{"meta":{"exportedAt":"2026-10-23T08:49:28.443Z","formatVersion":2,"selection":{"q":"bc","system":"","harm":"","context":"","country":"","role":"","relation":"contextual","evidence":"","year":"2025","response":"","severity":"","verification":"","view":"incidents","sort":"added"},"totalIncidents":3,"coverage":{"cases":3,"countries":3,"languages":1,"unknownLocation":0,"locationPending":0,"unknownLanguage":0,"unknownDate":0,"lawsuits":0,"regulatory":1,"minors":0,"coreRelations":0,"contextualRelations":3,"mixedRelations":0,"unknownRelations":0,"relationPending":0,"relationUnknown":0},"countingNote":"Distinct public cases in this selection. People counts apply within individual cases only; cross-case person overlap has not been resolved. No population incidence estimate.","affectedCountNote":"Interpret person counts with affectedCountStatus and the reported effects. Unquantified zeros are placeholders, not a measured zero.","source":"AI incidents","publisher":"NOPE","url":"https://nope.net/incidents","license":"CC BY 4.0"},"incidents":[{"id":"2025-nova-scotia-google-ai-overview-musician-sex-offender-summary-concert-cancelled","caseFacts":{"claims":[{"id":"c1","status":"reported","evidence":[{"locator":"They had read online, Mr. MacIsaac was told, that he had convictions related to internet luring and sexual assault.","relation":"supports","source_id":"s1"},{"locator":"That information is not true","relation":"supports","source_id":"s1"},{"locator":"the summary falsely asserted he had been convicted of a series of offences including sexual assault","relation":"supports","source_id":"s2"},{"locator":"returned a result that said he had been “convicted of sexual assault.”","relation":"supports","source_id":"s1"}],"assertion":"MacIsaac says a Google AI-generated search summary described him as having convictions for sexual offences including internet luring and sexual assault, and that this was untrue.","causal_attribution":"MacIsaac's account relayed by two outlets. The Globe adds that the only public record of a run-in with the law it found is a cannabis discharge. The summary was not inspected. The Globe reporter saw a Google result stating 'convicted of sexual assault' on a query that included the other man's town; that result was seen after the first amendments and may differ from what the First Nation read."},{"id":"c2","status":"reported","evidence":[{"locator":"its leadership had changed their mind","relation":"supports","source_id":"s1"},{"locator":"this situation was the result of mistaken identity caused by an AI error","relation":"supports","source_id":"s1"},{"locator":"had cancelled one of his concerts planned for Dec. 19","relation":"supports","source_id":"s2"},{"locator":"the cancellation was based on incorrect information","relation":"supports","source_id":"s2"},{"locator":"We deeply regret the harm this error caused to your reputation, your livelihood, and your sense of personal safety","relation":"supports","source_id":"s1"}],"assertion":"The Sipekne'katik First Nation cancelled MacIsaac's concert planned for 19 December 2025 after learning of the summary, then apologised in writing and said the cancellation was based on incorrect information.","causal_attribution":"The apology letter (seen by the Globe) and an online post (cited by Global News) are the First Nation's own statements. The First Nation did not respond to the Globe's requests for comment."},{"id":"c3","status":"reported","evidence":[{"locator":"blending MacIsaac’s biography with that of another man","relation":"supports","source_id":"s1"},{"locator":"the inaccurate claims were taken from online articles regarding a man in Atlantic Canada with the same last name","relation":"supports","source_id":"s2"}],"assertion":"The false information was the result of the AI summary blending MacIsaac's biography with that of another man in Atlantic Canada with the same last name.","causal_attribution":"The Globe states the blending in its own voice. Global News attributes the origin to MacIsaac."},{"id":"c4","status":"reported","evidence":[{"locator":"The fiddler says the ordeal left him worried for his safety","relation":"supports","source_id":"s1"},{"locator":"He’s also concerned about work he may have lost without realizing it","relation":"supports","source_id":"s1"},{"locator":"I feared for my own safety going on stage because of what I was labelled as.","relation":"supports","source_id":"s3"}],"assertion":"MacIsaac says the episode left him worried for his safety and concerned that other venues may have declined to book him without telling him.","causal_attribution":"MacIsaac's own account. Lost work beyond the one concert is his speculation."