Skip to main content
NOPE
Medium reported severity

Panasonic group company says a project member uploaded HR data on about 334,000 employees, former staff and relatives to a banned generative AI service

Panasonic Operational Excellence, a Panasonic Holdings subsidiary, announced on 23 October 2026 that a member of an in-house project introducing a personnel information system had uploaded part of that system's data, as registered in April 2026, to an external generative AI service whose use the company prohibits. According to the announcement as reported by ITmedia and CNET Japan, the data covered about 75,000 current and about 178,000 former employees of Panasonic group companies in Japan (employee numbers, addresses, phone numbers and email addresses, without names) and about 81,000 family members registered as emergency contacts (names, addresses, phone numbers and email addresses), about 334,000 people in all. The company says the upload broke internal rules and was not an outside attack, that the employee deleted the chat history and the local data immediately after the problem came to light, and that it reported the matter to Japan's Personal Information Protection Commission on 29 September. The provider told the company that training on the data was switched off at upload but that deleted data is kept for 30 days, until 25 October. No public exposure or misuse had been confirmed. The company has not named the AI service.

AI system
Unidentified chatbot
Occurred
Event date unknown
Reported
23 October 2026
Event location
Unknown
What the AI did
Received personal information about the person
Reported harm
Other Material Harm
Whose AI use
An institution’s AI use
Setting
Work · Privacy
Evidence
AI involvement reported · Causal attribution supported · 3 sources, 1 underlying account
5 claims: 5 reported. 5 open questions
People reported harmed
Not reliably quantifiable from the sources

AI system as recorded: An external generative AI service that Panasonic group rules prohibit for work; the company's announcement, as relayed, does not name the service or its provider

What Happened

The upload. Panasonic Operational Excellence (Kadoma, Osaka), a subsidiary of Panasonic Holdings, announced on 23 October 2026 that a staff member working on a project to introduce a personnel information system, run with its subsidiary Panasonic Digital, had uploaded part of the data registered in that system as of April 2026 to an external generative AI service whose use is prohibited inside the company. According to ITmedia and CNET Japan, the company says this was a breach of internal rules by the employee and not unauthorised access from outside. The articles do not give the date of the upload or of its discovery.

Whose data. ITmedia lists about 75,000 current and about 178,000 former employees of Panasonic group companies in Japan, and about 81,000 of their family members. For employees and former employees the data included employee numbers, addresses, phone numbers and email addresses but not names; for family members registered as emergency contacts it included names, addresses, phone numbers and email addresses. AI Insider adds, from the same announcement, that the family members are emergency contacts of current staff and relatives of people who left since 2016, and that Panasonic has given staff its own AI assistant since 2023 while prohibiting external services.

What followed. The employee deleted the chat history on the service and the data on the work PC straight after the problem came to light. The company says the provider confirmed that the function using data for training was off when the data was uploaded, so it would not be used in answers to other users, but that the provider keeps deleted data for 30 days for security and legal compliance, until 25 October. The company reported the matter to the Personal Information Protection Commission on 29 September; no public disclosure or concrete harm from misuse had been confirmed. It says it will keep investigating, review its rules on handling personal information and on managing generative AI services, and strengthen training.

Reported harm

According to the company's announcement as reported by ITmedia and CNET Japan, a project member uploaded HR data on about 334,000 current and former Panasonic group employees in Japan and their family emergency contacts, including addresses, phone numbers and email addresses, to an external generative AI service the company prohibits.

Outcome

Ongoing

Panasonic Operational Excellence reported the matter to the Personal Information Protection Commission on 29 September 2026 and announced it on 23 October. The employee deleted the chat history on the service and the data on the work PC; the provider keeps deleted data for 30 days, until 25 October, and told the company the data was not used for training. The company says it is still investigating the impact, will review its rules on personal information and on the use of generative AI services, and will strengthen training. No action by the Commission had been reported when the articles were published.

What remains unknown

  • When the upload took place and when it was discovered; the articles give only the April 2026 data snapshot and the 29 September report to the Commission.
  • Which generative AI service and provider received the data.
  • Whether provider staff viewed the data during the 30-day retention period.
  • Whether any affected employee, former employee or family member was later notified individually; CNET Japan reports that the public announcement was made in place of individual notification.
  • Whether the Personal Information Protection Commission has taken any action, and whether the employee faced discipline.

