrictions on personal Google profiles in Chrome", "triggerType": "security-incident", "eventDate": "2023-09-28", "eventDateLabel": "Reported unauthorized-access period begins", "observationEnd": "2023-11-29", "governanceChange": "Okta reported enforcing a Chrome configuration that prevents personal Google-profile sign-in on managed laptops.", "limitation": "Okta marked the browser restriction complete. The cited sources do not identify its accountable owner or report a test of its effectiveness.", "checkpoints": { "finding": { "status": "reported", "summary": "Okta found compromised service-account credentials. Its later investigation also corrected an underestimate of the information downloaded.", "sourceIds": [ "okta-root-cause", "okta-scope-update" ] }, "decision": { "status": "reported", "summary": "Okta identifies blocking personal Google profiles in managed Chrome as incident remediation.", "sourceIds": [ "okta-root-cause" ] }, "ownership": { "status": "unknown", "summary": "The cited report does not identify a role accountable for the browser restriction.", "sourceIds": [] }, "implementation": { "status": "reported", "summary": "The remediation list marks the managed-browser restriction complete.", "sourceIds": [ "okta-root-cause" ] }, "validation": { "status": "unknown", "summary": "The source does not report a test of the browser restriction.", "sourceIds": [ "okta-root-cause" ] } }, "summary": "Okta reported unauthorized access through a support-system service account. Its credentials had been saved in an employee’s personal Google account; the route by which the attacker obtained them remained uncertain.", "logo": "/assets/polbench/logos/okta.svg", "mechanism": "operating-policy", "causalBasis": { "type": "organization-attributed", "summary": "The incident's remediation list directly identifies the browser restriction.", "sourceIds": [ "okta-root-cause" ] }, "responseKind": "new-or-revised-policy", "decisionState": "adopted", "validationDetails": null, "searchedThrough": "2026-10-20", "followUp": { "summary": "On November 29, 2023, Okta said an attacker had downloaded names and email addresses for all users of the affected support system, correcting its earlier account. Separate FedRAMP High, DoD IL4 and Auth0 support systems were excluded. This correction concerns incident scope, not a test of the browser restriction.", "sourceIds": [ "okta-scope-update" ], "searchNote": "Searched Okta follow-ups and independent review terms through October 20, 2026. No later public assessment of the managed-Chrome restriction was located." }, "sources": [ { "id": "okta-root-cause", "title": "Unauthorized Access to Okta's Support Case Management System: Root Cause and Remediation", "url": "https://sec.okta.com/articles/2023/11/unauthorized-access-oktas-support-case-management-system-root-cause/", "date": "2023-11-03", "kind": "organization postmortem", "note": "This early incident report was followed by further scope disclosures. This case does not reuse its initial customer-impact count.", "locator": "Executive Summary, service-account paragraphs; Remediation Tasks, item 2", "origin": "organization", "retrievedOn": "2026-10-20" }, { "id": "okta-scope-update", "title": "October Customer Support Security Incident — Update and Recommended Actions", "url": "https://www.sec.gov/Archives/edgar/data/1660134/000166013423000065/okta-10312023_ex992.htm", "date": "2023-11-29", "kind": "organization incident update filed with SEC", "locator": "Opening disclosure; How we discovered this; third-party forensics paragraph", "origin": "organization", "retrievedOn": "2026-10-20", "note": "An Okta-authored exhibit hosted by the SEC; SEC hosting does not make the claims independent findings." } ] }, { "id": "anthropic-asl3-2025", "org": "Anthropic", "title": "ASL-3 activation for Claude Opus 4", "triggerType": "evaluation", "eventDate": "2025-05-22", "eventDateLabel": "ASL-3 activation announced", "observationEnd": "2026-10-20", "governanceChange": "The existing Responsible Scaling Policy made stronger deployment safeguards and model-weight security conditions for releasing Opus 4.", "limitation": "The initial tests support a limited safeguard-testing claim. Later reports disclose gaps in operation and examine other model versions; none establishes a causal reduction in harm from the May 2025 activation.", "checkpoints": { "finding": { "status": "reported", "summary": "The organization could not rule out the capability risks relevant to ASL-3.", "sourceIds": [ "anthropic-asl3" ] }, "decision": { "status": "reported", "summary": "It activated ASL-3 precautions for Opus 4 under its existing policy.", "sourceIds": [ "anthropic-asl3" ] }, "ownership": { "status": "unknown", "summary": "A named accountable owner for this decision is not established in the cited announcement.", "sourceIds": [] }, "implementation": { "status": "reported", "summary": "Anthropic announced classifiers, two-person weight-access authorization and change controls. A later report disclosed that vendor feedback traffic lacked blocking biology classifiers from May 2025 to April 2026.", "sourceIds": [ "anthropic-asl3", "anthropic-risk-aug-2026" ] }, "validation": { "status": "reported", "summary": "Anthropic reports pre-launch tests of classifiers guarding Sonnet 3.7. Later outside reviews concern successor models or different risks, so they do not independently validate the original Opus 4 deployment.", "sourceIds": [ "anthropic-asl3-report", "securebio-opus46-review", "metr-risk-aug-review" ] } }, "summary": "Anthropic activated ASL-3 safeguards for Claude Opus 4 because it could not confidently rule out the capability risks covered by its policy.", "logo": "/assets/logos/anthropic.svg", "mechanism": "deployment-gate", "causalBasis": { "type": "organization-attributed", "summary": "Anthropic attributes the precautionary activation to uncertainty about Opus 4’s capabilities.", "sourceIds": [ "anthropic-asl3" ] }, "responseKind": "existing-policy-activation", "decisionState": "activated", "validationDetails": { "timing": "pre-deployment", "target": "ASL-3 classifier safeguards before Opus 4 launch; partner testing used classifiers guarding Sonnet 3.7.", "method": "Threat-model test queries in a pre-launch HackerOne bug bounty, alongside internal red teaming.", "result": "Some potentially effective jailbreaks were found; Anthropic reports identifying remediations.", "provenance": "organization", "limitation": "The pre-launch account is published by Anthropic and uses a different guarded model. Later direct external reviews do not retrospectively validate the complete May 2025 Opus 4 safeguard package.", "sourceIds": [ "anthropic-asl3-report" ] }, "searchedThrough": "2026-10-20", "followUp": { "summary": "Anthropic revised the RSP in February 2026. Its August report disclosed a biology-classifier gap on vendor feedback traffic from May 2025 to April 2026; it reported remediation and no detected concerning chemical or biological misuse. SecureBio’s July review of Opus 4.6–4.8 found 94.2% refusal on its hazardous-prompt benchmark, while noting jailbreak and monitoring limits. METR’s October 20 review judged later-model misalignment risk likely low, but found the reasoning insufficient to rule it out confidently. These reviews have different targets from the original Opus 4 activation.", "sourceIds": [ "anthropic-rsp-v3", "anthropic-rsp-log", "anthropic-risk-aug-2026", "securebio-opus46-review", "metr-risk-aug-review" ], "searchNote": "Searched Anthropic, SecureBio, METR and UK AISI through October 20, 2026. Read relevant report sections and direct assessor summaries. Redactions, differing model versions and limited assessor access constrain comparisons." }, "sources": [ { "id": "anthropic-asl3", "title": "Activating AI Safety Level 3 protections", "url": "https://www.anthropic.com/news/activating-asl3-protections", "date": "2025-05-22", "kind": "organization policy implementation", "locator": "Opening paragraphs; Deployment Measures, first bullet; Security, second paragraph", "origin": "organization", "retrievedOn": "2026-10-20" }, { "id": "anthropic-asl3-report", "title": "Activating AI Safety Level 3 Protections — technical report", "url": "https://anthropic.com/activating-asl3-report", "date": "2025-05", "dateType": "report-date", "kind": "organization technical report", "note": "Cover gives May 2025; linked from the May 22 announcement. Historical page versions were not reconstructed.", "locator": "Sections 2.2.1–2.2.2, printed pages 7–9: pre-deployment