Hello. A big trove of data not only makes a ripe target for hackers. It also draws scrutiny from regulators.

General Motors settled a case with the Federal Trade Commission over collecting and selling data vacuumed up through its OnStar connected-car system without driver permission.

OnStar, the FTC said, harvested data points every three seconds, including driver habits and which radio station was playing, and can pinpoint locations to within 4.5 inches. GM sold the data to brokers such as Lexis Nexis Risk Services, which then shared it with insurance companies and others. Drivers were surprised when their premiums were raised or policies canceled, the FTC said. 

GM wasn't fined but the settlement says it must stop these practices for five years and if it resumes collection, the company has to get driver permission, take only minimum data for certain purposes and store it for a defined period of time. GM also has to delete within six months all the data it previously collected in violation of privacy regulations—a big job in itself.

The deal restricts GM in lots of other ways for the next 20 years. Read the original complaint and the settlement. 

More news below.

Note: The WSJ Pro Cybersecurity newsletter will be off Monday in observance of Martin Luther King Jr. Day. We’ll be back Tuesday.

China-backed hackers are targeting U.S. government officials in a phishing campaign that mentions recent events in Venezuela, including the capture of leader Nicolás Maduro, according to cybersecurity company Acronis. Malware linked to the operation would steal information from computers on which it was activated, Acronis said. (Reuters)

• Rudd was noncommittal at Thursday's confirmation hearing on whether the U.S. should pursue an aggressive "hack first" cyber strategy against adversaries, as Trump has been advocating. 
• The NSA and Cyber Command have been without a permanent head since April, when Trump fired Gen. Timothy Haugh without giving a reason. (New York Times)

GrubHub confirmed a recent data breach, saying financial data and order histories weren't affected. The food delivery service didn't specify which or how much data was downloaded and said it is investigating the incident. (Bleeping Computer)

The WSJ Pro Cybersecurity team is Deputy Bureau Chief Kim S. Nash and reporters Angus Loten and James Rundle. Follow us on X @WSJCyber. Reach the team by replying to any newsletter you receive or by emailing Kim at kim.nash@wsj.com.