Skip to main content
NOPE
Low reported severity Investigation Opened

NSW Reconstruction Authority says a former temporary staff member uploaded 2031 Resilient Homes participants' personal data to ChatGPT without authorisation

The NSW Reconstruction Authority says that between 12 and 15 March 2025 a former temporary staff member (called a former contractor in its first notice) uploaded a Microsoft Excel spreadsheet of Northern Rivers Resilient Homes Program information, 10 columns and more than 12,000 rows, to ChatGPT, an AI platform the Authority had not authorised. The Authority disclosed the breach on 6 October 2025, estimating that up to 3000 people were affected, and later said external forensic analysis confirmed that 2031 people had some of their data uploaded, including names, contact details, addresses, dates of birth, sensitive personal and health information and limited financial commentary. It says no driver licence, Medicare, passport or Tax File Numbers were disclosed and that there is no evidence the data is publicly available or was accessed by a third party; whether OpenAI retained or used the data is not addressed. The Authority apologised, contacted affected people with ID Support NSW, offered to compensate the replacement of compromised identity documents and notified the NSW Privacy Commissioner. A program participant told the ABC the information was deeply personal and that they felt concerned. No misuse of the data is reported.

AI system
ChatGPT
OpenAI
Occurred
12 Mar 2025 to 15 Mar 2025
Reported
6 October 2025
Event location
Australia
What the AI did
Received personal information about the person
Reported harm
Other Material Harm
Whose AI use
An institution’s AI use
Setting
Privacy · Public services
Evidence
AI involvement supported · Causal attribution alleged · 4 sources, 1 underlying account
7 claims: 7 reported. 5 open questions
People reported harmed
2031 people

AI system as recorded: ChatGPT (OpenAI), used through an unauthorised upload of program data by a person working for the NSW Reconstruction Authority

What Happened

The Authority's notices state that a former temporary staff member (called a former contractor in the first notice) uploaded a Microsoft Excel spreadsheet with 10 columns and more than 12,000 rows of Resilient Homes Program information to ChatGPT between 12 and 15 March 2025. The upload was not authorised, and the Authority says it was not a cyber-attack and its internal systems were not compromised. The Authority disclosed the breach publicly on 6 October 2025, as reported by iTnews and the ABC, and said the delay reflected the time needed to identify every affected person; the NSW Minister for Recovery told the ABC she had received a preliminary report in July. The first notice said up to 3000 people may be impacted. External forensic analysis later confirmed 2031 people, with name and contact details, residential or mailing address, date of birth, sensitive personal and health information and limited financial commentary. The Authority says no driver licence, Medicare, passport or Tax File Numbers were disclosed, that there is no evidence the data is publicly available or was accessed by a third party, and that it believes the risk of misuse is low. It reports blocking uploads of personal information into AI tools and other policy, training and system changes after an independent review. A program participant told the ABC the information held was deeply personal and that they felt concerned. No sources report misuse of the data.

Reported harm

The NSW Reconstruction Authority reports that personal and sensitive information of 2031 Resilient Homes Program participants was uploaded to ChatGPT without authorisation, a loss of privacy for those people; it reports no evidence of public exposure or third-party access, and no misuse is reported (the Authority's notices and press coverage relaying them).

Outcome

Resolved

The Authority contacted affected people with ID Support NSW and Social Futures, notified the NSW Privacy Commissioner, had Cyber Security NSW monitor the internet and dark web, implemented controls to block the upload of personal information into AI tools, and completed an independent review that identified governance, training and data security improvements (page updated 26 March 2026).

What remains unknown

  • Why the staff member uploaded the spreadsheet and what, if anything, was asked of ChatGPT; no ChatGPT output is described.
  • Whether OpenAI retained, deleted or used the uploaded data for training; the sources establish the upload to the service only.
  • Whether any participant suffered identity misuse or other realised loss; none is reported.
  • Whether the uploader was a temporary staff member or a contractor (the Authority uses both terms), and how many separate uploads occurred between 12 and 15 March 2025.
  • The findings of the independent review beyond the Authority's summary of it.