tests and bug bounty.", "origin": "organization", "retrievedOn": "2026-10-20" }, { "id": "anthropic-rsp-v3", "title": "Anthropic’s Responsible Scaling Policy: Version 3.0", "url": "https://www.anthropic.com/news/responsible-scaling-policy-v3", "date": "2026-02-24", "kind": "organization policy revision", "locator": "Assessing our theory of change; Updating our Responsible Scaling Policy", "origin": "organization", "retrievedOn": "2026-10-20" }, { "id": "anthropic-rsp-log", "title": "Responsible Scaling Policy — version history", "url": "https://www.anthropic.com/responsible-scaling-policy", "date": "2026-08-14", "kind": "organization policy changelog", "locator": "August 14 and July 8, 2026 entries", "origin": "organization", "retrievedOn": "2026-10-20", "dateType": "latest-dated-entry", "note": "Live changelog. August 14 records publication of the August report, whose coverage ends July 15." }, { "id": "anthropic-risk-aug-2026", "title": "Risk Report: August 2026 — redacted public version", "url": "https://www-cdn.anthropic.com/f61d49fa5596956a5dec75fea0e973bf6a6a8378/Redacted%20Risk%20Report%20August%202026%20.pdf", "date": "2026-08-14", "kind": "organization risk report", "locator": "Sections 4.5.3 and 4.5.8.2.2, printed pages 135–139 and 148–149", "origin": "organization", "retrievedOn": "2026-10-20", "note": "Publication date is established by the RSP changelog; the report covers evidence through July 15, 2026." }, { "id": "securebio-opus46-review", "title": "Review of Anthropic’s Unredacted Chemical and Biological Risk Report: Claude Opus 4.6", "url": "https://securebio.org/blog/review-of-anthropics-unredacted-chemical/", "date": "2026-07-28", "kind": "external safeguard assessment", "locator": "Summary of our Review; model-scope paragraph; external review criteria", "origin": "external", "retrievedOn": "2026-10-20", "note": "SecureBio says it received no Anthropic funding. Its review applies to Opus 4.6–4.8, not the original Opus 4 deployment. The page contains an apparent year typo for the RSP v3 release; the Anthropic original dates it February 24, 2026." }, { "id": "metr-risk-aug-review", "title": "Review of the Misalignment in high-stakes settings section in Anthropic’s August 2026 Risk Report", "url": "https://metr.org/blog/2026-10-20-misalignment-risk-report-august-2026-review/", "date": "2026-10-20", "kind": "external risk-report review", "locator": "Scope and access; redaction statement; executive summary", "origin": "external", "retrievedOn": "2026-10-20", "note": "Review of later-model misalignment reasoning, based on Anthropic’s internal report. Not an assessment of the original Opus 4 ASL-3 chemical/biological safeguards." } ] }, { "id": "equifax-settlement-2019", "org": "Equifax", "title": "FTC security program and board reporting", "triggerType": "security-incident", "eventDate": "2019-07-22", "eventDateLabel": "FTC proposed-settlement announcement", "observationEnd": "2026-03-18", "governanceChange": "The order requires designated program responsibility, annual board certifications and regular independent assessments. Later company filings describe a CISO-led program with board committee oversight.", "limitation": "The order settles allegations without an admission. Later program and assessment results are company reports; they do not establish compliance with every order provision or show that the settlement caused the reported improvements.", "checkpoints": { "finding": { "status": "documented", "summary": "The FTC record describes alleged failures to secure consumer information; the order does not adjudicate those allegations.", "sourceIds": [ "equifax-ftc", "equifax-signed-order" ] }, "decision": { "status": "documented", "summary": "The court entered the security-program and accountability requirements on July 23, 2019.", "sourceIds": [ "equifax-signed-order" ] }, "ownership": { "status": "reported", "summary": "The 2024 Form 10-K assigns program execution to the CISO and describes quarterly reporting to the board’s Technology Committee.", "sourceIds": [ "equifax-2024-10k" ] }, "implementation": { "status": "reported", "summary": "Later filings describe an operating security program, board review and risk assessments. They do not establish completion of every court-ordered requirement.", "sourceIds": [ "equifax-2024-10k", "equifax-security-2025" ] }, "validation": { "status": "planned", "summary": "The order requires independent assessments. The later maturity score does not identify an assessment of compliance with the order or test the board-reporting requirements.", "sourceIds": [ "equifax-signed-order", "equifax-security-2025" ] } }, "summary": "The FTC’s case over the 2017 breach led to a signed July 23, 2019 order requiring a security program, accountable staff, board reporting and outside assessments.", "logo": "/assets/polbench/logos/equifax.svg", "mechanism": "mandated-program", "causalBasis": { "type": "regulator-record", "summary": "The FTC action ties the required program to the 2017 breach. Later company reports describe the program but do not isolate the settlement’s effect.", "sourceIds": [ "equifax-ftc", "equifax-signed-order" ] }, "responseKind": "regulatory-program", "decisionState": "adopted", "searchedThrough": "2026-10-20", "followUp": { "summary": "The proposal became a court order on July 23, 2019. A 2025 filing describes CISO responsibility and board reviews. The March 2026 security report names Jeremy Koppen as CISO and reports a 4.4 maturity score from an outside firm using a NIST-based framework. The underlying assessor report is not provided, and this score does not establish compliance with the order.", "sourceIds": [ "equifax-signed-order", "equifax-2024-10k", "equifax-security-2025-release", "equifax-security-2025" ], "searchNote": "Searched FTC records, Equifax filings and security reports through October 20, 2026. Later consumer-credit enforcement matters concern different obligations and are not treated as outcomes of this security order." }, "sources": [ { "id": "equifax-ftc", "title": "Equifax settlement related to the 2017 data breach", "url": "https://www.ftc.gov/news-events/news/press-releases/2019/07/equifax-pay-575-million-part-settlement-ftc-cfpb-states-related-2017-data-breach", "date": "2019-07-22", "kind": "regulator record", "locator": "Final procedural paragraph and following NOTE", "origin": "external", "retrievedOn": "2026-10-20" }, { "id": "equifax-proposed-order", "title": "Equifax proposed stipulated order", "url": "https://www.ftc.gov/system/files/documents/cases/172_3203_equifax_proposed_order_7-22-19.pdf", "date": "2019-07-22", "kind": "proposed legal order", "note": "Filed proposal; not evidence of completed compliance.", "locator": "Findings ¶3, p.2; II.C, p.13; III.C–D, p.21; V, p.24", "origin": "external", "retrievedOn": "2026-10-20" }, { "id": "equifax-signed-order", "title": "Stipulated Order for Permanent Injunction and Monetary Judgment", "url": "https://www.ftc.gov/system/files/documents/cases/172_3203_equifax_order_signed_7-23-19.pdf", "date": "2019-07-23", "kind": "signed court order", "locator": "Filed-date header; Findings paragraph 3; sections II.C, III.C–D and V", "origin": "external", "retrievedOn": "2026-10-20", "note": "The signed order follows the July 22 proposal. Entry of the order does not establish subsequent compliance." }, { "id": "equifax-2024-10k", "title": "Equifax 2024 Form 10-K", "url": "https://investor.equifax.com/sec-filings/all-sec-filings/content/0000033185-25-000025/0000033185-25-000025.pdf", "date": "2025-02-20", "kind": "organization regulatory filing", "locator": "Item 1C, Governance, printed pages 27–28", "origin": "organization", "retrievedOn": "2026-10-20", "note": "Company statements in a regulatory filing; the financial-statement audit does not independently verify these cybersecurity statements." }, { "id": "equifax-security-2025-release", "title": "Equifax Releases 2025 Security Annual Report", "url": "https://investor.equifax.com/news-events/press-releases/detail/1399/equifax-releases-2025-security-annual-report", "date": "2026-03-18", "kind": "organization report announcement", "locator": "Publication date; security maturity and new CISO paragraphs", "origin": "organization", "retrievedOn": "2026-10-20" }, { "id": "equifax-security-2025", "title": "2025 Security Annual Report", "url": "https://assets.equifax.com/assets/corp/equifax-2025-security-annual-report.pdf", "date": "2026-03-18", "kind": "organization security report", "locator": "Printed pages 4, 7–8, 