A week in security (September 22 – September 28)

A week in security (September 22 – September 28) summarises last week’s cybersecurity news, published on 29 September 2025 by Malwarebytes Labs.

According to Malwarebytes Labs, the week’s highlights include several high‑profile cases and warnings: on 26 September 2025, hackers reportedly stole data on 8,000 nursery children and contacted parents to demand a ransom; Flo Health and Google agreed to pay $56 million to settle lawsuits over health data used for ads; Neon Mobile was reported as paying users to record calls and selling data for AI training.

The preceding day, 25 September 2025, saw reports of a new SVG‑based phishing campaign described as a recipe for disaster, and of LinkedIn announcing it would use user data for AI training unless opted out. The article roundups illustrate a mix of data privacy, phishing, and AI‑driven data use concerns current in the security landscape.