Hello. A deluge of data-breach lawsuits has a growing number of U.S. judges insisting victims show exactly how their leaked personal details caused “tangible harm,” a high bar that is getting more cases tossed out of court.

Essentially, having data exposed or stolen isn't harmful enough—although it used to be, when breaches were rare. Read our full story.

Also today: 

• Microsoft curtailed some tech services to Israel's Defense Ministry, citing surveillance of Gaza citizens
• Singapore targets Meta over Facebook scams
• Google and period tracker Flo Health to pay $56 million to end privacy case
• Alleged casino hacker released to parents
• Boards tie compensation of bank CEOs to cyber goals
• And more 

National security: Denmark said it had suffered a hybrid attack by a professional actor after drones were observed over several airports late Wednesday, the second time in less than a week that unmanned aircraft have disrupted air traffic in the Nordic nation, a NATO member. (WSJ)

Meta has until Sept. 30 to improve its policing of impersonation scams on Facebook, then it will incur a fine of up to about $776,000, said the Singapore government. Fake ads and profiles on Facebook with videos and images of local government officials and other public figures have surged in the past year, Singapore's ministry of home affairs. (Reuters)

• It is the first instance of the government issuing an order under its 2024 Online Criminal Harms Act. 

Google and period-tracking app Flo Health agreed to pay a combined $56 million to settle a data-privacy lawsuit that accused the companies of collecting information about users' menstrual cycles for targeted ads, in violation of California privacy laws. (Reuters)

Jaguar Land Rover has begun a gradual restart of its operations, with some IT systems back online following the recent cyberattack on the U.K. automaker. The company, owned by India’s Tata Motors, discovered a cyberattack late last month, forcing it to shut down its computer systems and halt production. (WSJ)

U.K. retailer Co-op lost at least £206 million, or about $275 million, in revenue during an April cyberattack that disrupted online payments and caused inventory problems. Further financial hits related to the hack are expected, the company said. (BBC)

Alleged casino hacker released to parents. A 17-year-old Chicagoan who turned himself in to Las Vegas police last week in relation to the investigation of cyberattacks at MGM Resorts and other casinos in 2023 must remain in Nevada's Clark County and can't use the internet unless it is for schoolwork, a judge said. 

• A hearing in November is expected to determine whether the teen will be tried as an adult. He was 15 at the time of the cyberattacks. (Las Vegas Review-Journal)

Cisco equipment problems must be fixed by Friday, CISA said. The Cybersecurity and Infrastructure Security Agency ordered federal agencies to identify any Cisco devices in use that could contain two significant vulnerabilities. The agencies must then send memory files to CISA for analysis by midnight on Sept. 26. 

• More on the emergency directive here. 

An investigation by the Senate Homeland Security committee has found that Elon Musk's DOGE group has created cybersecurity risks and mishandled the data of U.S. residents at three federal agencies: the General Services Administration, the Office of Personnel Management and the Social Security Administration.

The WSJ Pro Cybersecurity team is Deputy Bureau Chief Kim S. Nash and reporters Angus Loten, James Rundle and Catherine Stupp. Follow us on X @WSJCyber. Reach the team by replying to any newsletter you receive or by emailing Kim at kim.nash@wsj.com.