What the evidence supports

AI involvement: supported. The Authority states that a former temporary staff member uploaded a spreadsheet of program information to ChatGPT between 12 and 15 March 2025, that the upload was not authorised, and that forensic analysis confirmed 2031 people had some of their data uploaded. The reported transfer of their personal and sensitive information into the generative AI service is the AI connection to the privacy harm. This establishes the upload only. It does not establish retention by OpenAI, use for training, public exposure or a finding of illegality, and no ChatGPT output affecting participants is described.

7 claims: 7 reported. What the statuses mean

Reported Between 12 and 15 March 2025 a former temporary staff member (called a former contractor in the first notice) of the NSW Reconstruction Authority uploaded a Microsoft Excel spreadsheet of Northern Rivers Resilient Homes Program information (10 columns, more than 12,000 rows) to ChatGPT; the Authority says the upload was not authorised and was not a cyber-attack.

Causal attribution. The Authority's own notices report the upload, its dates and its unauthorised status; the ABC and iTnews relay those notices. The uploader's role is a former temporary staff member on the current page and a former contractor in the first notice and the press.

  • nsw.gov.au(opens in new tab) supports · English
    Some personal information provided by people during the RHP applications process was uploaded by a former temporary employee of the RA to the AI platform, ChatGPT.
  • nsw.gov.au(opens in new tab) supports · English
    The data shared was contained in a Microsoft Excel spreadsheet with 10 columns and more than 12,000 rows of information.
  • nsw.gov.au(opens in new tab) supports · English
    The upload took place between 12 and 15 March 2025.
  • nsw.gov.au(opens in new tab) supports · English
    This incident occurred when a former temporary employee uploaded information from a Microsoft Excel spreadsheet to an unauthorised third-party AI platform, ChatGPT.
  • nsw.gov.au(opens in new tab) supports · English
    Between 12 and 15 March 2025, personal information was uploaded by a former contractor of the RA to the Artificial Intelligence platform ChatGPT.
  • abc.net.au(opens in new tab) supports · English
    "Personal information was uploaded by a former contractor of the RA to the artificial intelligence platform ChatGPT," an RA spokesperson said.
  • itnews.com.au(opens in new tab) supports · English
    The authority said in a breach notice that the upload “was not authorised”.
Reported The Authority says external forensic analysis confirmed that 2031 people who provided information for the program had some of their data uploaded to ChatGPT, including name and contact details, residential or mailing address, date of birth, sensitive personal and health information and limited financial commentary, and that no driver licence, Medicare, passport or Tax File Numbers were disclosed; its first notice had estimated up to 3000 people.

Causal attribution. The Authority's statements report the count and data categories from its forensic analysis; the ABC relays the first notice's categories.

Reported The Authority says there is no evidence that the uploaded data is publicly available online or has been accessed by a third party; its first notice said this could not be ruled out, and it assesses the risk of misuse as low.

Causal attribution. The Authority's own assessment. Whether OpenAI retained, deleted or used the uploaded data is not addressed in the inspected sources.

Reported The Authority apologised for the distress the breach may cause, and a program participant whose flooded home was bought back told the ABC the information held by the Authority was deeply personal and that they felt concerned.

Causal attribution. The concern is one participant's stated reaction; the ABC does not say whether this person is among the 2031. No identity misuse or other realised loss is reported.

Reported The Authority contacted affected people with ID Support NSW and Social Futures to offer support, and said it would compensate reasonable out-of-pocket expenses if compromised identity documents needed replacing.

Causal attribution. The Authority's statements about its response.

  • nsw.gov.au(opens in new tab) supports · English
    We are working with Social Futures to reach out to people who have been impacted and ID Support NSW, a government identity and cyber security support service, to assist anyone whose data may have been compromised.
  • nsw.gov.au(opens in new tab) supports · English
    The NSW Reconstruction Authority will provide compensation for any reasonable out of pocket expenses if any compromised identity documents need to be replaced.
Reported The Authority notified the NSW Privacy Commissioner, had Cyber Security NSW monitor the internet and dark web, implemented controls to block the upload of personal information into AI tools, and completed an independent review that identified areas for improvement in its governance, training and data security practices.

Causal attribution. The Authority's own account of its response; the review report itself was not inspected.

