Hello. Even with a paid, ad-free subscription to Facebook and Instagram in Europe, users can’t escape promotional content. Meta offered the subscription to residents of the European Union after regulators there demanded the company be more explicit about how it collects data.

For a fee of about $14 on Instagram, WSJ Personal Tech columnist Nicole Nguyen found that official ads disappeared but promotional content from accounts she follows remained. Meta says it won’t use personal data for ads if a user pays for a subscription, but it still looks at what accounts they interact with. That data helps Meta personalize the kind of content it shows to each user.

It is unlikely Meta will offer similar subscriptions in the U.S. unless there are tighter data restrictions requiring it. A Meta spokesman said the choice to offer a paid version was the direct result of the EU regulators’ decision. Read the full story.

Also today:

• Hackers exploit Citrix flaw
• A hacker faked his death and claimed to sell Marriott data
• CISA publishes healthcare security guide
• Samsung says hackers accessed U.K. customer data

• Logistics company DP World Australia is still dealing with a cyberattack that exploited the 'CitrixBleed' vulnerability, News.com.au reports. Four major ports were shut down and 30,000 containers piled up after the hack. Devices on DP World’s network hadn’t been updated before the Nov. 10 cyberattack, even though the fix for the Citrix vulnerability was available for over a month.

Also read:

• Hackers also exploited the Citrix hack in a recent attack on the New York arm of the Industrial and Commercial Bank of China, WSJ reported.

Samsung’s British store between July 1, 2019 and June 30, 2020. A spokeswoman said Samsung was “recently alerted” about the incident and didn’t disclose how many customers were affected.

• The guide includes mitigation strategies focused on three areas: asset management, identity management and device security, and vulnerability, patch and configuration management.

Also read: 

• New York state issued cyber rules for hospitals last week, WSJ Pro reported.
• The largest U.S. healthcare accreditation body issued cyber guidelines in August, WSJ Pro reported.

Hacker Faked His Death and Claimed to Sell Marriott Data

A hacker told the Federal Bureau of Investigation that he sold access to Marriott customers on a Russian forum, Forbes reports. The defendant, Jesse Kipf, allegedly hacked into several U.S. state death certificate registration agencies to try to fake his own death. A Marriott spokeswoman said the company’s systems weren’t breached and that there was “no impact to customer data.” Kipf was charged last month with hacking into employee accounts at two Marriott contractors and into state death certificate systems.

The WSJ Pro Cybersecurity team is Deputy Editor Kim S. Nash (on X @knash99), reporter James Rundle and reporter Catherine Stupp (@catstupp). Follow us on X @WSJCyber. Reach the team by replying to any newsletter you receive or by emailing Kim at kim.nash@wsj.com.