},{"id":"c5","status":"reported","evidence":[{"locator":"Google has amended search results for the musician","relation":"supports","source_id":"s1"},{"locator":"we use those examples to improve our systems, and may take action under our policies","relation":"supports","source_id":"s1"}],"assertion":"Google amended the search results for MacIsaac. A Google spokesperson said AI Overviews change frequently and that Google uses examples of misinterpreted content to improve its systems.","causal_attribution":"Globe reporting and a Google statement. The exact edits were not inspected."},{"id":"c6","status":"reported","evidence":[{"locator":"In a statement of claim filed in February with the Ontario Superior Court of Justice","relation":"supports","source_id":"s3"},{"locator":"None of the claims in the document has been tested in court.","relation":"supports","source_id":"s3"},{"locator":"claiming the online giant defamed him by falsely identifying him as a sex offender in an AI-generated summary","relation":"supports","source_id":"s3"},{"locator":"Google is also liable for injuries and losses arising from the AI overview's defective design","relation":"supports","source_id":"s3"},{"locator":"MacIsaac is seeking $1.5 million in damages from Google LLC.","relation":"supports","source_id":"s3"}],"assertion":"In February 2026 MacIsaac filed a statement of claim in the Ontario Superior Court of Justice alleging defamation and defective design and seeking damages of 1.5 million from Google LLC (US dollars in the Globe and Mail copy of the Canadian Press story, no currency stated in the CBC copy). Its claims have not been tested in court.","causal_attribution":"News paraphrase of the statement of claim (Canadian Press, relayed by CBC, the Globe and Billboard Canada). The claim itself was not inspected. The Globe copy of the wire story gives US dollars and the CBC copy gives no currency."}],"effects":[{"label":"Concert cancelled and reputational harm after a false AI-generated summary","claim_id":"c2","direction":"negative"},{"label":"Reported fear for personal safety and possible unnoticed lost work","claim_id":"c4","direction":"negative"}],"sources":[{"id":"s1","url":"https://www.theglobeandmail.com/culture/article-ashley-macisaac-show-cancelled-google-ai-misinformation-music-fiddler/","kind":"national_news","access":"read","language":"en","translation_note":"","independence_group":"globe-and-mail-dec-2025"},{"id":"s2","url":"https://globalnews.ca/news/11589560/ashley-macissac-ai-content-accusation/amp","kind":"national_news","access":"read","language":"en","translation_note":"","independence_group":"canadian-press-2025-12"},{"id":"s3","url":"https://www.cbc.ca/news/canada/nova-scotia/cape-breton-fiddler-ashley-macisaac-lawsuit-against-google-9.7187490","kind":"national_news","access":"read","language":"en","translation_note":"","independence_group":"canadian-press-2026-05-lawsuit"},{"id":"s4","url":"https://www.theglobeandmail.com/culture/music/article-ashley-macisaac-lawsuit-google-ai-error-sex-offender/","kind":"national_news","access":"read","language":"en","translation_note":"","independence_group":"canadian-press-2026-05-lawsuit"},{"id":"s5","url":"https://ca.billboard.com/business/legal/ashley-macisaac-google-lawsuit","kind":"trade_press","access":"read","language":"en","translation_note":"","independence_group":"canadian-press-2026-05-lawsuit"}],"version":1,"ai_roles":["institutional_use","others_use"],"contexts":["work","everyday_life"],"unknowns":["The AI Overview text the First Nation read was not preserved in the inspected sources (the Globe reporter saw a later result with a similar statement), and its content changed over time.","Exact date of the cancellation (the concert was planned for 19 December 2025).","Whether any other booking was lost (MacIsaac speculates, including about a concert in Mexico earlier in 2025).","Currency of the claimed damages (US dollars in one copy of the wire story, unstated in another).","The statement of claim was not read. Google's defence and the lawsuit outcome are unknown."],"geography":{"basis":"The concert was planned with the Sipekne'katik First Nation, described as north of Halifax (Nova Scotia is named by Billboard Canada). The statement of claim was filed in the Ontario Superior Court of Justice. The country of residence of the affected person is not stated, so it is left unknown.","court_countries":["CA"],"event_countries":["CA"],"affected_person_countries":[]},"publication":{"basis":"Named public figure who is the subject. Two December 2025 outlets and May 2026 lawsuit coverage report a concrete cancelled concert and reputational harm traced to a Google AI-generated summary. The First Nation's written apology and Google's response are reported. Lawsuit claims remain