12–14", "origin": "organization", "retrievedOn": "2026-10-20", "note": "Release date established by the companion announcement. The maturity assessor and posture-rating provider are unnamed; their underlying reports are not supplied." } ] }, { "id": "github-npm-2fa-2021", "org": "GitHub", "title": "Mandatory authentication for npm maintainers", "triggerType": "security-incident", "eventDate": "2021-11-15", "eventDateLabel": "Incident review and policy announcement", "observationEnd": "2026-09-17", "summary": "GitHub cited takeovers of npm packages including ua-parser-js, coa and rc when it announced mandatory two-factor authentication for popular-package maintainers.", "governanceChange": "Mandatory 2FA became a condition of access for a defined maintainer cohort. GitHub later reported that all maintainers of the top 100 packages by dependents were enrolled.", "limitation": "The case concerns npm ecosystem rules. Later authentication changes broaden protection but do not measure the original cohort’s reduction in takeovers.", "logo": "/assets/polbench/logos/github.svg", "checkpoints": { "finding": { "status": "reported", "summary": "GitHub identifies account takeovers and explains why malware detection alone does not resolve account-security weaknesses.", "sourceIds": [ "github-npm-commitment" ] }, "decision": { "status": "reported", "summary": "The November announcement selects mandatory 2FA for popular-package maintainers, with rollout to begin in 2022.", "sourceIds": [ "github-npm-commitment" ] }, "ownership": { "status": "unknown", "summary": "The cited sources do not assign a specific role or team responsibility for the maintainer rollout.", "sourceIds": [ "github-npm-commitment" ] }, "implementation": { "status": "reported", "summary": "The later update reports enrollment of all maintainers of the top-100 packages by dependents on February 1.", "sourceIds": [ "github-npm-progress" ] }, "validation": { "status": "unknown", "summary": "No outcome assessment of the original mandatory-2FA cohort was located. Later releases describe additional controls, not a measured effect of that cohort policy.", "sourceIds": [ "github-npm-progress", "github-npm-roadmap-2026" ] } }, "mechanism": "operating-policy", "causalBasis": { "type": "organization-attributed", "summary": "GitHub connects the mandatory-2FA decision to maintainer account takeovers.", "sourceIds": [ "github-npm-commitment", "github-npm-progress" ] }, "responseKind": "new-or-revised-policy", "decisionState": "adopted", "validationDetails": null, "searchedThrough": "2026-10-20", "followUp": { "summary": "GitHub revoked classic npm tokens in December 2025. Its September 2026 roadmap reports staged publishing with 2FA approval and tighter permissions for tokens that bypass 2FA. It schedules removal of direct publishing with those tokens for January 2027; that deadline is still a plan at this search date.", "sourceIds": [ "github-npm-tokens-2025", "github-npm-roadmap-2026" ], "searchNote": "Searched GitHub/npm updates and external cohort studies through October 20, 2026. Later supply-chain incidents and new policies are context, not evidence that the original top-100 rollout succeeded or failed." }, "sources": [ { "id": "github-npm-commitment", "title": "GitHub's commitment to npm ecosystem security", "url": "https://github.blog/open-source/githubs-commitment-to-npm-ecosystem-security/", "date": "2021-11-15", "kind": "organization incident review", "locator": "Account-takeover section, paragraph beginning 'That said'", "origin": "organization", "retrievedOn": "2026-10-20" }, { "id": "github-npm-enforcement", "title": "Top-100 npm package maintainers now require 2FA", "url": "https://github.blog/security/supply-chain-security/top-100-npm-package-maintainers-require-2fa-additional-security/", "date": "2022-02-01", "updatedDate": "2022-02-11", "kind": "organization rollout announcement", "locator": "First rollout paragraph; following enhanced-login paragraph", "origin": "organization", "retrievedOn": "2026-10-20" }, { "id": "github-npm-progress", "title": "Enhanced 2FA experience for your npm account", "url": "https://github.blog/news-insights/product-news/enhanced-2fa-experience-for-your-npm-account/", "date": "2022-05-10", "updatedDate": "2022-06-02", "kind": "organization progress update", "locator": "Byline dates and paragraph below the sign-in animation", "origin": "organization", "retrievedOn": "2026-10-20" }, { "id": "github-npm-tokens-2025", "title": "npm classic tokens revoked, session-based auth and CLI token management now available", "url": "https://github.blog/changelog/2025-12-09-npm-classic-tokens-revoked-session-based-auth-and-cli-token-management-now-available/", "date": "2025-12-09", "kind": "organization implementation update", "locator": "Classic tokens; session-based authentication; 2FA publishing requirements", "origin": "organization", "retrievedOn": "2026-10-20" }, { "id": "github-npm-roadmap-2026", "title": "npm’s roadmap: safer publishing, smoother workflows, and what’s next", "url": "https://github.com/orgs/community/discussions/208130", "date": "2026-09-17", "kind": "organization product roadmap", "locator": "Original post by npm product manager Leo Balter; What we have shipped since May; token migration paragraphs", "origin": "organization", "retrievedOn": "2026-10-20", "note": "The original dated post distinguishes shipped changes from January 2027 plans. Later discussion replies are not treated as the source publication date." } ] }, { "id": "circleci-production-access-2023", "org": "CircleCI", "title": "Restrictions on production access", "triggerType": "security-incident", "eventDate": "2023-01-04", "eventDateLabel": "Incident disclosure and access restriction", "observationEnd": "2023-01-12", "summary": "CircleCI reported that malware on an employee laptop stole an authenticated session, allowing an attacker into production systems and exposing customer secrets.", "governanceChange": "Production access was limited to a small operational group, with additional authentication requirements for retained access.", "limitation": "The report describes the access restriction as operating while further measures were developed. It does not show completion of the planned short-lived permissions or outside configuration review.", "logo": "/assets/polbench/logos/circleci.svg", "checkpoints": { "finding": { "status": "reported", "summary": "A stolen authenticated session exposed production access and customer secrets.", "sourceIds": [ "circleci-postmortem" ] }, "decision": { "status": "reported", "summary": "CircleCI reduced production access and strengthened authentication for remaining users.", "sourceIds": [ "circleci-postmortem" ] }, "ownership": { "status": "unknown", "summary": "The report’s CTO byline does not assign ongoing responsibility for these access controls.", "sourceIds": [ "circleci-postmortem" ] }, "implementation": { "status": "reported", "summary": "The company describes restricted access and added authentication controls as implemented.", "sourceIds": [ "circleci-postmortem" ] }, "validation": { "status": "unknown", "summary": "The report does not establish a test of the new production-access rules. Its proposed outside tooling review has a broader target.", "sourceIds": [ "circleci-postmortem" ] } }, "mechanism": "operating-policy", "causalBasis": { "type": "organization-attributed", "summary": "The report explicitly lists access restrictions as incident response.", "sourceIds": [ "circleci-postmortem" ] }, "responseKind": "new-or-revised-policy", "decisionState": "adopted", "validationDetails": null, "searchedThrough": "2026-10-20", "followUp": { "summary": "The January 2023 incident report remains the latest source retained for the internal production-access restriction.", "sourceIds": [ "circleci-postmortem" ], "searchNote": "Searched CircleCI incident follow-ups, access-control and outside-review terms through October 20, 2026. Later reliability updates and customer OIDC features did not establish whether this internal restriction was tested or replaced." }, "sources": [ { "id": "circleci-postmortem", "title": "CircleCI Jan 4, 2023 security incident report", "url": "https://circleci.com/blog/jan-4-2023-incident-report/", "date": "2023-01-12", "kind": "organization postmortem", "locator": "Incident-response bullets; attack-vector section; lessons section's first plan", "origin": "organization", "retrievedOn": "2026-10-20" } ] }, { "id": "dropbox-webauthn-2022", "org": "Dropbox", "title": "Accelerated WebAuthn