  • nsw.gov.au(opens in new tab) supports · English
    We are working with Cyber Security NSW to monitor the internet and dark web to see if any of this information is accessible online. The NSW Privacy Commissioner has also been notified.
  • nsw.gov.au(opens in new tab) supports · English
    The RA has also implemented controls to block the upload of personal information into AI tools.
  • nsw.gov.au(opens in new tab) supports · English
    An independent review into the data breach has now been completed, identifying several areas for improvement in RA’s governance, training and data security practices.
Reported The breach was disclosed publicly on 6 October 2025, more than six months after the upload; the NSW Minister for Recovery told the ABC she had received a preliminary report about the breach in July and would have preferred people to be advised sooner.

Causal attribution. iTnews's own observation of the disclosure timing and the Minister's statement to the ABC; the Authority attributes the delay to the time needed to identify affected people.

  • itnews.com.au(opens in new tab) supports · English
    The AI-related data breach was disclosed on what is a public holiday Monday in NSW, although it actually occurred over six months ago, between March 12 and 15.
  • abc.net.au(opens in new tab) supports · English
    said she received a preliminary report about the breach in July, and the final report on Friday.
  • abc.net.au(opens in new tab) supports · English
    "I would prefer [for the RA] to advise people sooner, and I'm also informed they couldn't identify everybody, but I need to see the report first," she said.

Sources

4 sources inspected, from 1 underlying account. Sources that repeat one account do not corroborate each other.

How the sources were read, and where the events happened

English original; full body read by curl on 2026-10-11 (page last updated 26 March 2026, with the 9 December 2025 update and FAQ on the same page). Applies to s1.

English original; full body read by curl on 2026-10-11. Relays the Authority statement; the participant and the Minister were interviewed separately within the same article. Applies to s2.

English original; full body read by curl on 2026-10-11. Relays the Authority breach notice; the disclosure-timing observation is the outlet's own. Applies to s3.

English original; full body read by curl on 2026-10-11. Authority departmental release of the first notice, 6 October 2025. Applies to s4.

Event countries: Australia. Affected-person countries: Australia. Court countries: Unknown.

The data was held by the NSW Reconstruction Authority, a New South Wales government agency, and was uploaded by a former temporary staff member of that agency; the Authority describes the incident as a breach of its program data. The ABC describes the affected people as northern NSW residents of the Northern Rivers region. No court is involved.

Reviewed for publication 2026-10-11: The Authority's notices, read in full on 2026-10-11, state that a staff member uploaded program participants' personal and sensitive information to ChatGPT without authorisation and that forensic analysis confirmed 2031 affected people. The disclosure of their information to a generative AI service without their knowledge is the recorded privacy harm. The upload rests on the Authority's own account, which the press relayed; no retention, training, public exposure or misuse is established. The uploader and affected people are not named.

People described

Participants in the Northern Rivers Resilient Homes Program, a NSW flood buyback and resilience program; the Authority confirmed that 2031 of them had personal information uploaded

People reported harmed in this case

2031 people

0 AI participants · 2031 other people harmed

The Authority states that external forensic analysis confirmed 2031 people had some of their data uploaded to ChatGPT. The upload of their personal information to the AI service is itself the privacy harm recorded, so those 2031 people are counted as other people harmed. The first notice's estimate of up to 3000 is not used; the 12,000 rows are rows, not people. The participant quoted by the ABC is not separately counted because the ABC does not say whether that person is among the 2031. The uploader is not counted.

Counted once within this case. The same person may appear in other cases. This count does not establish AI causation.

Cite this case

Compiled per our published methodology: verification statuses, sourcing standards, and corrections process.