What the evidence supports

AI involvement: reported. The company's announcement, as reported by ITmedia and CNET Japan, states that a project member uploaded part of the personnel system's data, including addresses, phone numbers and email addresses of current and former employees and the names and contact details of family members, to an external generative AI service, which received and stored it; the provider keeps deleted data for 30 days. The privacy harm is that transfer of the people's data to the AI service without their knowledge. No generated output about them is reported, the service is not named, and the provider says training on the data was off.

5 claims: 5 reported. What the statuses mean

Reported Panasonic Operational Excellence announced on 23 October 2026 that a staff member on an in-house project had uploaded data containing personal information on about 334,000 current and former Panasonic group employees and their family members to an external generative AI service whose use the company prohibits; the company says it was a breach of internal rules by the employee, not an outside attack.

Causal attribution. All three articles relay the company's own announcement; the upload is the company's admission about its employee.

  • itmedia.co.jp(opens in new tab) supports · Japanese
    '社内プロジェクトに携わる社員が、パナソニックグループの従業員や元従業員、その家族ら計約33万4000人分の個人情報を含むデータを、社内で利用を禁止している外部の生成AIサービスにアップロードしていたと発表した。'; '今回の事案は外部からの不正な操作ではなく、当該社員の社内ルール違反によるものだと説明している。'
  • japan.cnet.com(opens in new tab) supports · Japanese
    'プロジェクトのメンバーが社内ルールに違反し、2026年4月時点で人事情報システムに登録されていたデータの一部を、外部の生成AIサービスにアップロードした。'
  • aiinsider.nl(opens in new tab) supports · Dutch
    'Een medewerker van Panasonic heeft persoonsgegevens van ongeveer 334.000 mensen geüpload naar een externe AI-dienst die binnen het bedrijf verboden is.'
Reported The uploaded data covered about 75,000 employees and about 178,000 former employees of Panasonic group companies in Japan (employee numbers, addresses, phone numbers and email addresses, without names) and about 81,000 family members registered as emergency contacts (names, addresses, phone numbers and email addresses).

Causal attribution. The figures and data fields are the company's, as relayed by ITmedia; they are approximate.

  • itmedia.co.jp(opens in new tab) supports · Japanese
    '日本国内のパナソニックグループの従業員約7万5000人、元従業員約17万8000人と、その家族計約8万1000人。'; '一方、家族については、緊急連絡先として登録された氏名、住所、電話番号、メールアドレスが含まれる。'
Reported The company says the employee deleted the chat history and the local data immediately after the problem came to light, that the provider confirmed training on the data was switched off, and that the provider keeps deleted data for 30 days, until 25 October.

Causal attribution. The company relays the provider's account; neither article had the provider's own statement.

  • itmedia.co.jp(opens in new tab) supports · Japanese
    '当該社員は問題の発覚直後に、生成AIサービス上のチャット履歴と業務用PC内の対象データを削除した。'; '削除されたデータを30日間保持しており、今回のデータは10月25日まで保管される。'
  • japan.cnet.com(opens in new tab) supports · Japanese
    '今回アップロードされたデータも、保持期間が終了する10月25日以降は、事業者側に残らないという。'
Reported The company reported the matter to the Personal Information Protection Commission on 29 September 2026 and says no public disclosure or concrete harm from misuse had been confirmed. CNET Japan reports that the company made its announcement in place of notifying each affected person individually under the personal-information protection law.

Causal attribution. The report to the regulator is stated by the company; no Commission document was read.

  • itmedia.co.jp(opens in new tab) supports · Japanese
    '同社は9月29日に個人情報保護委員会へ報告している。'; '現時点で、対象の個人情報が一般に公開された事実や、不正利用による具体的な被害は確認されていない。'
  • japan.cnet.com(opens in new tab) supports · Japanese
    '同社は9月29日、個人情報保護委員会に報告した。'; '今回の発表は、個人情報保護法に基づく本人通知の代替措置として行った。'
Reported The company has not named the AI service; it has given staff an in-house AI assistant since 2023 and prohibits external services.

