ICE Is Buying Credit Card Records, Meta Owes New Mexico $567M (08/07/2026)

Yesterday’s briefing covered a DNA collection program. Today it is credit card applications, bought rather than collected. The form you filled out to get a card asked for your address, your income, your employer, and your Social Security number, and you gave all of it to a bank. The government is now buying it from a broker, which is a purchase that requires no warrant and no notice to you.

Top 4 Critical Privacy Alerts

1. ICE Is Buying What You Told the Bank

Immigration and Customs Enforcement is purchasing access to credit card records through data brokers, obtaining the information people supplied when they opened an account. Schneier on Security

Operator Note: The consent you gave was to a lender, for the purpose of extending you credit. Nothing in that exchange contemplated this, and the broker market exists precisely because moving data through a purchase avoids the process a demand would require. Your own organization sells or shares more than you think, and the contract term to look for is the one permitting onward transfer.

2. A New Mexico Judge Orders Meta to Pay $567 Million

The judgment covers harms to children on Meta’s platforms. The money creates a fund to mitigate social media harms, with $420 million carved out specifically for treatment of New Mexico youth who were hurt. The Record

Operator Note: Look at the structure rather than the number. A court did not just fine a company, it directed most of the award toward treating the people affected. That is a remedy shaped like a harm rather than like a penalty, and it is a template other states will read closely.

3. An NHS Trust Is Checking Who Opened a Murdered Child’s File

NHS Tayside is investigating whether staff improperly accessed the medical records of nine-year-old Minnie Merriman after she was publicly named this week, following a man’s arrest on suspicion of murder. The Register

Operator Note: Record snooping spikes whenever a name enters the news, and it is almost never malicious. It is curiosity, from people who have legitimate access and no specific reason to look. Break-glass alerting on high-profile records is a configuration, not a project, and the time to turn it on is before the name is published.

4. The FTC Drops Disparate Impact Theories

The Federal Trade Commission issued a policy statement clarifying that it will not pursue claims based on disparate-impact or unfair discrimination theories. FTC

Operator Note: If you run automated decisions in lending, hiring, or pricing, one federal avenue narrowed today. State attorneys general and private plaintiffs did not go anywhere, and several states have been building exactly this theory into their own AI statutes.

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.