allegations.","reviewed_on":"2026-09-29"},"ai_involvement":{"basis":"The Globe and Mail states the false description was the result of Google's AI-generated search summary blending MacIsaac's biography with that of another man. Google's spokesperson statement refers to AI Overviews generally and does not address this summary. The summary itself was not inspected and its content changed over time.","status":"reported"},"person_relations":["made_claim_about"]},"name":"Google AI Overview reportedly described fiddler Ashley MacIsaac as a convicted sex offender, and a concert was cancelled","summary":"In December 2025 Cape Breton fiddler Ashley MacIsaac said a First Nation north of Halifax cancelled his concert planned for 19 December after reading a Google AI-generated search summary that said he had convictions for sexual offences. He says the statements were false and came from online articles about another man in Atlantic Canada with the same last name. The First Nation apologised in writing and Google amended the search results. MacIsaac says he feared for his safety and worries about other lost work. In a statement of claim filed in February 2026 in the Ontario Superior Court of Justice he seeks damages of 1.5 million from Google (US dollars in the Globe and Mail copy of the Canadian Press story, no currency stated in the CBC copy). None of its claims has been tested in court, and the claim says Google did not admit responsibility.","incidentDate":"2025-12-01","incidentKind":"single_event","incidentDatePrecision":"month","exposurePattern":"unknown","reportedDate":"2025-12-23","aiSystem":"Google Search AI Overviews","aiProduct":"Google AI Overviews","aiCompany":"Google","severity":"medium","verificationStatus":"unverified","harmCategories":[],"harmOutcomes":["reputational_harm","professional_harm","psychological_distress"],"harmOutcomeSummary":"MacIsaac reports a cancelled concert, damage to his reputation and livelihood, fear for his safety and possible unnoticed lost bookings after the AI summary said he had convictions for sexual offences (his account, plus the First Nation's apology letter).","frameworkFacets":[],"causationStatus":"alleged","participantUsersAffectedMin":0,"otherPeopleHarmedMin":1,"affectedCountStatus":"exact","affectedCountEvidence":"One person, the musician, is reported harmed. The other man with the same last name is reported as the source of the mixed-up information and no harm to him is reported. The First Nation is not counted.","victimAgeRange":"adult","platformType":"other","primarySourceUrl":"https://www.theglobeandmail.com/culture/article-ashley-macisaac-show-cancelled-google-ai-misinformation-music-fiddler/","primarySourceLabel":"The Globe and Mail, 23 December 2025","firstPublishedAt":"2026-09-29T13:29:04.774728+00:00","updatedAt":"2026-09-30T01:17:12.421073+00:00","scopeVersion":"facts-v3","tags":["historical-2025"]},{"id":"2025-new-york-union-square-facial-recognition-false-arrest-two-days-jail","caseFacts":{"claims":[{"id":"c1","status":"reported","evidence":[{"locator":"After his mug shot was generated as a possible match to the offender in an indecent exposure case, he was arrested and spent two days in jail in April before the charges against him were dropped in July.","relation":"supports","source_id":"s2"},{"locator":"was falsely arrested and jailed for two days despite not matching the physical description given by the victim of a sex crime.","relation":"supports","source_id":"s1"},{"locator":"Prosecutors dismissed the case last month after ... public defenders, the Legal Aid Society, were able to prove he was falsely identified.","relation":"supports","source_id":"s1"}],"assertion":"An indecent exposure suspect search produced a possible facial recognition match to the affected man, who was arrested in April 2025, jailed for two days and charged. Prosecutors dismissed the case in July 2025.","causal_attribution":"The reporting attributes the arrest to the facial recognition possible match followed by police decisions (a photo lineup and the arrest). The inspected sources do not establish what other evidence the police relied on."},{"id":"c2","status":"reported","evidence":[{"locator":"\"The man they were looking for, he was eight inches shorter than me and 70 pounds lighter.\"","relation":"supports","source_id":"s1"},{"locator":"Location data from his cell phone showed that ... was miles away from the crime, the New York Times first reported.","relation":"supports","source_id":"s1"}],"assertion":"The man reports that the suspect was eight inches shorter and 70 pounds lighter than him, and reports say location data from his phone placed him miles from the crime.","causal_attribution":"Physical and location discrepancies are the man's account and a relayed New York Times report. The New York Times article was not readable and the phone data was not inspected."