rollout", "triggerType": "security-incident", "eventDate": "2022-10-14", "eventDateLabel": "Notification of suspicious access", "observationEnd": "2022-11-01", "summary": "Dropbox reported that phishing captured credentials and a one-time password, enabling access to a GitHub organization.", "governanceChange": "Dropbox accelerated an existing move to WebAuthn for employee authentication.", "limitation": "The November 2022 post promised wider deployment. The search through October 20, 2026 did not locate a completion report or a test of that rollout. The outside forensic work described in the post examined the breach.", "logo": "/assets/polbench/logos/dropbox.svg", "checkpoints": { "finding": { "status": "reported", "summary": "Attackers captured credentials and a one-time password, then accessed Dropbox’s GitHub organization.", "sourceIds": [ "dropbox-phishing" ] }, "decision": { "status": "reported", "summary": "Dropbox announced a decision to accelerate its existing WebAuthn migration.", "sourceIds": [ "dropbox-phishing" ] }, "ownership": { "status": "unknown", "summary": "The post does not assign a role, team or person responsibility for completing the employee migration.", "sourceIds": [] }, "implementation": { "status": "planned", "summary": "Dropbox said protection across its environment was coming soon.", "sourceIds": [ "dropbox-phishing" ] }, "validation": { "status": "unknown", "summary": "The collected sources do not show a test of the accelerated migration.", "sourceIds": [ "dropbox-phishing" ] } }, "mechanism": "operating-policy", "causalBasis": { "type": "organization-attributed", "summary": "Dropbox linked the faster rollout to the attack; the migration had already begun.", "sourceIds": [ "dropbox-phishing" ] }, "responseKind": "implementation-acceleration", "decisionState": "committed", "validationDetails": null, "searchedThrough": "2026-10-20", "followUp": { "summary": "Targeted searches found the original response and customer authentication guidance, but no later report establishing completion of this employee rollout.", "sourceIds": [], "searchNote": "Searches through October 20, 2026 found no later employee-rollout completion or test. Customer sign-in guidance covers a different deployment." }, "sources": [ { "id": "dropbox-phishing", "title": "How we handled a recent phishing incident that targeted Dropbox", "url": "https://dropbox.tech/security/a-recent-phishing-campaign-targeting-dropbox", "date": "2022-11-01", "kind": "organization postmortem", "locator": "Opening notification paragraph; incident-response paragraph; final section about next steps.", "origin": "organization", "retrievedOn": "2026-10-20" } ] }, { "id": "twilio-phishing-2022", "org": "Twilio", "title": "Administrative access and training changes", "triggerType": "security-incident", "eventDate": "2022-08-04", "eventDateLabel": "Incident detected", "observationEnd": "2026-08-07", "summary": "Twilio reported that employee credentials captured through social engineering enabled access to internal tools and customer information.", "governanceChange": "Twilio tightened authentication and administrative access, shortened access-token lifetimes, and added training and phishing exercises.", "limitation": "The later filings describe the response but give no results from the phishing exercises or tests of the changed access rules. Distributed security keys do not establish mandatory use; financial materiality does not measure control effectiveness.", "logo": "/assets/polbench/logos/twilio.svg", "checkpoints": { "finding": { "status": "reported", "summary": "Social engineering exposed employee credentials and internal administrative access.", "sourceIds": [ "twilio-final-report" ] }, "decision": { "status": "reported", "summary": "Twilio changed authentication, access and mandatory-training requirements in response.", "sourceIds": [ "twilio-final-report" ] }, "ownership": { "status": "unknown", "summary": "Incident-response personnel are described, but continuing ownership of the changed controls is not.", "sourceIds": [] }, "implementation": { "status": "reported", "summary": "Twilio’s 2025 filing repeats the access changes and says it ran simulated phishing attempts.", "sourceIds": [ "twilio-final-report", "twilio-2024-10k" ] }, "validation": { "status": "unknown", "summary": "Phishing exercises are reported, but their results and tests of the changed access rules are not published in the collected sources.", "sourceIds": [ "twilio-2024-10k", "twilio-2026-q2" ] } }, "mechanism": "operating-policy", "causalBasis": { "type": "organization-attributed", "summary": "Both the incident update and the later filing identify these measures as responses to the 2022 attacks.", "sourceIds": [ "twilio-final-report", "twilio-2024-10k" ] }, "responseKind": "new-or-revised-policy", "decisionState": "adopted", "validationDetails": null, "searchedThrough": "2026-10-20", "followUp": { "summary": "The August 2026 filing still discusses the 2022 compromise and its remediation. It reports no material financial impact from security events to date, without evaluating the effectiveness of these particular controls.", "sourceIds": [ "twilio-2026-q2" ], "searchNote": "Searches through October 20, 2026 located later filings but no published results for these controls or phishing exercises." }, "sources": [ { "id": "twilio-final-report", "title": "Incident Report: Employee and Customer Account Compromise", "url": "https://www.twilio.com/en-us/blog/archive/2022/august-2022-social-engineering-attack", "date": "2022-10-27", "kind": "organization postmortem", "note": "Final investigation update; the initial post was published August 7, 2022.", "locator": "Initial incident summary and the October 27 final update's eradication/remediation section, especially the five additional-measures bullets.", "origin": "organization", "retrievedOn": "2026-10-20" }, { "id": "twilio-2024-10k", "title": "Twilio 2024 Form 10-K", "url": "https://investors.twilio.com/static-files/8458b5e3-f381-4b6a-98c9-aeae3a0070ff", "date": "2025-02-26", "dateType": "publication-date", "kind": "organization regulatory filing", "locator": "Printed page 24, paragraph beginning 'For example, in June and August 2022'; remediation list.", "origin": "organization", "retrievedOn": "2026-10-20", "note": "Filing date; financial year ended December 31, 2024." }, { "id": "twilio-2026-q2", "title": "Twilio Form 10-Q for the quarter ended June 30, 2026", "url": "https://investors.twilio.com/static-files/0179868a-a6a0-4633-a36f-1b0bba0ef714", "date": "2026-08-07", "dateType": "publication-date", "kind": "organization regulatory filing", "locator": "Printed page 55 (PDF page 55), cybersecurity risk factor, paragraph beginning 'In the normal course of business'.", "origin": "organization", "retrievedOn": "2026-10-20", "note": "Filing date, not the quarter-end date." } ] }, { "id": "zoom-security-plan-2020", "org": "Zoom", "title": "Security review and development changes", "triggerType": "security-incident", "eventDate": "2020-04-01", "eventDateLabel": "Security-response plan announced", "observationEnd": "2025-05-12", "summary": "Zoom’s April 2020 response to privacy concerns and meeting harassment changed development priorities and vulnerability handling. Later reports describe the bug-bounty program’s operation and performance.", "governanceChange": "Zoom reported a 90-day freeze on unrelated features, security checks throughout development, daily vulnerability triage and an advisory CISO council.", "limitation": "The available performance claims concern vulnerability handling. They do not isolate the effect of the 2020 reforms or measure the CISO council’s effectiveness. Luta helped deliver the changes; neither its summary nor Zoom’s later post supplies the underlying case data.", "checkpoints": { "finding": { "status": "reported", "summary": "Zoom acknowledged privacy and security concerns, including incidents of meeting harassment.", "sourceIds": [ "zoom-plan" ] }, "decision": { "status": "reported", "summary": "The company reported a 90-day freeze on unrelated features and introduced recurring security-review mechanisms.", "sourceIds": [ "zoom-progress" ] }, "ownership": { "status": "reported", "summary": "COO Aparna Bawa oversaw security; Deputy CIO Gary Sorrentino led the CISO council.", "sourceIds": [ "zoom-progress" ] }, "implementation": { "status": "reported", "summary": "The council had met four times; Zoom described a central bug repository, daily triage and development-stage security