Security News This Week: Oh Crap, Kohler’s Toilet Cameras Aren’t Really End-to-End Encrypted

An AI image creator startup left its database unsecured, exposing more than a million images and videos its users had created—the “overwhelming majority” of which depicted nudes and even nude images of children. A US inspector general report released its official determination that Defense Secretary Pete Hegseth put military personnel at risk through his negligence in the SignalGate scandal, but recommended only a compliance review and consideration of new regulations. Cloudflare’s CEO Matthew Prince told WIRED onstage at our Big Interview event in San Francisco this week that his company has blocked more than 400 billion AI bot requests for its customers since July 1.

A new New York law will require retailers to disclose if personal data collected about you results in algorithmic changes to their prices. And we profiled a new cellular carrier aiming to offer the closest thing possible to truly anonymous phone service—and its founder, Nicholas Merrill, who famously spent a decade-plus in court fighting an FBI surveillance order targeted at one of the customers of his internet service provider.

Putting a camera-enabled digital device in your toilet that uploads an analysis of your actual bodily waste to a corporation represents such a laughably bad idea that, 11 years ago, it was the subject of a parody infomercial. In 2025, it’s an actual product—and one whose privacy problems, despite the marketing copy of the company behind it, have turned out to be exactly as bad as any normal human might have imagined.

Security researcher Simon Fondrie-Teitler this week published a blog post revealing that the Dekota, a camera-packing smart device sold by Kohler, does not in fact use “end-to-end encryption” as it claimed. That term typically means that data is encrypted so that only user devices on either “end” of a conversation can decrypt the information therein, not the server that sits in between them and hosts that encrypted communication. But Fondrie-Teitler found that the Dekota only encrypts its data from the device to the server. In other words, according to the company’s definition of end-to-end encryption, one end is essentially—forgive us—your rear end, and the other is Kohler’s backend, where the images of its output are “decrypted and processed to provide our service,” as the company wrote in a statement to Fondrie-Teitler.

In response to his post pointing out that this is generally not what end-to-end encryption means, Kohler has removed all instances of that term from its descriptions of the Dekota.

The cyberespionage campaign known as Salt Typhoon represents one of the biggest counterintelligence debacles in modern US history. State-sponsored Chinese hackers infiltrated virtually every US telecom and gained access to the real-time calls and texts of Americans—including then presidential and vice-presidential candidates Donald Trump and J.D. Vance. But according to the Financial Times, the US government has declined to impose sanctions on China in response to that hacking spree amid the White House’s effort to reach a trade deal with China’s government. That decision has led to criticism that the administration is backing off key national security initiatives in an effort to accommodate Trump’s economic goals. But it’s worth noting that imposing sanctions in response to espionage has always been a controversial move, given that the United States no doubt carries out plenty of espionage-oriented hacking of its own across the world.

As 2025 draws to a close, the nation’s leading cyberdefense agency, the Cybersecurity and Infrastructure Agency (CISA), still has no director. And the nominee to fill that position, once considered a shoo-in, now faces congressional hurdles that may have permanently tanked his chances to run the agency. Sean Plankey’s name was excluded from a Senate vote Thursday on a panel of appointments, suggesting his nomination may be “over,” according to CyberScoop. Plankey’s nomination had faced various opposition from senators on both sides of the aisle with a broad mix of demands: Florida’s Republican senator Rick Scott had placed a hold on his nomination due to the Department of Homeland Security (DHS) terminating a Coast Guard contract with a company in his state, while North Carolina’s GOP senators opposed any new DHS nominees until disaster relief funding was allocated to their state. Democratic senator Ron Wyden, meanwhile, has demanded CISA publish a long-awaited report on telecom security prior to his appointment, which still has yet to be released.

The Chinese hacking campaign centered around the malware known as “Brickstorm” first came to light in September, when Google warned that the stealthy spy tool has been infecting dozens of victim organizations since 2022. Now CISA, the National Security Agency, and the Canadian Centre for Cybersecurity jointly added to Google’s warnings this week in an advisory about how to spot the malware. They also cautioned that the hackers behind it appear to be positioned not only for espionage targeting US infrastructure but also potentially disruptive cyberattacks, too. Most disturbing, perhaps, is a particular data point from Google, measuring the average time until the Brickstorm breaches have been discovered in a victim’s network: 393 days.