},{"id":"c3","status":"reported","evidence":[{"locator":"for NYPD investigators to make the decision to place him in a photo lineup, which was then shown to the victim, who misidentified him.","relation":"supports","source_id":"s2"}],"assertion":"A victim was shown a photo lineup that included the man and misidentified him.","causal_attribution":"Hell Gate summarises the New York Times account. Its chain traces to the same original reporting as the New York Times article that was not readable here."},{"id":"c4","status":"reported","evidence":[{"locator":"\"I was in the process of becoming a correctional officer at Rikers Island,\" he told Eyewitness News.","relation":"supports","source_id":"s1"},{"locator":"But after his arrest, he says \"they kind of froze the hiring process.\"","relation":"supports","source_id":"s1"}],"assertion":"The man says he was in the process of becoming a correctional officer and that after his arrest they \"kind of froze the hiring process.\"","causal_attribution":"Single first-person account relayed by one outlet. No employer statement was inspected and the current hiring status is unknown."},{"id":"c5","status":"reported","evidence":[{"locator":"\"even if there is a possible match, the NYPD cannot and will never make an arrest solely using facial recognition technology.\"","relation":"supports","source_id":"s1"}],"assertion":"The NYPD stated that even with a possible facial recognition match it cannot and will never make an arrest solely using facial recognition technology.","causal_attribution":"Police statement relayed by ABC7. It bears on how the match was used and does not address this arrest specifically."},{"id":"c6","status":"reported","evidence":[{"locator":"On Monday, the Legal Aid Society sent a letter to the City's Department of Investigation urging the agency to open a probe into the NYPD's use of facial recognition technology","relation":"supports","source_id":"s2"},{"locator":"who was wrongfully arrested  based on a false facial recognition match","relation":"context","source_id":"s3"}],"assertion":"The Legal Aid Society wrote to the city Department of Investigation asking it to investigate NYPD facial recognition use after this and other false arrests.","causal_attribution":"Advocacy response. Legal Aid statements are the organisation's allegations."}],"effects":[{"label":"Arrest and two days in jail after a facial recognition possible match, case later dismissed","claim_id":"c1","direction":"negative"}],"sources":[{"id":"s1","url":"https://abc7ny.com/post/man-falsely-jailed-nypds-facial-recognition-surveillance-tech-failed/17664671/","kind":"news","access":"read","language":"en","translation_note":"","independence_group":"abc7-interview"},{"id":"s2","url":"https://hellgatenyc.com/legal-aid-investigation-nypd-facial-recognition/","kind":"news","access":"read","language":"en","translation_note":"","independence_group":"nyt-original-account"},{"id":"s3","url":"https://legalaidnyc.org/news/demands-ban-nypd-facial-recognition-technology/","kind":"advocacy_statement","access":"read","language":"en","translation_note":"","independence_group":"legal-aid"},{"id":"s4","url":"https://www.nytimes.com/2025/08/26/nyregion/nypd-facial-recognition-dismissed-case.html","kind":"news","access":"unavailable","language":"en","translation_note":"","independence_group":"nyt-original-account"}],"version":1,"ai_roles":["institutional_use"],"contexts":["justice","work"],"unknowns":["The New York Times article could not be read, so details attributed to it are relayed second-hand.","The facial recognition product, the source of the comparison photo and the match score are unknown.","The Hell Gate article is behind a subscriber paywall after its opening paragraphs; only the visible text was inspected.","The date of the facial recognition search and match (between the 10 February offense and the April arrest) is not stated in the inspected sources; the incident date is the reported arrest month.","The exact arrest day, the court and the dismissal date are not stated in the inspected sources.","Whether the correctional officer hiring process resumed is unknown.","Which evidence besides the possible match supported the arrest and lineup is unknown."],"geography":{"basis":"ABC7 places the offense in Manhattan's Union Square and the arrest by the NYPD. The man's residence and the court are not stated in the inspected sources.","court_countries":[],"event_countries":["US"],"affected_person_countries":[]},"publication":{"basis":"ABC7 New York and a Legal Aid Society release were read in full. Hell Gate