AdFection: Citizen Lab says ads helped Candiru target at least 45 Al Jazeera devices, no infection count

2,289 days on an approved list, 441,954,291 impressions won, at least 45 devices targeted: numbers that do not divide

Discover-Tech was on IAB Europe's Global Vendor List from 2 July 2020 to 8 October 2026. That is 2,289 days, or 6.3 years (derived). The Citizen Lab at the University of Toronto alleges, in a report published on 15 October 2026, that the Israeli company was a bridge between advertising platforms and mercenary spyware vendors, and says its corporate links to the spyware industry go back almost six years. It says Discover-Tech runs a platform called Controlium that lets customers pick individual devices and send them code when an ad is displayed, and that for at least 45 devices at Al Jazeera, in 2024 and 2025, the code was Candiru's spyware. Citizen Lab links the Al Jazeera attacks to Candiru with "high confidence". Google's three vendor lists carried Discover-Tech over a similar period, from 2020 until the first week of October 2026, and Google and IAB Europe both removed it in the days before the report appeared.

The other headline numbers come from different windows and cannot be divided into each other. In four months of bidding data that Citizen Lab found exposed on a Discover-Tech server (March to June 2026, 122 days, derived), the company's own platform bid on 3,770,286,576 impressions and won 441,954,291 of them, which is 11.7 per cent. About 19 per cent of the bids were for ads that appeared to carry a script tag pointing back at the company's server. The only victims the report counts are the at least 45 Al Jazeera devices, taken from network logs of 2024 and 2025. Dividing 45 by 441,954,291 would produce a rate that mixes two periods, two sources and two different things, so this briefing does not print one.

What the record does not establish is most of what the headlines imply. It does not say how many people outside Al Jazeera were targeted or infected, or how many of the 45 devices were infected. It does not say which ad platforms carried the hand-off to spyware infrastructure, or for how long, or what any platform detected before the researchers made contact. It names no software flaw and gives no patch status, so it cannot say whether the delivery works against current versions of any operating system or browser. It names no customers. It does not characterise the legal status of any of the use: Citizen Lab asks regulators to investigate whether laws were broken, which is a request, not a finding. Table 2 sets out the stated and not-stated columns line by line.

This briefing reads the primaries. The full Citizen Lab report was read: all eleven numbered sections, the correspondence section and the appendices, with its executive summary, Confiant's own post and the five company responses that Citizen Lab published as PDFs. The Guardian, CyberScoop and Reuters, through a Cyprus Mail copy were read for what they add, chiefly the statements from Google and IAB Europe. A Forbes report answered with a 403 and was not read; no bot check was bypassed. Where coverage and the report differ, the report is followed. Everything was read on Thursday 15 October 2026, between about 14:13 and 14:34 BST, and a report published that morning can be amended.

What the report says it observed, and what it infers

Citizen Lab separates observation from inference more carefully in some places than in others. Table 1 lists the claims that carry the story, the basis the report prints for each, and its own wording of confidence. The words "high confidence" appear twice in the report, for two different things, and the report does not define a scale for them.

Table 1. The main claims in Citizen Lab's report 195 (15 October 2026), the basis it prints, and its wording. Allegations are Citizen Lab's. Basis and wording are paraphrased except where quoted.

