Skip to main content
NOPE
Low reported severity Internal Action

Estonia's data protection inspectorate says a bank employee uploaded staff employment contracts to an AI service whose shared account let colleagues view them

In its overview of personal-data breach notifications for the third quarter of 2026, published on 8 October 2026, Estonia's Data Protection Inspectorate (AKI) listed a case in which a bank employee uploaded employment contracts to a widely used AI web service, making them available to other employees who used the same AI account. Answering questions from the technology outlet Geenius, AKI said the employment contracts of a few individual employees had been entered into the AI system and became accessible to other employees using the same account; Geenius reports that those colleagues could view and download them. According to the report, the bank informed the people affected and blocked its employees from using that AI system. AKI did not name the bank, the AI service or further circumstances.

AI system
Unidentified AI web service
Occurred
Event date unknown
Reported
8 October 2026
Event location
Estonia
What the AI did
Received personal information about the person
Reported harm
Other Material Harm
Whose AI use
Someone else’s AI use
Setting
Work · Privacy
Evidence
AI involvement supported · Causal attribution supported · 2 sources, 1 underlying account
5 claims: 1 documented, 4 reported. 4 open questions
People reported harmed
Not reliably quantifiable from the sources

AI system as recorded: A widely used AI web service, not named, into which a bank employee uploaded employment contracts under an account shared with other employees

Reported harm

According to Estonia's data protection inspectorate, the employment contracts of a few bank employees were uploaded to an AI service and became accessible to other employees using the same account; the bank notified the people affected.

Outcome

Unknown

The bank notified the affected people and blocked its employees from using the AI system, according to the Geenius report of AKI's information. The case was notified to AKI as a personal-data breach in the third quarter of 2026; no AKI proceeding or sanction is reported.

What remains unknown

  • Which bank and which AI service were involved.
  • When the upload happened (it was notified to AKI in the third quarter of 2026).
  • How many employees' contracts were exposed and how many colleagues accessed them.
  • Whether the AI provider retained or used the uploaded contracts.

What the evidence supports

AI involvement: supported. Estonia's data protection inspectorate, which received the breach notification, states that a bank employee uploaded employment contracts to a widely used AI web service and that, through the AI account shared with other employees, the contracts became accessible to them. The capture of the contracts into the AI service and their exposure through its shared account are the reported privacy harm; the bank notified the affected employees. The AI service is not named, and whether the provider retained or used the files is not reported.

5 claims: 1 documented, 4 reported. What the statuses mean

Documented AKI's overview of third-quarter 2026 breach notifications lists a case in which a bank employee uploaded employment contracts to a widely used AI web service, making them available to other employees using the same AI account.

Causal attribution. The regulator's published overview establishes that it recorded this description; the underlying facts come from the breach notification.

  • aki.ee(opens in new tab) supports · Estonian
    Panga töötaja laadis levinud tehisaru veebiteenusesse töölepingud, mis said seeläbi kättesaadavaks sama tehisaru kontot kasutavatele teistele töötajatele.
Reported AKI told Geenius that the employment contracts of a few individual employees had been entered into the AI system and became accessible to other employees using the same account.

Causal attribution. AKI's statement to the outlet.

  • forte.delfi.ee(opens in new tab) supports · Estonian
    Saame öelda, et tehisarusüsteemi sisestati mõne üksiku töötaja töölepingud ning need muutusid sama kontot kasutanud teistele töötajatele kättesaadavaks
Reported Geenius reports that colleagues who used the same account could view and download the contracts.

Causal attribution. The outlet's summary; AKI's quoted statement says 'accessible'.

Reported The bank informed the people affected and blocked its employees from using that AI system.

Causal attribution. Reported by Geenius from AKI's information.

  • forte.delfi.ee(opens in new tab) supports · Estonian
    Pank teavitas juhtumist puudutatud inimesi ning sulges oma töötajatele selle tehisarusüsteemi kasutamise võimaluse.
Reported AKI did not name the bank or disclose further circumstances.

Causal attribution. The limits of the public record.

Sources

2 sources inspected, from 1 underlying account. Sources that repeat one account do not corroborate each other.

How the sources were read, and where the events happened

Read in Estonian on 2026-10-31; translation by the research agent, an AI. AKI news item of 8 October 2026 summarising third-quarter 2026 breach notifications, with a one-sentence description of the case. Applies to s1.

Read in Estonian on 2026-10-31; translation by the research agent, an AI. Delfi Forte excerpt, dated 30 October 2026, of a Geenius article quoting AKI's answer to the outlet's inquiry; the excerpt ends 'Loe edasi Digigeeniuse portaalist' and the full Digigeenius article was not read; the case facts come from AKI, so it shares s1's group. Applies to s2.

Event countries: Estonia. Affected-person countries: Unknown. Court countries: Unknown.

Geenius describes the employer as an Estonian bank ('Ühe Eesti panga töötaja'), and the case was notified to Estonia's data protection inspectorate; the event is recorded in Estonia on that basis. The affected employees' countries of residence are not stated.

Reviewed for publication 2026-10-31: Published under the 2026-10-06 privacy-capture boundary: the national data protection regulator records that employees' employment contracts were uploaded into an AI web service and became accessible to colleagues through its shared account, and the bank notified those affected. The exposure ran through the AI service's shared account to co-workers, as well as to the service itself.

People described

Employees of a bank in Estonia whose employment contracts were uploaded to an AI service account that other employees could access

People reported harmed in this case

Not reliably quantifiable from the sources

AKI says the contracts of 'a few individual employees' were exposed; no number is given, so the count is unquantified with zero placeholders. The employee who uploaded the files and the colleagues who could view them are not counted as harmed.