was read only as far as its subscriber paywall allows. The New York Times original was blocked (HTTP 403 and reader relays) and is cited unread. Claims are attributed and left at reported status. The affected person is not named.","reviewed_on":"2026-09-29"},"ai_involvement":{"basis":"Hell Gate and ABC7 report the arrest followed a facial recognition possible match. The system, the search image and the match output were not produced, and the New York Times original was not readable.","status":"reported"},"person_relations":["made_claim_about"]},"name":"New York: man misidentified through facial recognition in an indecent exposure case arrested and jailed two days","summary":"Reporting from August 2025 says an NYPD facial recognition search of images from a February 2025 indecent exposure in Manhattan's Union Square produced a possible match to a man who did not fit the described suspect. The man was placed in a photo lineup, arrested in April 2025 and jailed for two days. Prosecutors dismissed the case in July 2025 after his public defenders showed he was misidentified. The man says the process of becoming a correctional officer 'kind of' froze after the arrest. The NYPD says it never arrests solely on a facial recognition match.","incidentDate":"2025-04-01","incidentKind":"single_event","incidentDatePrecision":"month","exposurePattern":"unknown","reportedDate":"2025-08-26","aiSystem":"NYPD facial recognition system (product and vendor not identified in the inspected sources)","aiProduct":"Unidentified facial recognition system","severity":"medium","verificationStatus":"unverified","harmCategories":[],"harmOutcomes":["loss_of_liberty","professional_harm"],"harmOutcomeSummary":"ABC7 and Hell Gate report the man was arrested and jailed for two days before prosecutors dismissed the case, and the man says a correctional officer hiring process 'kind of' froze after the arrest.","frameworkFacets":[],"causationStatus":"alleged","participantUsersAffectedMin":0,"otherPeopleHarmedMin":1,"affectedCountStatus":"exact","affectedCountEvidence":"One man reported arrested and jailed. The offense victim and other people are not counted as harmed by the AI.","victimAgeRange":"adult","platformType":"other","primarySourceUrl":"https://abc7ny.com/post/man-falsely-jailed-nypds-facial-recognition-surveillance-tech-failed/17664671/","primarySourceLabel":"ABC7 New York (27 Aug 2025)","firstPublishedAt":"2026-09-29T12:42:09.552414+00:00","updatedAt":"2026-09-30T01:17:11.583854+00:00","scopeVersion":"facts-v3","tags":["historical-2025"]},{"id":"2025-nsw-resilient-homes-program-applicant-data-uploaded-to-chatgpt","caseFacts":{"claims":[{"id":"c1","status":"reported","evidence":[{"locator":"Some personal information provided by people during the RHP applications process was uploaded by a former temporary employee of the RA to the AI platform, ChatGPT.","relation":"supports","source_id":"s1"},{"locator":"The data shared was contained in a Microsoft Excel spreadsheet with 10 columns and more than 12,000 rows of information.","relation":"supports","source_id":"s1"},{"locator":"The upload took place between 12 and 15 March 2025.","relation":"supports","source_id":"s1"},{"locator":"This incident occurred when a former temporary employee uploaded information from a Microsoft Excel spreadsheet to an unauthorised third-party AI platform, ChatGPT.","relation":"supports","source_id":"s1"},{"locator":"Between 12 and 15 March 2025, personal information was uploaded by a former contractor of the RA to the Artificial Intelligence platform ChatGPT.","relation":"supports","source_id":"s4"},{"locator":"\"Personal information was uploaded by a former contractor of the RA to the artificial intelligence platform ChatGPT,\" an RA spokesperson said.","relation":"supports","source_id":"s2"},{"locator":"The authority said in a breach notice that the upload “was not authorised”.","relation":"supports","source_id":"s3"}],"assertion":"Between 12 and 15 March 2025 a former temporary staff member (called a former contractor in the first notice) of the NSW Reconstruction Authority uploaded a Microsoft Excel spreadsheet of Northern Rivers Resilient Homes Program information (10 columns, more than 12,000 rows) to ChatGPT; the Authority says the upload was not authorised and was not a cyber-attack.","causal_attribution":"The Authority's own notices report the upload, its dates and its unauthorised status; the ABC and iTnews relay those notices. The uploader's role is a former temporary staff member on the current page and a former contractor in the first notice and the press."