The claim	The basis the report prints	The report's wording
At least 45 devices at Al Jazeera were targeted in zero-click attacks in 2024 and 2025	Network logs that Al Jazeera supplied for the attack period show a repeated sequence: contact with Discover-Tech infrastructure (an ad impression), then a check by a Candiru-attributed server, then contact with a command server. Al Jazeera also isolated one Windows library file from one compromised device.	Linked "with high confidence" to Candiru's spyware delivered through Discover-Tech's ads
The recovered file is a newer version of a Candiru chain Citizen Lab captured in 2021	Overlaps with the 2021 sample in design choices, string handling and a network check.	"High confidence"
Discover-Tech runs Controlium, a platform for choosing individual devices to profile or infect	The platform's front-end code was served publicly on its login page and was reconstructed offline. Login records came from an endpoint that needed no authentication: 128 days, 120 distinct usernames. The lab says it did not exploit a weakness it found in the platform's own sign-in.	Discover-Tech "appears to be a front". The lab says the exact steps a customer takes are not clear and that it is unsure what most target options mean
Millions of devices were directed to Candiru servers	A statistics endpoint on one decision server showed 3,637,213 "eligible users" from January to June 2026, which may include other customers. For ad-delivered links from April to December 2025 the lab estimates hundreds of thousands to millions.	"Likely for large-scale tracking and reconnaissance"
The ads reached sensitive networks	Bidding records from an exposed database, with addresses matched to organisations, and Confiant's own telemetry.	An impression "does not in and of itself confirm targeting or infection", the report says
Bindecy and Intelos work with Discover-Tech	Platform login overlaps, company records and a shared website publishing account.	The technical analysis "indicates" they work together; the lab cannot assess the scope
Adtimizer and Volasim are linked to Discover-Tech	Shared domains, DNS records and ad content.	No conclusive evidence that either knowingly took part. Both deny it
A separate actor, which the lab calls DARK CARTOGRAPHER, uses the infrastructure to link ad identifiers to phone numbers	Described, not documented: five types of weakness across mobile carriers in more than 30 countries. Technical detail is withheld until disclosure to carriers finishes.	The lab assesses activity since at least 2019 and promises a separate report

How the Al Jazeera devices were identified matters for what the 45 means. The identification rests on network logs from Al Jazeera, which consented to be named, showing the same sequence of contacts, and on one recovered file. The report describes one file from one device and does not say how many devices yielded samples. It prints no operating-system breakdown for the 45. Reuters describes all 45 as Windows devices that were compromised, and the Guardian says dozens were believed compromised; the report text read for this briefing says only that the one recovered file is a Windows library, and counts at least 45 devices targeted. The key findings say devices at Al Jazeera were infected, and section 2 says at least 45 were targeted in attacks linked to Candiru. The number infected is not given, so the coverage has turned a count of targets into a count of victims.

Stated and not stated: the record, line by line

"Not stated" means not found in the report, its executive summary, Confiant's post or the five published responses. It does not mean the information does not exist.

Table 2. What the primaries state and do not state. Primaries: Citizen Lab report 195 and its correspondence section, Confiant's post, both of 15 October 2026. Reuters is named where it is the only source.

The question	Stated	Not stated
Who was hit?	At least 45 Al Jazeera devices targeted in 2024 and 2025. Al Jazeera consented to be named and supplied network logs.	How many were infected, any other victim, whether any individual outside Al Jazeera was infected. No Al Jazeera statement found; Reuters says it did not reply.
Which devices?	One recovered file is described as a Windows library. Reuters calls the 45 Windows devices.	The operating system and version of each device, the browser or app, whether any phone was infected.
What was exploited?	Only the class: code run in the app or browser that shows the ad. The ad itself is said to carry no exploit code.	Any flaw, any version, any patch status, and so whether current versions are affected. Confiant says it did not capture a full exploit chain in the wild.
How long?	Al Jazeera attacks in 2024 and 2025. Bidding data March to June 2026. Confiant's window 1 April to 10 September 2026. Candiru infection links of 2024 and 2025.	When the hand-off to spyware infrastructure began and ended on each ad platform, and when any platform could first have seen it.
How many people were profiled?	Millions of devices were directed to Candiru servers, the report says. 3,637,213 eligible users on one server, January to June 2026.	The number of people. The overlap between the report's sources. The people behind the 441,954,291 won impressions.
Which ad platforms carried the hand-off?	Discover-Tech delivered ads through Google, Yandex, Vungle, Sunteng, Beeswax and Eskimi, and used Xandr identifiers for matching.	Which of them carried ads that handed off to Candiru-attributed code. Neither primary tallies the hand-off ads by platform.
What did the ad platforms detect?	Eskimi says its monitoring flagged the behaviour and stopped campaigns, the last on 6 August 2026. Beeswax says it acted after recent activity and third-party validation. Google ended access and added Safe Browsing warnings.	What any platform detected before the researchers made contact, or when. Liftoff says it cannot confirm the assertions while its review runs.
Does Candiru confirm?	Candiru (now Integrity Labs, the report says) did not respond. It has been on the US Commerce Department's Entity List since 3 November 2021.	Any statement from Candiru, Bindecy, Intelos or Discover-Tech. The status of the reported 2025 acquisition of Candiru is described as unclear.
Who are the customers?	Platform accounts the lab links to Candiru, Bindecy and Intelos. The report says it is not known which governments use the capability.	Who bought spyware or ad intelligence through the platform, and for whom.
Is it lawful?	Citizen Lab asks regulators to investigate whether Discover-Tech and Candiru broke applicable laws.	Any finding of illegality. The NCSC describes such capabilities as an essential part of many countries' toolkits for serious crime and national security, and the report does not say otherwise of any customer.
Does it touch the UK?	The UK is not among the 24 countries where the report lists government-network impressions. The report says it saw the ads displaying on the BBC's site, among others.	Whether UK organisations or people were reached or targeted. The report's view is limited to one platform's data for March to June 2026.
Is it still running?	Google, IAB Europe and Beeswax removed Discover-Tech, Liftoff paused it and Eskimi blocked it. Two cookie-matching domains were suspended on 1 October, Confiant says. The exposed bidding databases were shut in August.	Whether other routes, other customers or other firms using the same method are active. The report says it is unlikely Discover-Tech is the only enabler.