APA

NOPE. (2026). NSW Reconstruction Authority says a former temporary staff member uploaded 2031 Resilient Homes participants' personal data to ChatGPT without authorisation. AI incidents. https://nope.net/incidents/2025-nsw-resilient-homes-program-applicant-data-uploaded-to-chatgpt

BibTeX

@misc{2025_nsw_resilient_homes_program_applicant_data_uploaded_to_chatgpt,
  title = {NSW Reconstruction Authority says a former temporary staff member uploaded 2031 Resilient Homes participants' personal data to ChatGPT without authorisation},
  author = {NOPE},
  year = {2026},
  howpublished = {AI incidents},
  url = {https://nope.net/incidents/2025-nsw-resilient-homes-program-applicant-data-uploaded-to-chatgpt}
}

Related cases

Medium ChatGPT

Victorian child protection worker put a family's information into ChatGPT to draft a court report that minimised risk to the child, regulator finds

Victoria's Information Commissioner (OVIC) found in a report published on 24 September 2024 that a child protection worker at the Department of Families, Fairness and Housing (DFFH) used ChatGPT in or around September 2023 to draft a Protection Application Report submitted to the Children's Court about a young child. On the balance of probabilities, OVIC found the worker entered personal information, including names, about the child, mother, father and carer, disclosing it to OpenAI; the worker admitted using ChatGPT but denied entering personal information. OVIC found generated content in the report described a doll that the father had reportedly used for sexual purposes as a parental strength ('age-appropriate toys'), downplaying the risk to the child, although the court's and the department's decisions did not change. The report was withdrawn and replaced, and the mother, father and carer described anxiety when told of the disclosure. OVIC found serious breaches of two privacy principles and issued a compliance notice requiring DFFH to ban and block generative AI text tools for child protection staff until November 2026; DFFH accepted the breach findings.

High ChatGPT (reported)

Eindhoven municipality says staff uploaded files with residents' youth-care and social-support data and applicants' CVs to public AI websites such as ChatGPT

The municipality of Eindhoven in the Netherlands told its council in an information letter shared on Thursday 18 December 2025 that a sample of staff data traffic from 23 September to 23 October 2025 showed files containing personal data of residents and employees had been sent to public AI websites such as ChatGPT, according to Omroep Brabant and Binnenlands Bestuur. The files included youth-care (Jeugdwet) documents, internal reports and CVs, mostly from departments that provide care and support to residents. According to Omroep Brabant's account of findings by the advisory firm Hooghiemstra & Partners, the youth-care documents held information about the mental and physical health of minor children, and social-support (WMO) documents and applicants' CVs were also entered. The municipality reported the breach to the Dutch Data Protection Authority on 23 October, blocked public AI websites and asked OpenAI to delete the files. The council says the scale cannot be determined because the data was kept for only 30 days, so it cannot inform those affected, and that the risk of misuse is limited but cannot be ruled out. A spokesperson said OpenAI had not yet replied.

Medium ChatGPT

Texas health plan says an employee uploaded a file of members' personal and prescription data to ChatGPT from a home network, against its policy

Community First Health Plans, a nonprofit health plan in San Antonio, Texas, said in a 29 June 2026 release that on the evening of 29 April 2026 one of its employees uploaded a file containing personal information of some members to ChatGPT from a home computer network, circumventing the plan's firewall safeguards and violating its policy. The plan says it does not use ChatGPT and that its systems detected the violation and alerted its IT department. According to the release, the file may have included members' names, addresses, dates of birth, member identification numbers and prescription drug information. The next morning the plan revoked the employee's access, directed and verified deletion of the data from the employee's ChatGPT account, asked OpenAI to delete any related data, and ended its relationship with the employee. It notified affected members and federal and state agencies, offered 12 months of identity monitoring and says it is not aware of any misuse. The release gives no number of affected members.

Low ChatGPT

Adult ChatGPT Plus subscriber says the account was classified as a teen and restricted, and that OpenAI said profiling had to come first; first-person post

In a Reddit post of 11 October 2026, a ChatGPT Plus subscriber who says they are an adult (36, by the post's own account) writes that when OpenAI's age checks rolled out their account was classified as a teen account and put on a restricted account. The poster says they had earlier emailed OpenAI asking for verification options without ID or a photo, received a canned reply about the verification provider Persona, and on escalating to data protection was told they had to be profiled first. The poster says they then cancelled the subscription. OpenAI's Help Center says ChatGPT uses an age prediction system that reads account signals, automatically enables the teen experience when it predicts an account may belong to someone under 18, can get this wrong, and lets adults verify their age to remove it. The account is the poster's own and is not corroborated.

If you or someone you know is struggling, free and confidential support is available. Find a helpline near you at Signpost.

Back to all incidents