},{"id":"c2","status":"reported","evidence":[{"locator":"2031 people who provided information to the RA for the RHP had some of their data uploaded to ChatGPT.","relation":"supports","source_id":"s1"},{"locator":"Name and contact details","relation":"supports","source_id":"s1"},{"locator":"Residential/mailing address","relation":"supports","source_id":"s1"},{"locator":"Date of birth","relation":"supports","source_id":"s1"},{"locator":"Sensitive personal information","relation":"supports","source_id":"s1"},{"locator":"Sensitive health information","relation":"supports","source_id":"s1"},{"locator":"Limited financial commentary, but not banking or financial details","relation":"supports","source_id":"s1"},{"locator":"no driver's licence numbers, Medicare numbers, passport numbers, or Tax File Numbers were disclosed in the breach.","relation":"supports","source_id":"s1"},{"locator":"Up to 3000 individuals may be impacted by the breach.","relation":"supports","source_id":"s4"},{"locator":"The breach shared the names and addresses of program applicants, as well as email addresses, phone numbers, and other personal and health information.","relation":"supports","source_id":"s2"}],"assertion":"The Authority says external forensic analysis confirmed that 2031 people who provided information for the program had some of their data uploaded to ChatGPT, including name and contact details, residential or mailing address, date of birth, sensitive personal and health information and limited financial commentary, and that no driver licence, Medicare, passport or Tax File Numbers were disclosed; its first notice had estimated up to 3000 people.","causal_attribution":"The Authority's statements report the count and data categories from its forensic analysis; the ABC relays the first notice's categories."},{"id":"c3","status":"reported","evidence":[{"locator":"There is no evidence that any of the uploaded data is publicly available online or has been accessed by a third party at this stage.","relation":"supports","source_id":"s1"},{"locator":"We believe the risk of misuse is low","relation":"supports","source_id":"s1"},{"locator":"There is no evidence that any information has been made public, however this cannot be ruled out","relation":"supports","source_id":"s4"}],"assertion":"The Authority says there is no evidence that the uploaded data is publicly available online or has been accessed by a third party; its first notice said this could not be ruled out, and it assesses the risk of misuse as low.","causal_attribution":"The Authority's own assessment. Whether OpenAI retained, deleted or used the uploaded data is not addressed in the inspected sources."},{"id":"c4","status":"reported","evidence":[{"locator":"we are deeply sorry for the distress it may cause for those involved in the program.","relation":"supports","source_id":"s1"},{"locator":"I feel concerned — the information with the RA was deeply personal,","relation":"supports","source_id":"s2"}],"assertion":"The Authority apologised for the distress the breach may cause, and a program participant whose flooded home was bought back told the ABC the information held by the Authority was deeply personal and that they felt concerned.","causal_attribution":"The concern is one participant's stated reaction; the ABC does not say whether this person is among the 2031. No identity misuse or other realised loss is reported."},{"id":"c5","status":"reported","evidence":[{"locator":"We are working with Social Futures to reach out to people who have been impacted and ID Support NSW, a government identity and cyber security support service, to assist anyone whose data may have been compromised.","relation":"supports","source_id":"s1"},{"locator":"The NSW Reconstruction Authority will provide compensation for any reasonable out of pocket expenses if any compromised identity documents need to be replaced.","relation":"supports","source_id":"s4"}],"assertion":"The Authority contacted affected people with ID Support NSW and Social Futures to offer support, and said it would compensate reasonable out-of-pocket expenses if compromised identity documents needed replacing.","causal_attribution":"The Authority's statements about its response."},{"id":"c6","status":"reported","evidence":[{"locator":"We are working with Cyber Security NSW to monitor the internet and dark web to see if any of this information is accessible online. The NSW Privacy Commissioner has also been notified.","relation":"supports","source_id":"s1"},{"locator":"The RA has also implemented controls to block the upload of personal information into AI tools.","relation":"supports","source_id":"s1"},{"locator":"An independent review into the data breach has now been completed, identifying several areas for improvement in RA’s governance, training and data security practices.","relation":"supports","source_id":"s1"}],"assertion":"The Authority notified the NSW Privacy Commissioner, had Cyber Security NSW monitor the internet and dark web, implemented controls to block the upload of personal information into AI tools, and completed an independent review that identified areas for improvement in its governance, training and data security practices.","causal_attribution":"The Authority's own account of its response; the review report itself was not inspected."