How the chain works, and where the ad platforms stop seeing it

Citizen Lab's account of the mechanism is short, and the diagram follows it. An ad is bought through a demand-side platform and pushed by an exchange to an app or page. The ad is a plain image with a script tag. For most viewers a server run by the company returns nothing. For a selected device it returns code, which can lead to a hand-off to infrastructure that the lab attributes to Candiru and then to installation with no click. Citizen Lab argues that this design keeps malicious code, and even pointers to it, away from the companies that serve and display the ads. Eskimi's account of its own platform fits that description: it says the tags loaded different code depending on who viewed them, which is how they passed third-party verification. The report says the decision step apparently rests on the address and advertising identifiers, and that it does not know how customers choose targets.

The defender's reading needs no exploit detail. The delivery rides an ordinary ad request, an ad scanner that visits is unlikely to be shown the code, and in the one case the report documents, the evidence that identified the victims was the organisation's own network logs. Confiant adds that the operator's creatives were plain and did nothing visible, and that its detection began with an ad that fired a heuristic on 12 April 2026, 186 days (derived) before publication.

The numbers, and why they do not divide

Each figure below is printed in a primary. Each has a window, a source and a thing it counts. Reading one as if it were another is how a story about ad impressions becomes a story about victims.

Table 3. The figures in the primaries, with window, source and what each counts. Derived figures are this briefing's arithmetic.

The figure	Window and source	What it counts, and what it cannot tell
3,770,286,576 bids, 441,954,291 won (11.7 per cent)	March to June 2026 (122 days, derived). One platform's data from an exposed database. Excludes Beeswax and Eskimi.	Bids and wins on impressions, not people or devices. 3.6 million won impressions a day on average (derived).
718,748,885 bids with a script tag (about 19 per cent)	The same data. The report infers the tag from strings in ad names.	Bids for such ads, not delivered impressions. How many were won is not stated.
75,373 apps and 120,768 websites	The same data: places where tagged ads were displayed. 196,141 together (derived); the summary says almost 200,000.	Places, not victims.
3,637,213 eligible users	One decision server, January to June 2026, until its statistics endpoint was removed in June.	Users directed to the server and intended to receive code. Not infections, and not a funnel into the 45. May include other customers.
Hundreds of thousands to millions	April to December 2025. The lab's estimate for different delivery routes; the method is not printed.	An estimate of users directed to those routes.
At least 45 devices	Al Jazeera's network logs, 2024 and 2025.	Devices targeted. Infected: not stated.
About 10 million ads a day	Confiant's estimate for all Discover-Tech serving, 1 April to 10 September 2026.	2.8 times the 3.6 million a day won on the exposed platform (derived). Neither source explains the gap, and the exposed data excludes two of the three platforms the report names.
161 countries and 228 countries	Citizen Lab geolocated bids with script tags. Confiant counted countries where it saw the ads served.	Different methods. The report warns that address geolocation can mislead through VPNs and satellite links.
24 countries	Countries where the report lists government-network impressions, "as of now".	Impressions on a network, not targeting. The United Kingdom is not listed.
9 countries	Confiant: where it saw the hand-off to code it attributes to Candiru.	Hundreds to lower thousands of impressions a day, 56 per cent of hits in Belgium.