requirements.", "sourceIds": [ "zoom-progress" ] }, "validation": { "status": "unknown", "summary": "Later bug-bounty metrics do not test the CISO council or the specific development and daily-triage rules introduced in 2020.", "sourceIds": [ "zoom-bounty-2024-review" ] } }, "logo": "/assets/polbench/logos/zoom.png", "mechanism": "accountability", "causalBasis": { "type": "organization-attributed", "summary": "Zoom tied the 2020 changes to several security and privacy concerns and a rapid change in usage.", "sourceIds": [ "zoom-plan", "zoom-progress" ] }, "responseKind": "new-or-revised-policy", "decisionState": "adopted", "validationDetails": null, "searchedThrough": "2026-10-20", "followUp": { "summary": "Luta describes reviewing and improving bug handling in 2020. Zoom’s May 2025 review reports more than 90% improvement in average resolution time during February 2024–January 2025. It gives no raw durations or comparison group and does not measure the effect of the 2020 changes.", "sourceIds": [ "zoom-luta-review", "zoom-bounty-2024-review" ], "searchNote": "Searches through October 20, 2026 found later program metrics, but no evaluation of the council or the specific daily-triage and development rules." }, "sources": [ { "id": "zoom-plan", "title": "A Message to Our Users", "url": "https://www.zoom.com/en/blog/a-message-to-our-users/", "date": "2020-04-01", "kind": "organization response", "locator": "Opening acknowledgement, usage-context discussion, and seven-action plan near the end.", "origin": "organization", "retrievedOn": "2026-10-20" }, { "id": "zoom-progress", "title": "CEO Report: 90 Days Done, What's Next for Zoom", "url": "https://www.zoom.com/en/blog/ceo-report-90-days-done-whats-next-for-zoom/", "date": "2020-07-01", "kind": "organization progress report", "note": "Later editorial updates concern data-routing language, which this case does not reuse.", "locator": "Commitments 1, 2, 4, 5 and 6; personnel updates near the end.", "origin": "organization", "retrievedOn": "2026-10-20" }, { "id": "zoom-luta-review", "title": "Luta Security Highlights for Zoom Bug Bounty Programs", "url": "https://www.lutasecurity.com/post/luta-security-highlights-for-zoom-bug-bounty-programs", "date": "2023-10-25", "dateType": "updated-date", "kind": "engaged adviser retrospective", "locator": "Displayed publication/update dates; paragraphs on bug cases, maturity gap analysis, staffing and advisory role.", "origin": "external", "retrievedOn": "2026-10-20", "relationship": "engaged-adviser", "originalPublicationDate": "2020-07-01", "note": "The page describes work completed in 2020 and displays an October 25, 2023 update. No archived comparison established what changed in that update." }, { "id": "zoom-bounty-2024-review", "title": "Zoom’s security journey: Our 2024 bug bounty year in review", "url": "https://www.zoom.com/en/blog/bug-bounty-program/", "date": "2025-05-12", "dateType": "publication-date", "kind": "organization program review", "locator": "Publication date and Roy Davis byline; 'Our multi-layered security approach' and 'By the numbers: A year of security wins'.", "origin": "organization", "retrievedOn": "2026-10-20", "note": "Metric period is February 2024–January 2025." } ] }, { "id": "meta-privacy-program-2020", "org": "Meta", "title": "Privacy governance under the FTC order", "triggerType": "security-incident", "eventDate": "2019-07-24", "eventDateLabel": "Facebook settlement announced", "observationEnd": "2025-07-30", "summary": "Facebook, now Meta, linked its privacy overhaul to the FTC investigation following Cambridge Analytica. The settlement order received court approval in April 2020.", "governanceChange": "The response introduced board privacy oversight, executive certifications, product privacy review and named implementation leaders.", "limitation": "The initial assessment had mixed findings. In 2023, the FTC alleged noncompliance and proposed stronger terms; Meta disputed those claims. The July 2025 stay paused that proceeding without deciding the merits. The public excerpt cannot establish current program-wide effectiveness.", "checkpoints": { "finding": { "status": "documented", "summary": "The FTC record describes alleged violations of Facebook's earlier privacy order.", "sourceIds": [ "meta-final" ] }, "decision": { "status": "documented", "summary": "The final order codified a revised privacy program and greater accountability.", "sourceIds": [ "meta-final" ] }, "ownership": { "status": "reported", "summary": "Facebook named Delfina Eberly to lead program design, implementation and testing; its board committee provided oversight.", "sourceIds": [ "meta-program", "meta-assessment" ] }, "implementation": { "status": "documented", "summary": "Protiviti’s assessment documents established board and senior-management privacy oversight and a dedicated Privacy Review function.", "sourceIds": [ "meta-assessor-direct" ] }, "validation": { "status": "documented", "summary": "Protiviti’s initial assessment found foundations in place and substantial work remaining. Later FTC allegations and Meta’s rebuttal do not establish a new assessment result.", "sourceIds": [ "meta-assessor-direct", "meta-ftc-2023", "meta-response-2023" ] } }, "logo": "/assets/polbench/logos/meta.svg", "mechanism": "mandated-program", "causalBasis": { "type": "organization-attributed", "summary": "Facebook explicitly connected the agreement to the investigation following Cambridge Analytica.", "sourceIds": [ "meta-agreement" ] }, "responseKind": "regulatory-program", "decisionState": "adopted", "validationDetails": { "timing": "post-implementation", "assessmentStart": "2020-10-25", "assessmentEnd": "2021-04-22", "target": "Part VII mandated privacy program; U.S. users and functionality.", "method": "Assessor document review, interviews, walkthroughs and sampled design/operating tests; unimplemented safeguards were not operating-tested.", "result": "Mixed: foundations established; substantial additional work and investment needed.", "provenance": "external-direct", "limitation": "The excerpt is redacted, and newer safeguards had little operating history. It does not establish current effectiveness or a reduction in privacy harm.", "sourceIds": [ "meta-assessor-direct" ] }, "searchedThrough": "2026-10-20", "followUp": { "summary": "Meta’s 2025 account reports continued investment and assessor feedback. The latest dated entry located in the FTC case record is the July 30, 2025 stay, pending resolution of federal-court challenges.", "sourceIds": [ "meta-privacy-2025", "meta-stay-2025", "meta-case-index" ], "searchNote": "The FTC timeline checked on October 20, 2026 ended with the July 2025 stay. The review did not establish a final resolution of the related federal cases or locate a newer public assessor report." }, "sources": [ { "id": "meta-agreement", "title": "FTC Agreement Brings Rigorous New Standards for Protecting Your Privacy", "url": "https://about.fb.com/news/2019/07/ftc-agreement/", "date": "2019-07-24", "kind": "organization announcement", "locator": "Opening paragraphs connecting the FTC investigation to Cambridge Analytica; accountability provisions.", "origin": "organization", "retrievedOn": "2026-10-20" }, { "id": "meta-final", "title": "FTC Gives Final Approval to Modify Facebook's Privacy Order", "url": "https://www.ftc.gov/news-events/news/press-releases/2020/04/ftc-gives-final-approval-modify-ftcs-2012-privacy-order-facebook-provisions-2019-settlement", "date": "2020-04-28", "kind": "regulator final-order record", "locator": "Opening announcement and paragraph reporting the April 23 court entry.", "origin": "external", "retrievedOn": "2026-10-20" }, { "id": "meta-program", "title": "Final FTC Agreement Represents a New Level of Accountability for Privacy", "url": "https://about.fb.com/news/2020/04/final-ftc-agreement/", "date": "2020-04-23", "kind": "organization implementation report", "locator": "Privacy leadership and program section naming Delfina Eberly.", "origin": "organization", "retrievedOn": "2026-10-20" }, { "id": "meta-assessment", "title": "Completing a Six-Month Independent Privacy Assessment", "url": "https://about.fb.com/news/2021/09/independent-privacy-assessment/", "date": "2021-09-22", "kind": "organization account of external assessment", "locator": "Opening paragraphs; progress section; final improvement section.", "origin": "organization", "retrievedOn": "2026-10-20" }, { "id": "meta-assessor-direct", "title": "Protiviti: Initial Privacy Program Assessment — redacted