},{"id":"c7","status":"reported","evidence":[{"locator":"The AI-related data breach was disclosed on what is a public holiday Monday in NSW, although it actually occurred over six months ago, between March 12 and 15.","relation":"supports","source_id":"s3"},{"locator":"said she received a preliminary report about the breach in July, and the final report on Friday.","relation":"supports","source_id":"s2"},{"locator":"\"I would prefer [for the RA] to advise people sooner, and I'm also informed they couldn't identify everybody, but I need to see the report first,\" she said.","relation":"supports","source_id":"s2"}],"assertion":"The breach was disclosed publicly on 6 October 2025, more than six months after the upload; the NSW Minister for Recovery told the ABC she had received a preliminary report about the breach in July and would have preferred people to be advised sooner.","causal_attribution":"iTnews's own observation of the disclosure timing and the Minister's statement to the ABC; the Authority attributes the delay to the time needed to identify affected people."}],"effects":[{"label":"personal and sensitive information of 2031 Resilient Homes Program participants was uploaded to ChatGPT without authorisation","claim_id":"c2","direction":"negative"},{"label":"a program participant reports concern about the deeply personal information held; the Authority apologised for possible distress","claim_id":"c4","direction":"negative"}],"sources":[{"id":"s1","url":"https://www.nsw.gov.au/departments-and-agencies/nsw-reconstruction-authority/resilient-homes-program-data-breach","kind":"official_statement","access":"read","language":"en","translation_note":"English original; full body read by curl on 2026-10-11 (page last updated 26 March 2026, with the 9 December 2025 update and FAQ on the same page).","independence_group":"nsw-ra-statement"},{"id":"s2","url":"https://www.abc.net.au/news/2025-10-06/data-breach-northern-rivers-resilient-homes-program-chatgpt/105855284","kind":"news_report","access":"read","language":"en","translation_note":"English original; full body read by curl on 2026-10-11. Relays the Authority statement; the participant and the Minister were interviewed separately within the same article.","independence_group":"nsw-ra-statement"},{"id":"s3","url":"https://www.itnews.com.au/news/nsw-gov-contractor-uploaded-excel-spreadsheet-of-flood-victims-data-to-chatgpt-620815","kind":"news_report","access":"read","language":"en","translation_note":"English original; full body read by curl on 2026-10-11. Relays the Authority breach notice; the disclosure-timing observation is the outlet's own.","independence_group":"nsw-ra-statement"},{"id":"s4","url":"https://www.nsw.gov.au/departments-and-agencies/nsw-reconstruction-authority/media-releases/northern-rivers-resilient-homes-program-data-breach","kind":"official_statement","access":"read","language":"en","translation_note":"English original; full body read by curl on 2026-10-11. Authority departmental release of the first notice, 6 October 2025.","independence_group":"nsw-ra-statement"}],"version":1,"ai_roles":["institutional_use"],"contexts":["privacy","public_services"],"unknowns":["Why the staff member uploaded the spreadsheet and what, if anything, was asked of ChatGPT; no ChatGPT output is described.","Whether OpenAI retained, deleted or used the uploaded data for training; the sources establish the upload to the service only.","Whether any participant suffered identity misuse or other realised loss; none is reported.","Whether the uploader was a temporary staff member or a contractor (the Authority uses both terms), and how many separate uploads occurred between 12 and 15 March 2025.","The findings of the independent review beyond the Authority's summary of it."],"geography":{"basis":"The data was held by the NSW Reconstruction Authority, a New South Wales government agency, and was uploaded by a former temporary staff member of that agency; the Authority describes the incident as a breach of its program data. The ABC describes the affected people as northern NSW residents of the Northern Rivers region. No court is involved.","court_countries":[],"event_countries":["AU"],"affected_person_countries":["AU"]},"publication":{"basis":"The Authority's notices, read in full