Two internal checks. The report's table of the top ten countries by raw bids sums to 919,061,293 (derived), which is 127.9 per cent of the 718,748,885 tagged bids in the same section, so it cannot be a breakdown of that total. The report does not say what the table counts. The four countries the Guardian names as places the ads were served, Yemen, Brazil, Mexico and Czechia, all appear in this table, and Yemen alone is 457,283,658 of its bids. The table of exchange shares sums to 99.46 per cent (derived); the report does not say what the other 0.54 per cent is. Neither point undermines the findings. Both are reasons to treat the country figures as indicative.

Reached is not the same as selected. Citizen Lab says an impression on a sensitive network would at minimum have led to profiling, and in some cases could have led to code from Candiru or others running on the device, but "does not in and of itself confirm targeting or infection". Confiant's narrower measure points the same way: when its telemetry showed a hand-off to code it attributes to Candiru, the volumes were "extremely low", hundreds to lower thousands of impressions a day. At 1,000 a day that would be 0.01 per cent of its estimate of about 10 million a day (derived, an illustration). Confiant found most of those ads on residential or mobile addresses, not on government networks, and no sign of geofencing. Its hypothesis, which it labels as an assessment, is that broad passive collection builds an identity graph from which spyware operators later pick targets by advertising ID. Broad profiling and narrow hand-off are different findings, and the first does not prove the second.

What the companies said

Citizen Lab sent requests for comment to 13 companies and says eight did not respond within its timeline (derived: 13 less the five responses it publishes). Google is not among the 13, because it collaborated. One detail is worth knowing: the correspondence shows Citizen Lab found on 14 October that a request to Eskimi had never been sent, set out its findings to Eskimi that day, and received a reply the same day.

Table 4. The companies in the report, the role it gives each, and the response printed or reported. Responses are quoted in short phrases or paraphrased.

Company	The role the report gives it	Response
Discover-Tech	The Israeli company the report alleges bridges ad platforms and spyware vendors. Registered March 2020.	No response to Citizen Lab. Reuters reports no reply to its contact form or messages, and the Guardian says the company was approached.
Candiru (Integrity Labs), Bindecy, Intelos	Spyware, hacking and ad-intelligence vendors the report links to the platform. Candiru is the one linked with high confidence to the Al Jazeera attacks.	No response from any of the three. Reuters could not reach Candiru's owners.
Google	Its exchange carried 24.79 per cent of the platform's bids (derived from two labels). Discover-Tech was on three Google vendor lists from 2020. Google collaborated.	Ended Discover-Tech's access to its exchanges and added Safe Browsing warnings for known domains. Told Reuters it acted for "systematically violating our policies".
IAB Europe	Kept Discover-Tech on its Global Vendor List from 2 July 2020 to 8 October 2026.	No reply to Citizen Lab, which counts it among those that acted. Told Reuters that an audit identified policy violations.
Beeswax (Comcast)	A buying platform Discover-Tech used and synchronised identifiers with.	Removed Discover-Tech after its own observation and outside validation. "Malicious advertising of any kind is prohibited" on its platform.
Liftoff (Vungle)	Its exchange carried 7.24 per cent of the platform's bids.	Paused all access while it reviews. It cannot yet confirm the report's factual assertions.
Eskimi	A third buying platform. Discover-Tech had been a self-service advertiser since 2022.	Says the tags were "built to evade automated scanning", loaded different code by viewer, and passed third-party verification; spend was a few hundred dollars; last campaign stopped 6 August 2026; accounts and domains blocked.
Yandex, Xandr, Sunteng	Yandex carried 67.4 per cent of the platform's bids. Xandr identifiers were used for matching. Sunteng carried 0.03 per cent.	Yandex is not among the 13 asked and did not reply to Reuters. Xandr and Sunteng did not respond to Citizen Lab.
Trustworthy Accountability Group	Discover-Tech was listed in its registry and displayed a "Verified by TAG" badge as of October 2026, the report says.	Not among the 13 asked. No statement found.
Adtimizer and Volasim	Linked to Discover-Tech through domains, DNS records and ad content. The report says it has no conclusive evidence that either knowingly took part.	Both deny it. Adtimizer says it had "no knowledge of, or involvement in" the activities. Volasim says it has "no involvement whatsoever" and used Discover-Tech as an external advertising provider.
Affle	The report believes it bought Discover-Tech's carrier and device business in 2021, and has no reason to believe Affle controls the ad operations.	No response to Citizen Lab.
Al Jazeera	The victim organisation. It consented to be named and supplied the logs.	No statement found. Reuters says it did not reply.