executive summary and methodology", "url": "https://www.ftc.gov/system/files/documents/foia_requests/facebook_assessment_report-executive_summary-redacted_for_release.pdf", "date": "2021-06-21", "dateType": "report-date", "publicReleaseDate": null, "kind": "external assessor report excerpt", "note": "Date is the assessor’s cover-letter date. FTC-hosted redacted excerpt retrieved October 20, 2026; its original public-release date is unconfirmed. The full report was not reviewed.", "locator": "Cover; printed pages 1–4 (approach, implementation, findings), 7–8 (scope), 11 (operating tests).", "origin": "external", "retrievedOn": "2026-10-20" }, { "id": "meta-ftc-2023", "title": "FTC Proposes Blanket Prohibition Preventing Facebook from Monetizing Youth Data", "url": "https://www.ftc.gov/news-events/news/press-releases/2023/05/ftc-proposes-blanket-prohibition-preventing-facebook-monetizing-youth-data", "date": "2023-05-03", "dateType": "publication-date", "kind": "regulator proposed enforcement action", "locator": "Opening allegations; paragraph on the assessor’s gaps and weaknesses; final note describing the start of proceedings.", "origin": "external", "retrievedOn": "2026-10-20" }, { "id": "meta-response-2023", "title": "Upholding Our Commitment to Protecting Your Privacy: What the FTC Gets Wrong", "url": "https://about.fb.com/news/2023/05/upholding-our-commitment-to-protecting-your-privacy/", "date": "2023-05-03", "dateType": "publication-date", "kind": "organization response to regulator", "locator": "Opening response; 'The FTC’s Latest Action Ignores Key Facts'; first-assessment and second-assessment paragraphs.", "origin": "organization", "retrievedOn": "2026-10-20" }, { "id": "meta-privacy-2025", "title": "Reflecting on Meta’s $8 Billion Investment in Privacy", "url": "https://about.fb.com/news/2025/01/meta-8-billion-investment-privacy/", "date": "2025-07-09", "dateType": "updated-date", "kind": "organization program review", "locator": "Displayed dates, Michel Protti byline, takeaways, and 'The Catalyst for Change'.", "origin": "organization", "retrievedOn": "2026-10-20", "originalPublicationDate": "2025-01-28", "note": "The page displays January 28 and July 9, 2025. The later date is treated as an update, not as the date every described action occurred." }, { "id": "meta-stay-2025", "title": "Order Staying Show Cause Proceeding", "url": "https://www.ftc.gov/system/files/ftc_gov/pdf/c4365_2025.07.30_commission_order_staying_proceeding__0.pdf", "date": "2025-07-30", "dateType": "order-date", "kind": "regulator procedural order", "locator": "Page 1, operative stay paragraph and issuance date.", "origin": "external", "retrievedOn": "2026-10-20" }, { "id": "meta-case-index", "title": "Facebook, Inc., In the Matter of", "url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/092-3184-182-3109-c-4365-facebook-inc-matter", "date": "2025-07-30", "dateType": "updated-date", "kind": "regulator case timeline", "locator": "Last Updated date and first case-timeline entry.", "origin": "external", "retrievedOn": "2026-10-20", "note": "The latest dated entry visible when retrieved was the July 30, 2025 stay. This does not establish the disposition of every related federal case." } ] }, { "id": "uber-ftc-2018", "org": "Uber", "title": "Breach reporting and recordkeeping requirements", "triggerType": "security-incident", "eventDate": "2018-10-26", "eventDateLabel": "Final FTC settlement announced", "observationEnd": "2026-02-13", "summary": "After Uber's second breach and delayed disclosure, the FTC expanded its settlement and gave final approval in October 2018.", "governanceChange": "The revised settlement added specified incident notices, submission of all privacy assessments and retention of relevant bug-bounty records. A comprehensive privacy program and recurring assessments were already in the 2017 proposal.", "limitation": "The DOJ later acknowledged broader remediation, but the collected records do not show operation of each added reporting or recordkeeping duty. General audit counts do not identify the assessments required by this order.", "checkpoints": { "finding": { "status": "documented", "summary": "The FTC describes two breaches and delayed disclosure of the 2016 incident.", "sourceIds": [ "uber-final" ] }, "decision": { "status": "documented", "summary": "The FTC finalized added incident notices, submission of assessments and bug-bounty record retention after the undisclosed breach.", "sourceIds": [ "uber-final", "uber-order", "uber-original" ] }, "ownership": { "status": "planned", "summary": "The order requires responsible employees; the collected records do not identify the assignment for these added duties.", "sourceIds": [ "uber-order" ] }, "implementation": { "status": "planned", "summary": "The added notice and recordkeeping duties are required. The DOJ’s later account describes broader changes without confirming each duty’s operation.", "sourceIds": [ "uber-order", "uber-doj-2022" ] }, "validation": { "status": "planned", "summary": "The order requires recurring independent assessments. No completed report evaluating these duties was located.", "sourceIds": [ "uber-order", "uber-2025-10k" ] } }, "logo": "/assets/polbench/logos/uber.svg", "mechanism": "mandated-program", "causalBasis": { "type": "regulator-record", "summary": "The FTC connected the expanded terms to the second breach and delayed disclosure. The original privacy-program requirements were already in the 2017 proposal.", "sourceIds": [ "uber-expanded", "uber-final" ] }, "responseKind": "regulatory-program", "decisionState": "adopted", "validationDetails": null, "searchedThrough": "2026-10-20", "followUp": { "summary": "In 2022, the DOJ acknowledged changes in leadership and substantial investment in compliance, legal and security functions. Uber’s February 2026 filing still lists the FTC obligations, without publishing their assessment results.", "sourceIds": [ "uber-doj-2022", "uber-2025-10k" ], "searchNote": "Searches through October 20, 2026 found broad audit counts and continuing obligations, but no completed public FTC assessment of these duties." }, "sources": [ { "id": "uber-final", "title": "Federal Trade Commission Gives Final Approval to Settlement with Uber", "url": "https://www.ftc.gov/news-events/news/press-releases/2018/10/federal-trade-commission-gives-final-approval-settlement-uber", "date": "2018-10-26", "kind": "regulator final-settlement record", "locator": "Second-breach paragraph and following final-terms paragraphs.", "origin": "external", "retrievedOn": "2026-10-20" }, { "id": "uber-order", "title": "Uber Technologies: Revised Decision and Order", "url": "https://www.ftc.gov/system/files/documents/cases/152_3054_c-4662_uber_technologies_revised_decision_and_order.pdf", "date": "2018-10-25", "kind": "regulator final order", "note": "Issuance date printed on page 9; announced/published October 26.", "locator": "Page 3 II.A; pages 3–4 III; pages 4–5 IV; page 7 VII.G; page 9 issuance.", "origin": "external", "retrievedOn": "2026-10-20" }, { "id": "uber-expanded", "title": "Uber Agrees to Expanded Settlement with FTC Related to Privacy, Security Claims", "url": "https://www.ftc.gov/news-events/news/press-releases/2018/04/uber-agrees-expanded-settlement-ftc-related-privacy-security-claims", "date": "2018-04-12", "kind": "regulator settlement announcement", "note": "Date confirmed by the FTC April 2018 press-release index; case-document timeline separately uses April 11.", "locator": "Opening two paragraphs and paragraph specifying additional provisions.", "origin": "external", "retrievedOn": "2026-10-20" }, { "id": "uber-original", "title": "Uber Settles FTC Allegations that It Made Deceptive Privacy and Data Security Claims", "url": "https://www.ftc.gov/news-events/news/press-releases/2017/08/uber-settles-ftc-allegations-it-made-deceptive-privacy-data-security-claims", "date": "2017-08-15", "kind": "regulator proposed-settlement announcement", "locator": "Opening paragraph and original agreement's four-bullet terms.", "origin": "external", "retrievedOn": "2026-10-20" }, { "id": "uber-doj-2022", "title": "Uber Enters Non-Prosecution Agreement Related to 2016 Data Breach", "url": "https://www.justice.gov/usao-ndca/pr/uber-enters-non-prosecution-agreement", "date": "2022-07-22", "dateType": "publication-date", "kind": "prosecutor resolution record", "locator": "Paragraphs on accepted responsibility, new management, investment in compliance/legal/security, and the 2018 FTC