Apple Fights the UK Backdoor, Samsung Cuts Proxy Apps & KT Fined (08/03/2026)

Three stories today about who holds the key to a thing you thought was yours. Apple is in a British tribunal arguing about a demand it is not allowed to describe. Samsung is pulling apps that quietly rented out the internet connection in someone’s living room. Korea’s regulator fined its largest telco after an attacker walked in with a certificate lifted off a lost piece of hardware. Nobody in any of these stories asked the person whose data moved.

Top 3 Critical Privacy Alerts

1. Apple Takes the UK’s Secret iCloud Order to Tribunal

Apple has filed a complaint with the UK’s Investigatory Powers Tribunal challenging a technical capability notice, a secret legal order requiring access to encrypted user data. This is the second such order, issued in October 2025, after the first was dropped in early 2025 following US intervention. The demands target UK users. Apple’s response to the first order was to remove Advanced Data Protection for UK customers entirely in February 2025 rather than build a way in. TechCrunch

Operator Note: Notice the shape of the remedy. Apple could not give UK users the strong option and comply, so UK users lost the option. When a government demands access to encryption, the realistic outcome is not a backdoor only good guys use, it is a downgrade applied to everyone in the jurisdiction.

2. Samsung Pulls the Apps That Were Renting Out Your Living Room

Samsung is banning residential proxy software from its smart TV app store, restricting new registrations with proxy functionality and removing existing apps that contain it. The Norwegian firm Mnemonic found the code inside popular Samsung TV apps, including a Pac-Man game in the store’s Editor’s Choice section. Harrison Sand, the consultant who ran the analysis, described bare-bones app shells that load their real content from external servers, so what a reviewer approved is not necessarily what runs. The developers claim hundreds of millions of installations. TechCrunch

Operator Note: The researchers warned that a code change on a web server could flip hundreds of millions of televisions into a botnet. Your employees’ home networks are where your remote workforce lives, and a device nobody thinks of as a computer is sitting on the same segment as the laptop with your data on it.

3. Korea Fines KT About $39 Million Over a Rogue Femtocell

Seoul’s Personal Information Protection Commission fined KT, Korea’s largest telecommunications company, roughly $39 million. An attacker extracted the security certificate from a lost KT femtocell, embedded it in a self-built unit, joined the mobile network, and intercepted traffic to process fraudulent micropayments. The breach exposed phone numbers, IMSI, and IMEI data for 16,647 users, and 368 customers lost 240 million won, about $175,000, to unauthorized charges. The regulator cited inadequate access controls, 10-year certificate validity, unrestricted IP access, and weak detection. It ran 11 months before anyone noticed. Infosecurity Magazine

Operator Note: A certificate good for ten years on a device that can be physically lost is a design decision, made once, by someone who is probably no longer there. Go find out how long your own device certificates are valid and whether losing one piece of hardware puts an attacker inside your trust boundary.

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.