Good day. The 2015 Cybersecurity Information Sharing Act expired Wednesday after weeks of partisan gridlock and amid a broader federal government shutdown. The decade-old legislation sought to encourage private-sector organizations to share intelligence on new attack vectors with the Department of Homeland Security, chiefly the Cybersecurity and Infrastructure Security Agency.

Among other measures, the act set guardrails aimed at shielding companies from antitrust and liability charges. Now, without legal protections, private-sector companies are more likely to withhold critical attack information, leaving potential vulnerabilities exposed. By losing a core strategy meant to prevent Chinese, Russian and other state-sponsored hackers from borrowing deeper into U.S. infrastructure, the federal government has created a dangerous gap in the nation’s cyber defenses, cybersecurity experts say.

Sunsetting the act will “slow the government’s ability to connect the dots, attribute attacks and warn others before new threats spread,” says Cynthia Kaiser, senior vice president of cybersecurity firm Halcyon’s Ransomware Research Center and former deputy director of the Federal Bureau of Investigation’s cyber division.

What do you think of letting the Cybersecurity Information Sharing Act expire? Let me know at angus.loten@wsj.com or reply to this email. Thanks. 

Also today:

• Center for Internet Security funding lapses
• Google fixes Gemini AI flaws
• Tractor Supply hit with $1.35 million privacy fine

DeKalb County Government Systems Hit by Cyberattack. Multiple systems across DeKalb County, Ind., government departments were disrupted in a cyberattack first detected on Sept. 25, though 911 and public safety services remained unaffected. Officials say no resident data has yet been confirmed compromised and that they are working with external cybersecurity firms to restore operations. (WOWO)

Google Fixes Gemini AI Flaws That Enabled Attacks. Google patched vulnerabilities in its Gemini assistant that allowed attackers to inject malicious prompts into logs, tricking the AI into executing unintended actions. The flaws, found by researchers at Tenable, required minimal social engineering. (SecurityWeek)

WSJ Tech Live is The Wall Street Journal’s premier technology event series. Over three days, our journalists will sit down with top executives, founders and policymakers to explore the most pressing topics of today. It all takes place across two global destinations for innovation and investment: California and Qatar.

Register your interest to be part of this unique live journalism experience and receive access to exclusive discounted rates on your pass.

The WSJ Pro Cybersecurity team is Deputy Bureau Chief Kim S. Nash and reporters Angus Loten, James Rundle and Catherine Stupp. Follow us on X @WSJCyber. Reach the team by replying to any newsletter you receive or by emailing Kim at kim.nash@wsj.com.