agreement.", "origin": "external", "retrievedOn": "2026-10-20" }, { "id": "uber-2025-10k", "title": "Uber 2025 Form 10-K", "url": "https://www.sec.gov/Archives/edgar/data/1543151/000154315126000015/uber-20251231.htm", "date": "2026-02-13", "dateType": "publication-date", "kind": "organization regulatory filing", "locator": "Printed page 37, privacy/data-processing risk factor: 2018 FTC settlement and July 2022 non-prosecution agreement; signatures for date.", "origin": "organization", "retrievedOn": "2026-10-20", "note": "Report signature/filing date; financial year ended December 31, 2025." } ] }, { "id": "lastpass-access-policy-2023", "org": "LastPass", "title": "Changes to access and device controls", "triggerType": "security-incident", "eventDate": "2022-12-22", "eventDateLabel": "Customer-data incident disclosure", "observationEnd": "2025-12-11", "summary": "The 2022 breaches exposed development systems and customer backups. In 2025, the ICO fined LastPass UK for security failures involving employee devices and linked personal and business vaults.", "governanceChange": "LastPass tightened employee access, authentication and device-use rules.", "limitation": "The ICO’s review addresses specified UK processing and remediation. It does not test long-term resistance to another attack. Some earlier security projects predated the breaches.", "checkpoints": { "finding": { "status": "documented", "summary": "The ICO found inadequate controls over personal-device access and linked vaults; its infringement period ended December 31, 2024.", "sourceIds": [ "lastpass-ico-notice" ] }, "decision": { "status": "documented", "summary": "The notice records revised authentication and acceptable-use requirements introduced after the incidents.", "sourceIds": [ "lastpass-ico-notice" ] }, "ownership": { "status": "unknown", "summary": "The reviewed sources do not identify an ongoing owner for the revised access and device policies.", "sourceIds": [ "lastpass-response" ] }, "implementation": { "status": "documented", "summary": "The ICO records changed authentication requirements and completion of the employee company-phone rollout by December 31, 2024.", "sourceIds": [ "lastpass-ico-notice" ] }, "validation": { "status": "documented", "summary": "The ICO found that later measures restored compliance for the processing it reviewed; ending attacker access had limited effect on harm already caused.", "sourceIds": [ "lastpass-ico-notice" ] } }, "logo": "/assets/polbench/logos/lastpass.svg", "mechanism": "operating-policy", "causalBasis": { "type": "organization-attributed", "summary": "The company and ICO connect revised rules to the incidents. LastPass says some technology projects had been planned earlier.", "sourceIds": [ "lastpass-response", "lastpass-ico-notice" ] }, "responseKind": "new-or-revised-policy", "decisionState": "adopted", "validationDetails": { "timing": "post-implementation", "target": "The security failures and remediation addressed in the ICO notice.", "method": "Regulatory investigation, including company representations and policy review.", "result": "Specified infringements remedied; limited mitigation of existing harm.", "provenance": "external-direct", "limitation": "A regulatory conclusion about this processing, not an experimental estimate of future breach risk.", "sourceIds": [ "lastpass-ico-notice" ] }, "searchedThrough": "2026-10-20", "followUp": { "summary": "The ICO announced its decision in December 2025. Its notice found that later access and device controls addressed the specified security infringements, while the response had limited effect on harm from data already taken.", "sourceIds": [ "lastpass-ico-announcement", "lastpass-ico-notice" ], "searchNote": "Searches through October 20, 2026 found the notice and announcement. No appeal disposition was located; the notice is not presented as judicially affirmed." }, "sources": [ { "id": "lastpass-response", "title": "Security Incident Update and Recommended Actions", "url": "https://blog.lastpass.com/posts/security-incident-update-recommended-actions", "date": "2023-03-01", "kind": "organization incident-response update", "locator": "Opening disclosure/investigation paragraphs; incident-response discussion; security-work section distinguishing completed policy changes, initiated work and future architecture.", "origin": "organization", "retrievedOn": "2026-10-20" }, { "id": "lastpass-ico-notice", "title": "LastPass UK Limited: Penalty Notice", "url": "https://ico.org.uk/media2/xfbl1uaa/lastpass-uk-ltd-penalty-notice.pdf", "date": "2025-11-20", "dateType": "notice-date", "kind": "regulator findings and remediation review", "locator": "Paragraphs 6–9 (printed pages 4–5), 153–156 (pages 56–59), and 210(a) (pages 75–76).", "origin": "external", "retrievedOn": "2026-10-20", "note": "Notice date. The regulator reviewed evidence and company representations; this is not a published penetration-test report." }, { "id": "lastpass-ico-announcement", "title": "Password manager provider fined £1.2m by ICO for data breach", "url": "https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/12/password-manager-provider-fined/", "date": "2025-12-11", "dateType": "publication-date", "kind": "regulator penalty announcement", "locator": "Opening findings and 'Details of the two incidents'.", "origin": "external", "retrievedOn": "2026-10-20" } ] }, { "id": "reddit-security-keys-2023", "org": "Reddit", "title": "Hardware keys and identity checks", "triggerType": "security-incident", "eventDate": "2023-02-05", "eventDateLabel": "Incident detected, Pacific time", "observationEnd": "2024-04-22", "summary": "Reddit reported that an employee phishing attack exposed internal systems. A later engineering account explicitly links that incident to changes in employee authentication.", "governanceChange": "Reddit introduced WebAuthn security keys and video identity checks for password and authenticator resets.", "limitation": "The engineering account describes key distribution and an operating recovery process, with compatibility problems. It does not establish mandatory WebAuthn use everywhere. Searches through October 20, 2026 found no later test of these controls.", "logo": "/assets/polbench/logos/reddit.svg", "checkpoints": { "finding": { "status": "reported", "summary": "Phishing captured an employee’s credentials and enabled internal access. The campaign targeted credentials and second-factor tokens.", "sourceIds": [ "reddit-incident" ] }, "decision": { "status": "reported", "summary": "Reddit explicitly connects the incident to its security-key adoption.", "sourceIds": [ "reddit-key-rollout" ] }, "ownership": { "status": "reported", "summary": "Corporate Technology and Security teams are identified as carrying out the changes.", "sourceIds": [ "reddit-key-rollout" ] }, "implementation": { "status": "reported", "summary": "The report describes key distribution and an operating identity-verification process for account recovery.", "sourceIds": [ "reddit-key-rollout" ] }, "validation": { "status": "unknown", "summary": "The account explains rollout lessons but provides no results from testing the new authentication and recovery rules.", "sourceIds": [ "reddit-key-rollout" ] } }, "mechanism": "operating-policy", "causalBasis": { "type": "organization-attributed", "summary": "The engineering account directly links the rollout to the February 2023 attack.", "sourceIds": [ "reddit-key-rollout" ] }, "responseKind": "new-or-revised-policy", "decisionState": "adopted", "validationDetails": null, "searchedThrough": "2026-10-20", "followUp": { "summary": "The April 2024 engineering account remains the latest dated report located about this employee rollout. Later generic passkey and consumer-account material was outside the case.", "sourceIds": [], "searchNote": "Searches through October 20, 2026 found no later test of the employee controls. Reddit search indexing is incomplete." }, "sources": [ { "id": "reddit-incident", "title": "We had a security incident. Here's what we know.", "url": "https://www.reddit.com/r/reddit/comments/10y427y/we_had_a_security_incident_heres_what_we_know/", "date": "2023-02-09", "kind": "organization incident disclosure", "locator": "Original post's first detailed incident paragraph, explicitly naming late February 5 Pacific time; employee report and access-removal paragraph.", "origin": "organization", "retrievedOn": "2026-10-20" }, { "id": "reddit-key-rollout", "title": "Security Keys at Reddit", "url": "https://www.reddit.com/r/RedditEng/comments/1cadhtm/security_keys_at_reddit/", "date": "2024-04-22", "kind": "organization