One of the intermediaries has a related history on this site: Xandr, which the report says Discover-Tech used for identity matching, was the subject of a Norwegian fine over real-time bidding data. That case concerned consent and data sharing, not spyware, and the two should not be run together. Other malicious use of the same ad supply chain is documented here, where a Google ad led to a fake installer. What is new in the AdFection report is the allegation of selective delivery of code to individually chosen devices.

The friendly names, and what each hides

Several labels in this story do the work of a control or of a finding. The table sets each against what the primaries print.

Table 5. Labels used in the coverage and the report, who uses them, and what each hides.

The label	Who uses it	What it hides
"Specialised digital advertising agency", "adtech"	Discover-Tech's self-description, as the Guardian puts it.	Citizen Lab says it found no good evidence of ordinary advertising revenue: the platform's revenue and profit fields were zero apart from one revenue field on three days in June, conversions were always zero, there were three advertisers, most linked to the company itself, and Confiant says about 60 per cent of August 2026 creatives were affiliate placements.
"Certified", "approved", "Verified by TAG"	Vendor lists and badges.	Citizen Lab says the lists "appear to be largely based on self-attestation by vendors", and that Google's description of a business review does not say what it checks. A listing is not a control. It recommends mandatory third-party audits.
"Partner"	The coverage, for Candiru, Bindecy and Intelos.	In the report a partner is a customer account on a platform, with limits on countries, volumes and campaigns per customer. The roles of Bindecy and Intelos are inferred from login overlaps and company records, not from a contract.
"Zero-click"	Press and vendors.	It describes only the victim's side: nothing to tap. Delivery still needs an ad to be displayed, a flaw on the device and a decision to select it. The report names no flaw, and says some ads render in the background.
"Mercenary spyware"	Citizen Lab.	A label for a class of vendor, not a legal finding. The NCSC calls the class commercial cyber intrusion capabilities and describes them as an essential part of many countries' toolkits for serious crime and national security. The Pall Mall Code says many can be developed or used for legitimate purposes and speaks of irresponsible use.
"Deanonymise"	Citizen Lab and the coverage.	In the ad trade this is identity matching, linking an advertising ID, cookie or address to a device or person. The report describes choosing a target by identifier and, for a separate actor, linking ad IDs to phone numbers. It gives no count of people identified.
"Benign ad"	The Guardian, "seemingly benign".	It describes what a scanner saw. The report says the ad carries no exploit code, and Eskimi says the tags returned different code depending on the viewer.
"High confidence"	Citizen Lab, twice.	It covers attribution of the Al Jazeera attacks to Candiru's spyware via these ads, and of one file to a 2021 chain. It does not cover the number of victims, the number infected, the customers or any other attribution, and no scale is defined.

UK: what applies to an organisation and to a high-risk individual, and where each stops

The report gives UK readers a threat model, not a UK incident. The United Kingdom is not among the 24 countries where it lists government-network impressions, and its view is limited to one platform's data for March to June 2026, which excludes Beeswax and Eskimi. It does say it observed the ads displaying on the BBC's site, among many others; a publisher showing a programmatic ad is not alleged to have done anything wrong. Confiant's post mentions Gibraltar for a single day, a Windows-only spike on 27 April reaching 4.7 per cent, which says nothing by itself about targeting. Table 6 sets out the UK instruments read for this briefing, what each says as read, and where each stops.

Table 6. UK guidance and law as read from the primary pages on 15 October 2026, and where each stops. Dates are those printed on each page.