Causal attribution. AI Insider's account of the announcement and of Panasonic's in-house assistant.

  • aiinsider.nl(opens in new tab) supports · Dutch
    'Welke AI-dienst dat was, zegt Panasonic niet.'; 'Opvallend is dat Panasonic zijn medewerkers sinds 2023 een eigen AI-assistent geeft, PX-AI.'

Sources

3 sources inspected, from 1 underlying account. Sources that repeat one account do not corroborate each other.

How the sources were read, and where the events happened

Read in Japanese on 2026-10-24 (HTTP 200); quoted passages were translated into English by the research agent (an AI), not by a human translator. The article relays Panasonic Operational Excellence's announcement of 23 October 2026; the announcement page on holdings.panasonic returned HTTP 403 to the fetcher and had no Wayback capture, so it was not read directly. Applies to s1.

Read in Japanese on 2026-10-24 (HTTP 200); quoted passages were translated into English by the research agent (an AI), not by a human translator. The article (also carried in its JSON-LD body) relays Panasonic Operational Excellence's announcement of 23 October 2026; the announcement page on holdings.panasonic returned HTTP 403 to the fetcher and had no Wayback capture, so it was not read directly. Applies to s2.

Read in Dutch on 2026-10-24 (HTTP 200); quoted passages were translated into English by the research agent (an AI), not by a human translator. The article translates and relays the same Panasonic Operational Excellence announcement and cites Nikkei and Kansai TV, so it shares that origin. Applies to s3.

Event countries: Unknown. Affected-person countries: Japan. Court countries: Unknown.

ITmedia describes the affected people as employees and former employees of Panasonic group companies in Japan ('日本国内のパナソニックグループの従業員') and their family members. The articles do not say where the employee made the upload, so no event country is recorded. No court is involved.

Reviewed for publication 2026-10-24: Published under the 2026-10-06 private-information ruling: the company's announcement, relayed by ITmedia and CNET Japan, describes a project member actually uploading personnel data on current and former employees and their family emergency contacts to an external generative AI service, without the knowledge of the people concerned. The affected people are the uploading organisation's own workforce and their relatives, whose records were held for employment purposes. The account rests on the company's own admission; the provider's statements on training and retention are recorded as relayed.

People described

Current and former employees of Panasonic group companies in Japan whose personnel records were in the new HR system, and family members they had registered as emergency contacts (none named)

People reported harmed in this case

Not reliably quantifiable from the sources

The company's figures, as relayed by ITmedia, are approximate: about 75,000 employees, about 178,000 former employees and about 81,000 family members, about 334,000 people in total ('計約33万4000人分'). Approximate figures are neither an exact count nor a documented minimum, so zero placeholders are used and the status is unquantified. The count would be of people whose personal information was transferred to the AI service, the privacy harm recorded here; no person is reported to have suffered misuse. The employee who uploaded the data is not counted.

Counted once within this case. The same person may appear in other cases. This count does not establish AI causation.

Tags

#privacy#generative-ai#unauthorised-ai-use#employee-data#japan#data-protection-report

Cite this case

Compiled per our published methodology: verification statuses, sourcing standards, and corrections process.

APA

NOPE. (2026). Panasonic group company says a project member uploaded HR data on about 334,000 employees, former staff and relatives to a banned generative AI service. AI incidents. https://nope.net/incidents/2026-japan-panasonic-group-company-says-project-member-uploaded-hr-data-on-about-334000-people-to-banned-generative-ai-service

BibTeX

@misc{2026_japan_panasonic_group_company_says_project_member_uploaded_hr_data_on_about_334000_people_to_banned_generative_ai_service,
  title = {Panasonic group company says a project member uploaded HR data on about 334,000 employees, former staff and relatives to a banned generative AI service},
  author = {NOPE},
  year = {2026},
  howpublished = {AI incidents},
  url = {https://nope.net/incidents/2026-japan-panasonic-group-company-says-project-member-uploaded-hr-data-on-about-334000-people-to-banned-generative-ai-service}
}

Related cases

Medium Unidentified OpenAI generative AI service (reported)

An insurer says a health-guidance contractor's employee entered data on 19,996 people, including disease information, into an unauthorised generative AI service