engineering report", "note": "Attributed to Nick Fohs, CorpTech Systems & Infra Manager. Page date identified by Reddit's day-specific post-index link.", "locator": "Author attribution and opening two paragraphs; distribution section; takeaways on VM/VDI compatibility and visual reset verification; footer day-specific post-index link.", "origin": "organization", "retrievedOn": "2026-10-20" } ] } ], "editorialNotes": [ "Scores describe evidence completeness for a particular response.", "An unestablished checkpoint may reflect incomplete public disclosure.", "Source dates and observation periods vary; every record includes its search date and latest source date.", "Incident detection, review, activation and settlement dates have different meanings.", "Temporary resourcing, activation of an existing rule and lasting policy changes are classified separately.", "Logos identify the organizations discussed and do not imply endorsement.", "The collection is selective and open to corrections." ], "version": "0.4", "releaseDate": "2026-10-20", "methodologyUrl": "https://www.syntonyresearch.ai/research/benchmarks/polbench/methodology/", "reviewStatus": "Public-source review of selected cases. Independent duplicate coding, expert review of the criteria and validation against independently observed outcomes remain incomplete.", "governanceMechanisms": { "accountability": "Accountability and oversight, including resource prioritization", "operating-policy": "Operating policies and access rules", "deployment-gate": "Deployment and release conditions", "mandated-program": "Regulatory governance obligations" }, "protocolUrl": "https://www.syntonyresearch.ai/assets/polbench/protocol.json", "evidenceCountDefinition": "Count of checkpoints labelled Documented or Self-reported, out of five. It describes the supporting evidence available for a response.", "sourceCutoffDefinition": "observationEnd is the latest dated source or stated update used in the case. searchedThrough is the date through which follow-up sources were sought. Report date may differ from publication date; unknown public-release timing remains unspecified. Sources were consulted on October 20, 2026 without reconstructing all archived versions.", "corrections": [ { "version": "0.2", "caseId": "okta-support-2023", "change": "Narrowed the intervention to the incident-linked Chrome rule; removed later program sources and changed source cutoff to November 3, 2023." }, { "version": "0.2", "caseId": "dropbox-webauthn-2022", "change": "Decision changed from planned to reported: the acceleration was announced. Implementation remains planned." }, { "version": "0.2", "caseId": "circleci-production-access-2023", "change": "Validation changed from planned to unknown: the proposed tooling review does not explicitly test the scoped access-policy change." }, { "version": "0.2", "caseId": "uber-ftc-2018", "change": "Added order and earlier settlement sources; ownership requirement is planned, not an established assignment. Distinguished incremental obligations from the earlier proposal." }, { "version": "0.2", "caseId": "anthropic-asl3-2025", "change": "Separated pre-deployment safeguard test from post-activation governance effectiveness." }, { "version": "0.2", "caseId": "meta-privacy-program-2020", "change": "Made mixed assessment findings and indirect assessor provenance explicit." }, { "version": "0.2", "caseId": "cloudflare-code-red-2023", "change": "Identified temporary response comparator and made ownership threshold consistent with the scoped resourcing decision." }, { "version": "0.3", "caseId": "meta-privacy-program-2020", "change": "Added the FTC-hosted redacted Protiviti assessment. Implementation and validation changed to documented for specified functions and assessment; ownership remains reported. Assessment period and unresolved public-release timing are explicit." }, { "version": "0.3", "caseId": "cloudflare-code-red-2023", "change": "Validation rationale now refers to the scoped temporary Code Red resourcing decision." }, { "version": "0.3", "caseId": "reddit-security-keys-2023", "change": "Narrowed finding to confirmed credential capture; second-factor tokens were targeted, not confirmed captured." }, { "version": "0.3", "caseId": "anthropic-asl3-2025", "change": "Added the companion technical report to specify the pre-launch test method, model context and mixed result. Validation remains self-reported and pre-deployment." }, { "version": "0.4", "caseId": "microsoft-sfi-2024", "change": "Searched through October 20, 2026; added later-evidence notes and retained source/search dates separately." }, { "version": "0.4", "caseId": "cloudflare-code-red-2023", "change": "Searched through October 20, 2026; added later-evidence notes and retained source/search dates separately." }, { "version": "0.4", "caseId": "okta-support-2023", "change": "Searched through October 20, 2026; added later-evidence notes and retained source/search dates separately." }, { "version": "0.4", "caseId": "anthropic-asl3-2025", "change": "Searched through October 20, 2026; added later-evidence notes and retained source/search dates separately." }, { "version": "0.4", "caseId": "equifax-settlement-2019", "change": "Searched through October 20, 2026; added later-evidence notes and retained source/search dates separately. Revised ownership: planned to reported; implementation: planned to reported. Decision state changed from proposed to adopted using the signed court order." }, { "version": "0.4", "caseId": "github-npm-2fa-2021", "change": "Searched through October 20, 2026; added later-evidence notes and retained source/search dates separately." }, { "version": "0.4", "caseId": "circleci-production-access-2023", "change": "Searched through October 20, 2026; added later-evidence notes and retained source/search dates separately." }, { "version": "0.4", "caseId": "dropbox-webauthn-2022", "change": "Searched through October 20, 2026; added later-evidence notes and retained source/search dates separately." }, { "version": "0.4", "caseId": "twilio-phishing-2022", "change": "Searched through October 20, 2026; added later-evidence notes and retained source/search dates separately." }, { "version": "0.4", "caseId": "zoom-security-plan-2020", "change": "Searched through October 20, 2026; added later-evidence notes and retained source/search dates separately." }, { "version": "0.4", "caseId": "meta-privacy-program-2020", "change": "Searched through October 20, 2026; added later-evidence notes and retained source/search dates separately." }, { "version": "0.4", "caseId": "uber-ftc-2018", "change": "Searched through October 20, 2026; added later-evidence notes and retained source/search dates separately." }, { "version": "0.4", "caseId": "lastpass-access-policy-2023", "change": "Searched through October 20, 2026; added later-evidence notes and retained source/search dates separately. Revised finding: reported to documented; decision: reported to documented; implementation: reported to documented; validation: unknown to documented." }, { "version": "0.4", "caseId": "reddit-security-keys-2023", "change": "Searched through October 20, 2026; added later-evidence notes and retained source/search dates separately." } ], "evidenceScore": { "name": "Evidence completeness score", "minimum": 0, "maximum": 100, "pointsPerCheckpoint": 20, "includedStatuses": [ "documented", "reported" ], "formula": "20 × number of documented or self-reported checkpoints", "interpretation": "A rescaling of the five-category evidence count. Equal points for documented and self-reported evidence; no credit for planned or unknown. Not a performance estimate, probability, or validation of effectiveness.", "sorting": "Optional sorting orders records by evidence completeness. Disclosure, response scope and source periods differ.", "passThreshold": null }, "codingClarifications": [ "For Decision, organization announcements are coded reported even when they announce a chosen commitment. Documented requires directly available operative policy text, a legal instrument, or an external record. This is a source classification, not doubt that an announcement exists.", "Ownership requires explicit responsibility for the scoped response; personnel leading an earlier investigation do not automatically own the later policy or resourcing decision.", "A test requires a stated procedure and result. A general claim that testing occurred is insufficient." ], "searchedThrough": "2026-10-20" }