Welcome back. Authorities have been aggressively shutting down cybercrime rings, with the unintended consequence of tutoring them in covering their tracks.

The problem, known as tactical exposure, is expected to deepen amid calls by the White House for more aggressive action against cybercrime and a recent wave of takedowns and disruptions of cybercrime networks and platforms. Read our full story.

Plus: Read our breakdown of the White House AI plan, issued Friday. The Trump administration wants Congress to stand down on creating any new rules for regulating AI and argues that AI development is inherently an interstate issue with national security dimensions, and that states shouldn’t be allowed to regulate it. More here.

RSAC: WSJ Pro’s James Rundle will cover this week’s RSA Conference in San Francisco, skipping the hype and focusing on what’s most important for cybersecurity chiefs.

More news below.

• Customers who can document financial losses from the breach can get up to $1,500. Others can receive a flat $100.
• Plaintiff’s lawyers are asking for $400,000. A hearing for final approval of the settlement is scheduled for June 22 in circuit court in Broward County, Fla.

Another chip-industry company hacked: A subsidiary of Singapore-based Trio-Tech International was hit with a ransomware attack on March 11 that encrypted some files, according to a filing last week with the U.S. Securities and Exchange Commission.

• On March 18, the hackers disclosed stolen information, which Trio-Tech warned might make the incident material to its operations or financial condition.
• The company said it shut down its network and is working to restore systems. An investigation is ongoing.
• Tokyo-based Advantest, which supplies semiconductor-testing equipment to Intel, Samsung and others, was hacked in February in a suspected ransomware attack. The company continues to investigate any potential data breach.

Hackers working for Russia’s intelligence services are targeting the Signal messaging accounts of U.S. users, the Federal Bureau of Investigation and Cybersecurity and Infrastructure Security Agency said Friday. A phishing scheme impersonates Signal’s security team, warning of suspicious activity on user accounts, trying to get recipients to click on links to provide credentials. Thousands of accounts have been compromised this way, the agencies said.

• Stryker supplies items such as custom bone inserts, aneurysm coils and intracranial stents. The company can’t process orders placed between March 11 and March 16 and these “will therefore be cancelled,” the NHS said.
• The health service said it is assessing whether and how to work with alternative suppliers.

Still can't work: Some Stryker workers in Michigan remain idle as the company works to recover product operations. Stryker has said it will pay them for their regularly scheduled hours. (M-Live)

• The same is happening at Stryker's plants in Cork, Ireland. (Irish Examiner)

The WSJ Pro Cybersecurity team is Deputy Bureau Chief Kim S. Nash and reporters Angus Loten and James Rundle. Follow us on X @WSJCyber. Reach the team by replying to any newsletter you receive or by emailing Kim at kim.nash@wsj.com.