Security Newsletter | 4/30/26

If you take nothing else from this newsletter, just do these three things to protect yourself:

1. Use a password manager. Your iPhone has a great password manager pre-installed, called the Passwords app. We highly recommend you use it to create and store passwords.
2. Turn off Visited Places in Apple Maps. Apple Maps has a new feature called Visited Places that tracks every place you visit, giving you a history of your location. If you don't want your iPhone tracking your every move, you may want to switch it off.
3. Ignore virus warnings on your iPhone. The iPhone is unlikely to be infected by viruses through the web browser, so if you see a pop-up warning you of a virus, it's likely fake, and you should close the tab right away.

This week, the US Supreme Court heard arguments about how law enforcement has used geofencing data to charge people with crimes. Geofencing is the practice of using location data to detect when a device enters or exits a certain area. In 2019, after a bank was robbed in Virginia, local law enforcement served a warrant to Google for geofencing data of phones that were in the area during the time of the robbery. Based on the data Google turned over, law enforcement made an arrest. The alleged bank robber has since challenged the legality of the warrant, arguing that it violated his Fourth Amendment rights because his location data was pulled from his Google account, which would normally be safely locked behind a password, and that law enforcement did not have probable cause to obtain that data.

The Supreme Court appears divided on the legality of the warrant, with some of the justices arguing that there is no reasonable expectation of privacy when you willingly allow Google to access your location, while others believe that the data you store in your Google account should be considered private. Justice Neil Gorsuch also worries that if the location data stored in a Google account is considered public, the government could potentially access other Google account data, like email or photos. You can read a concise summary of the case at NPR or head over to the SCOTUSblog for a more detailed write-up.

The Bottom Line: How the Supreme Court rules on this case could have an impact on how law enforcement can legally obtain the data of American citizens. For now, you may want to create offline backups for any important data that you've been storing in the cloud. If you exclusively rely on cloud storage, it's possible that this Supreme Court ruling could affect the privacy of your data.

Disneyland Using Facial Recognition

Disneyland has begun using facial recognition technology in its park. According to Disney, the tech captures images of guests' faces and matches them to images captured from the first time they entered the park in order to make entry faster. The park keeps the images for 30 days (unless they need to be kept longer for legal or fraud‑prevention purposes). Read more at The Hill.

The Bottom Line: If you want to opt out of Disneyland's facial recognition, you can enter the park through an alternate entrance along the Esplanade, where you can have your ticket manually verified.

Malicious Software Distributed to Users via Update

An open-source software called Elementary, which is a command-line interface (CLI) that helps companies with complex networks monitor the performance of their systems, was compromised last week. Attackers were able to modify the software and push an update to users, which was likely automatically installed for those with automatic updates enabled (and those without automatic updates enabled probably installed it without giving it a second thought). Once installed, the malicious software then stole any sensitive user information it could find. The attackers exploited a GitHub vulnerability to gain access to Elementary's developer account. The developers have since pulled the infected software and changed their login credentials. Check out the full technical breakdown at Ars Technica.

The Bottom Line: We always recommend only installing software from reputable developers. However, even trusted apps can be compromised, and just like in this story, malware can be pushed to your computer through a seemingly ordinary software update. Keeping a malware scanner, such as Malwarebytes, installed on your computer and doing regular scans can help protect you against this type of attack.

Software Company Loses Entire Database to AI

PocketOS, a company that makes software for car rental services, has lost its entire database. The company had been using an artificial intelligence coding agent powered by Claude to handle a variety of normal, everyday tasks. The AI ran into a problem that it could not solve and decided of its own volition that the only solution was to delete PocketOS's production database. This caused significant disruptions at the car rental businesses using PocketOS, as the deleted database contained customer records. It apparently took only 9 seconds to complete the deletion, giving PocketOS no time to respond or stop it from happening. Thankfully, the company was able to restore a backup a couple of days after the data loss. Read the full story at The Independent.

The Bottom Line: When using AI tools, it's best to ensure they don't have access to critical systems like an entire customer database. Even if you instruct the AI not to delete anything so important, there's always a possibility it could ignore your instructions and do what it thinks is best anyway.

The correct answer is A. Restart your computer and run a malware scan. The number that the pop-up wants you to call likely belongs to a scam call center where scammers would try to convince you to pay money to remove the "virus." More than likely, your computer was not actually infected, and the window that appeared was a maliciously crafted ad designed to induce panic and convince you to call the number. However, it's still a good idea to run a malware scan and make sure your system is clean. If this happens on your iPhone, there's no need to run a malware scan, as there is no way to scan the iPhone for malware. It is also very unlikely (though not impossible) for malware to infect the iPhone through a web browser.

Interested in keeping your iPhone secure? Check out:

• Protect Your iCloud Data
• How to Secure Messages on Your iPhone
• Answered: Can iPhones Get Viruses?