Instrument	What it says, as read	Where it stops
[NCSC guidance for high-risk individuals](https://www.ncsc.gov.uk/collection/defending-democracy/guidance-for-high-risk-individuals) (published 7 December 2023, reviewed 29 May 2024, version 1.0)	Install updates, use official app stores, replace unsupported devices. Consider Lockdown Mode on Apple devices, designed for people who might face sophisticated actors, and S mode on Windows. Use managed devices where possible. Report a suspected compromise to IT even on a personal device. Two invitation-only services, one blocking known malicious domains.	Written around spear-phishing. The page does not mention advertising. Lockdown Mode is Apple only, and the one recovered file the report describes is a Windows library. Whether S mode or Lockdown Mode would have stopped the attack is not stated.
[NCSC guidance for brands to help advertising partners counter malvertising](https://www.ncsc.gov.uk/guidance/guidance-brands-advertising-partners-counter-malvertising) (6 November 2024, version 1.0)	Eight principles to expect of ad partners: know-your-customer checks including owners of 25 per cent or more, secure operations, reputable data, industry standards such as ads.txt, detection and removal, including whether it covers cloaking, threat sharing, reporting routes and transparency. It names TAG and IAB UK certifications as examples of independent certification.	Advice to buyers, not a rule, and silent on blocking ads on managed devices. The report says Discover-Tech held a TAG badge in October 2026 and sat on industry lists for six years, and puts the lists down to self-attestation.
[NCSC Protective DNS](https://ncsc.gov.uk/information/pdns) (service page published 17 August 2017, reviewed 17 September 2024) and [private-sector guidance](https://www.ncsc.gov.uk/guidance/protective-dns-for-private-sector) (9 June 2021)	A resolver that does not return addresses for domains known to be malicious. Deny lists come from threat-intelligence feeds. A roaming client exists for Windows, macOS and iOS. Block data can feed a SIEM. The service is mandated for central government and open to other eligible organisations; the private-sector guidance is for those that do not qualify.	A deny list works on known domains. Confiant says the hand-off hosts were rotated after a few days and Eskimi says the code varied by viewer, so a list may trail. The pages read do not mention ad blocking or advertising identifiers.
[NCSC device security guidance](https://www.ncsc.gov.uk/collection/device-security-guidance) (published 29 June 2021, reviewed 13 May 2025, version 2.1), with platform and BYOD guides	Choose, configure and manage devices centrally, with platform guides for Android, iOS, macOS and Windows. BYOD protection depends on how far the device can be managed.	The overview pages read do not mention advertising identifiers or ad blocking. Citizen Lab's advice to opt out of ad targeting through device management is not in them.
[NCSC assessment: the threat from commercial cyber proliferation](https://www.ncsc.gov.uk/report/commercial-cyber-proliferation-assessment) (19 April 2023)	At least 80 countries had bought commercial intrusion software in ten years. Zero-click attacks exist. Spyware has "almost certainly" been used against journalists, activists and officials at scale. It was "almost certain" that further high-profile exposures would follow.	Predates AdFection and does not mention advertising as a route. It supports the premise that the market is real. It says nothing about who bought from Discover-Tech or Candiru.
[Pall Mall Process Code of Practice for States](https://www.gov.uk/government/publications/the-pall-mall-process-code-of-practice-for-states/the-pall-mall-process-code-of-practice-for-states) and the [NCSC blog of 2 December 2025](https://www.ncsc.gov.uk/blog-post/what-makes-a-responsible-cyber-actor)	Voluntary and non-binding. States commit to rules on developing, buying, transferring and using such tools, and to advice for people at high risk such as journalists. The NCSC says 27 states had signed and that guidelines for industry are the next phase, with a consultation.	Binds no company and no ad platform. No mention of advertising infrastructure found. It does not say whether any signatory bought from Candiru, and the report does not say so either.
ICO [update report on adtech and real-time bidding](https://ico.org.uk/media2/migrated/2615156/adtech-real-time-bidding-report-201906-dl191220.pdf) (20 June 2019) and [report for DSIT on advertising exceptions to PECR regulation 6](https://ico.org.uk/media2/yefdqvk4/20260505-report-for-dsit-on-changes-to-regulation-6-pecr-for-online-advertising.pdf) (5 May 2026)	2019: one bid request can reach hundreds of organisations, nothing technical controls what the others do with the data, and contract terms alone are not enough. 2026: many of those issues still exist, and regulation 6 bars storing or accessing information on a device unless consent or another exception applies. Advice for government to decide.	Privacy and data protection, not malware delivery: a search of both texts for malware, spyware, malicious and malvertising finds nothing. No ICO statement on Discover-Tech found. Confiant alleges first-party cookie capture even without consent; neither primary tests UK law.
UK GDPR [Article 32](https://www.legislation.gov.uk/eur/2016/679/article/32) and ICO [breach reporting](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/)	Controllers and processors must use technical and organisational measures giving security appropriate to the risk. A personal data breach is reportable to the ICO within 72 hours of becoming aware, where feasible.	Neither mentions advertising. No source read says whether ad exposure on managed devices must be controlled to meet Article 32; that is a risk judgement. Whether a device compromise is a reportable personal data breach depends on whether personal data was affected.
[Cyber Essentials requirements for IT infrastructure v3.3](https://www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastructure-v3-3.pdf) (April 2026), with [IASME's note on the April 2026 changes](https://iasme.co.uk/articles/important-update-changes-to-cyber-essentials-for-april-2026/)	Critical or high-risk updates within 14 days of release, on devices that include mobile phones. Two auto-fail questions on timely updates, A6.4 and A6.5.	Fast patching does not help with a flaw that is unpatched or undisclosed. The report names no flaw and no patch status, so whether a 14-day cycle would have mattered is not stated. The standard does not mention advertising.