Counted once within this case. The same person may appear in other cases. This count does not establish AI causation.

Tags

#employee-data-upload#shared-ai-account#employment-contracts#data-breach-notification#banking

Cite this case

Compiled per our published methodology: verification statuses, sourcing standards, and corrections process.

APA

NOPE. (2026). Estonia's data protection inspectorate says a bank employee uploaded staff employment contracts to an AI service whose shared account let colleagues view them. AI incidents. https://nope.net/incidents/2026-estonia-data-protection-inspectorate-says-bank-employee-uploaded-employment-contracts-to-shared-ai-service-account-colleagues-could-view

BibTeX

@misc{2026_estonia_data_protection_inspectorate_says_bank_employee_uploaded_employment_contracts_to_shared_ai_service_account_colleagues_could_view,
  title = {Estonia's data protection inspectorate says a bank employee uploaded staff employment contracts to an AI service whose shared account let colleagues view them},
  author = {NOPE},
  year = {2026},
  howpublished = {AI incidents},
  url = {https://nope.net/incidents/2026-estonia-data-protection-inspectorate-says-bank-employee-uploaded-employment-contracts-to-shared-ai-service-account-colleagues-could-view}
}

Related cases

Medium Unidentified OpenAI generative AI service (reported)

An insurer says a health-guidance contractor's employee entered data on 19,996 people, including disease information, into an unauthorised generative AI service

Notices from RIZAP's client insurers say that on 20 August 2026 it emerged that a staff member of RIZAP, the company they contract for specific health guidance, had entered data containing members' personal information into an external generative AI service that RIZAP had not permitted for work. The National Civil Engineering and Construction National Health Insurance Association (Doken Kokuho) puts the whole data set at 19,996 people, 1,167 of them its own members, and says the service was not under a corporate contract and that the matter was found when the employee noticed the transmission and reported it. A local-government employees' mutual aid association counts 726 of its members across 14 branches, and the IHI group health insurance society 210, according to a security news site that reads these as subsets of the 19,996. The data included membership numbers, email addresses, names, dates of birth, sex, some addresses and phone numbers, the type of health guidance and, for members with them, high blood pressure, diabetes or dyslipidaemia. The IHI society's notice, as relayed, names OpenAI as the provider and says OpenAI answered on 1 September that the data had not been used for model training. RIZAP's release, as described in an ITmedia column, says no third party other than the service operator could have viewed the data. Doken Kokuho says RIZAP confirmed to it that no third party viewed or used the information through the service; whether the provider's staff could view it was still being checked when the mutual aid association and the IHI society published.

Medium ChatGPT

Texas health plan says an employee uploaded a file of members' personal and prescription data to ChatGPT from a home network, against its policy

Community First Health Plans, a nonprofit health plan in San Antonio, Texas, said in a 29 June 2026 release that on the evening of 29 April 2026 one of its employees uploaded a file containing personal information of some members to ChatGPT from a home computer network, circumventing the plan's firewall safeguards and violating its policy. The plan says it does not use ChatGPT and that its systems detected the violation and alerted its IT department. According to the release, the file may have included members' names, addresses, dates of birth, member identification numbers and prescription drug information. The next morning the plan revoked the employee's access, directed and verified deletion of the data from the employee's ChatGPT account, asked OpenAI to delete any related data, and ended its relationship with the employee. It notified affected members and federal and state agencies, offered 12 months of identity monitoring and says it is not aware of any misuse. The release gives no number of affected members.

High ChatGPT (reported)

Eindhoven municipality says staff uploaded files with residents' youth-care and social-support data and applicants' CVs to public AI websites such as ChatGPT

The municipality of Eindhoven in the Netherlands told its council in an information letter shared on Thursday 18 December 2025 that a sample of staff data traffic from 23 September to 23 October 2025 showed files containing personal data of residents and employees had been sent to public AI websites such as ChatGPT, according to Omroep Brabant and Binnenlands Bestuur. The files included youth-care (Jeugdwet) documents, internal reports and CVs, mostly from departments that provide care and support to residents. According to Omroep Brabant's account of findings by the advisory firm Hooghiemstra & Partners, the youth-care documents held information about the mental and physical health of minor children, and social-support (WMO) documents and applicants' CVs were also entered. The municipality reported the breach to the Dutch Data Protection Authority on 23 October, blocked public AI websites and asked OpenAI to delete the files. The council says the scale cannot be determined because the data was kept for only 30 days, so it cannot inform those affected, and that the risk of misuse is limited but cannot be ruled out. A spokesperson said OpenAI had not yet replied.

Low Fireflies.AI meeting assistant (reported)

Illinois residents allege in lawsuits that Fireflies.AI's meeting assistant captured their voiceprints without notice or consent

Four Illinois residents who say they never had Fireflies accounts allege in four federal lawsuits, two of them later consolidated, that the Fireflies.AI meeting assistant, enabled by a colleague, boss or meeting organiser, recorded their voices in Zoom or Microsoft Teams meetings between March and November 2025, analysed their vocal characteristics to tell speakers apart and generated transcripts attributing statements to them, capturing voiceprints without telling them or obtaining written consent, in breach of the Illinois Biometric Information Privacy Act. One plaintiff dismissed her case without prejudice in March 2026; the California court stayed its case at both parties’ joint request in April 2026; Fireflies has moved to dismiss the consolidated Illinois case and does not concede that it collected biometric data about the plaintiffs.

If you or someone you know is struggling, free and confidential support is available. Find a helpline near you at Signpost.

Back to all incidents