Notices from RIZAP's client insurers say that on 20 August 2026 it emerged that a staff member of RIZAP, the company they contract for specific health guidance, had entered data containing members' personal information into an external generative AI service that RIZAP had not permitted for work. The National Civil Engineering and Construction National Health Insurance Association (Doken Kokuho) puts the whole data set at 19,996 people, 1,167 of them its own members, and says the service was not under a corporate contract and that the matter was found when the employee noticed the transmission and reported it. A local-government employees' mutual aid association counts 726 of its members across 14 branches, and the IHI group health insurance society 210, according to a security news site that reads these as subsets of the 19,996. The data included membership numbers, email addresses, names, dates of birth, sex, some addresses and phone numbers, the type of health guidance and, for members with them, high blood pressure, diabetes or dyslipidaemia. The IHI society's notice, as relayed, names OpenAI as the provider and says OpenAI answered on 1 September that the data had not been used for model training. RIZAP's release, as described in an ITmedia column, says no third party other than the service operator could have viewed the data. Doken Kokuho says RIZAP confirmed to it that no third party viewed or used the information through the service; whether the provider's staff could view it was still being checked when the mutual aid association and the IHI society published.

Medium ChatGPT

Texas health plan says an employee uploaded a file of members' personal and prescription data to ChatGPT from a home network, against its policy

Community First Health Plans, a nonprofit health plan in San Antonio, Texas, said in a 29 June 2026 release that on the evening of 29 April 2026 one of its employees uploaded a file containing personal information of some members to ChatGPT from a home computer network, circumventing the plan's firewall safeguards and violating its policy. The plan says it does not use ChatGPT and that its systems detected the violation and alerted its IT department. According to the release, the file may have included members' names, addresses, dates of birth, member identification numbers and prescription drug information. The next morning the plan revoked the employee's access, directed and verified deletion of the data from the employee's ChatGPT account, asked OpenAI to delete any related data, and ended its relationship with the employee. It notified affected members and federal and state agencies, offered 12 months of identity monitoring and says it is not aware of any misuse. The release gives no number of affected members.

High ChatGPT (reported)

Eindhoven municipality says staff uploaded files with residents' youth-care and social-support data and applicants' CVs to public AI websites such as ChatGPT

The municipality of Eindhoven in the Netherlands told its council in an information letter shared on Thursday 18 December 2025 that a sample of staff data traffic from 23 September to 23 October 2025 showed files containing personal data of residents and employees had been sent to public AI websites such as ChatGPT, according to Omroep Brabant and Binnenlands Bestuur. The files included youth-care (Jeugdwet) documents, internal reports and CVs, mostly from departments that provide care and support to residents. According to Omroep Brabant's account of findings by the advisory firm Hooghiemstra & Partners, the youth-care documents held information about the mental and physical health of minor children, and social-support (WMO) documents and applicants' CVs were also entered. The municipality reported the breach to the Dutch Data Protection Authority on 23 October, blocked public AI websites and asked OpenAI to delete the files. The council says the scale cannot be determined because the data was kept for only 30 days, so it cannot inform those affected, and that the risk of misuse is limited but cannot be ruled out. A spokesperson said OpenAI had not yet replied.

Low Fireflies.AI meeting assistant (reported)

Illinois residents allege in lawsuits that Fireflies.AI's meeting assistant captured their voiceprints without notice or consent

Four Illinois residents who say they never had Fireflies accounts allege in four federal lawsuits, two of them later consolidated, that the Fireflies.AI meeting assistant, enabled by a colleague, boss or meeting organiser, recorded their voices in Zoom or Microsoft Teams meetings between March and November 2025, analysed their vocal characteristics to tell speakers apart and generated transcripts attributing statements to them, capturing voiceprints without telling them or obtaining written consent, in breach of the Illinois Biometric Information Privacy Act. One plaintiff dismissed her case without prejudice in March 2026; the California court stayed its case at both parties’ joint request in April 2026; Fireflies has moved to dismiss the consolidated Illinois case and does not concede that it collected biometric data about the plaintiffs.

If you or someone you know is struggling, free and confidential support is available. Find a helpline near you at Signpost.

Back to all incidents