on 2026-10-11, state that a staff member uploaded program participants' personal and sensitive information to ChatGPT without authorisation and that forensic analysis confirmed 2031 affected people. The disclosure of their information to a generative AI service without their knowledge is the recorded privacy harm. The upload rests on the Authority's own account, which the press relayed; no retention, training, public exposure or misuse is established. The uploader and affected people are not named.","reviewed_on":"2026-10-11"},"ai_involvement":{"basis":"The Authority states that a former temporary staff member uploaded a spreadsheet of program information to ChatGPT between 12 and 15 March 2025, that the upload was not authorised, and that forensic analysis confirmed 2031 people had some of their data uploaded. The reported transfer of their personal and sensitive information into the generative AI service is the AI connection to the privacy harm. This establishes the upload only. It does not establish retention by OpenAI, use for training, public exposure or a finding of illegality, and no ChatGPT output affecting participants is described.","status":"supported"},"person_relations":["received_personal_information"]},"name":"NSW Reconstruction Authority says a former temporary staff member uploaded 2031 Resilient Homes participants' personal data to ChatGPT without authorisation","summary":"The NSW Reconstruction Authority says that between 12 and 15 March 2025 a former temporary staff member (called a former contractor in its first notice) uploaded a Microsoft Excel spreadsheet of Northern Rivers Resilient Homes Program information, 10 columns and more than 12,000 rows, to ChatGPT, an AI platform the Authority had not authorised. The Authority disclosed the breach on 6 October 2025, estimating that up to 3000 people were affected, and later said external forensic analysis confirmed that 2031 people had some of their data uploaded, including names, contact details, addresses, dates of birth, sensitive personal and health information and limited financial commentary. It says no driver licence, Medicare, passport or Tax File Numbers were disclosed and that there is no evidence the data is publicly available or was accessed by a third party; whether OpenAI retained or used the data is not addressed. The Authority apologised, contacted affected people with ID Support NSW, offered to compensate the replacement of compromised identity documents and notified the NSW Privacy Commissioner. A program participant told the ABC the information was deeply personal and that they felt concerned. No misuse of the data is reported.","incidentDate":"2025-03-12","incidentEndDate":"2025-03-15","incidentKind":"bounded_series","incidentDatePrecision":"range","exposurePattern":"unknown","reportedDate":"2025-10-06","aiSystem":"ChatGPT (OpenAI), used through an unauthorised upload of program data by a person working for the NSW Reconstruction Authority","aiProduct":"ChatGPT","aiCompany":"OpenAI","severity":"low","verificationStatus":"credible","harmCategories":[],"harmOutcomes":["other_material_harm"],"harmOutcomeSummary":"The NSW Reconstruction Authority reports that personal and sensitive information of 2031 Resilient Homes Program participants was uploaded to ChatGPT without authorisation, a loss of privacy for those people; it reports no evidence of public exposure or third-party access, and no misuse is reported (the Authority's notices and press coverage relaying them).","frameworkFacets":[],"causationStatus":"alleged","participantUsersAffectedMin":0,"otherPeopleHarmedMin":2031,"affectedCountStatus":"exact","affectedCountEvidence":"The Authority states that external forensic analysis confirmed 2031 people had some of their data uploaded to ChatGPT. The upload of their personal information to the AI service is itself the privacy harm recorded, so those 2031 people are counted as other people harmed. The first notice's estimate of up to 3000 is not used; the 12,000 rows are rows, not people. The participant quoted by the ABC is not separately counted because the ABC does not say whether that person is among the 2031. The uploader is not counted.","victimAgeRange":"unknown","jurisdiction":"AU-NSW","platformType":"chatbot","outcomeType":"investigation_opened","outcomeStatus":"resolved","primarySourceUrl":"https://www.nsw.gov.au/departments-and-agencies/nsw-reconstruction-authority/resilient-homes-program-data-breach","primarySourceLabel":"NSW Reconstruction Authority, updated 26 March 2026: Resilient Homes Program data breach","firstPublishedAt":"2026-09-29T12:41:19.196147+00:00","updatedAt":"2026-10-11T03:10:38.11789+00:00","scopeVersion":"facts-v3","tags":["historical-2025"]}]}