Ad blocking is the gap. Citizen Lab says there is currently no consistently safe way to expose users and networks to targeted ads, and recommends blocking ads and tracking at the gateway and on work devices, opting out of ad targeting through device management, and, for individuals, a blocking extension, a tracking-resistant browser and resetting or disabling the advertising ID. It cites NSA and CISA guidance from 2018 and 2020 that recommended ad blocking; this briefing did not read those documents. No NCSC page read here advises blocking ads on managed devices. The one NCSC document on malvertising speaks to brands and their partners. So the UK position as read is this: the NCSC tells buyers to demand better of ad partners, and tells high-risk people to patch, use managed and supported devices and consider Lockdown Mode, and neither tells an organisation whether to filter ads on the devices it manages. That decision falls to the organisation's risk assessment, and the checklist below treats it that way.

What to do, in the order worth doing

Three lists follow, for the security lead, for a newsroom or NGO, and for a buyer of advertising. Each item rests on a control a named source recommends, and where only Citizen Lab or Confiant recommends it, the item says so.

What could not be verified

• Forbes. Its report answered with a 403 and was not read. A search summary attributed the Windows description to it; Reuters carries the same description.
• Citizen Lab's raw data. The exposed bidding databases were shut in August and the statistics endpoint was removed in June, according to the report, so the counts could not be re-checked. All printed figures are as the report gives them. Derived figures are this briefing's arithmetic, in calc.py.
• Responses beyond the documents. No statement from Discover-Tech, Candiru, Bindecy, Intelos or Al Jazeera was found by about 14:34 BST. The Google statement was read in the report and in Reuters, not on a Google page.
• Confiant's charts. The list of named government networks in Confiant's post is an image and was read only through Citizen Lab's summary of it.
• US advice. The NSA and CISA ad-blocking guidance cited by Citizen Lab was not read.
• The NCSC incident reporting service. It loads as a web application whose text could not be read, and no form was opened or filled in. The ICO's breach page was read.
• The UK ICO position. The 2019 and 2026 ICO documents were read. No later ICO statement on adtech security or on Discover-Tech was found.
• Time-stamped. Sources were read between 14:13 and 14:34 BST on 15 October 2026. Citizen Lab says it will publish a separate report on a second actor, and a report published that morning can be amended.

The question that exposes the gap

If an advert you never bought, shown on a device you manage, can run code chosen by a server your ad platform never sees, which of your controls would have stopped it, and what did you check before you decided that a vendor on an approved list was safe to let through?

Key facts