{"meta":{"exportedAt":"2026-10-12T09:11:53.705Z","formatVersion":2,"selection":{"q":"contractor","system":"","harm":"","context":"","country":"","role":"","relation":"","evidence":"","year":"2026","response":"","severity":"","verification":"","view":"incidents","sort":"added"},"totalIncidents":2,"coverage":{"cases":2,"countries":1,"languages":2,"unknownLocation":1,"locationPending":0,"unknownLanguage":0,"unknownDate":0,"lawsuits":0,"regulatory":0,"minors":0,"coreRelations":0,"contextualRelations":1,"mixedRelations":0,"unknownRelations":1,"relationPending":0,"relationUnknown":1},"countingNote":"Distinct public cases in this selection. People counts apply within individual cases only; cross-case person overlap has not been resolved. No population incidence estimate.","affectedCountNote":"Interpret person counts with affectedCountStatus and the reported effects. Unquantified zeros are placeholders, not a measured zero.","source":"AI incidents","publisher":"NOPE","url":"https://nope.net/incidents","license":"CC BY 4.0"},"incidents":[{"id":"2026-japan-health-guidance-contractor-employee-uploaded-insured-members-health-data-to-unauthorised-ai-service","caseFacts":{"claims":[{"id":"c1","status":"reported","evidence":[{"locator":"'令和８年８月 20 日、委託先におけるデータ抽出業務において、委託先担当者が個人情報を含む'; 'データを、委託先が利用を許可していない AI サービスに入力等を行ったことが判明しました。'","relation":"supports","source_id":"s1"},{"locator":"'RIZAPの特定保健指導運営事務局で、従業員がデータ抽出業務を行う際、2024年度、2025年度、2026年度にRIZAPの特定保健指導を利用した210名分の個人情報を生成AIへ参照させたことが、当該従業員の自己申告で判明したとしています。'","relation":"supports","source_id":"s2"},{"locator":"'個人で利用している外部の生成AIサービスへ、要配慮個人情報を含む顧客情報を誤ってアップロードしていたという事象です。'","relation":"supports","source_id":"s3"}],"assertion":"RIZAP reported to its client insurers that it came to light on 20 August 2026 that, in data-extraction work, one of its staff had entered data containing members' personal information into an external generative AI service the company had not authorised.","causal_attribution":"All three accounts rest on RIZAP's own report of its employee's action, relayed by each insurer and by RIZAP's release; the transfer to the AI service is admitted by the company."},{"id":"c2","status":"reported","evidence":[{"locator":"'対象者は 726 名で、対象支部は 14 支部'; '疾患情報（高血圧症、糖尿病、脂質異常症のいずれかに該当する方）'","relation":"supports","source_id":"s1"}],"assertion":"The mutual aid association says 726 of its members across 14 branches are covered, and that the data included membership numbers, email addresses, names, dates of birth and sex, some addresses and phone numbers, the type of health guidance and disease information on high blood pressure, diabetes or dyslipidaemia.","causal_attribution":"The association's count of its own members, from its notice."},{"id":"c3","status":"reported","evidence":[{"locator":"'対象は2024年度、2025年度、2026年度にRIZAPの特定保健指導を利用した210名です。'; '当該従業員の自己申告で判明したとしています。'; '9月1日、OpenAIから「当該データはモデルの学習に利用されていない」との回答を得ています。'","relation":"supports","source_id":"s2"}],"assertion":"The IHI group health insurance society reported 210 of its members, said the matter was found through the employee's self-report, and said OpenAI answered on 1 September that the data had not been used for model training.","causal_attribution":"Relayed from the society's notice by a security news site; the notice itself was not read."},{"id":"c4","status":"reported","evidence":[{"locator":"'ビスに入力等を行ったデータについて、AI サービス提供事業者による閲覧・アクセスの有無に関し'","relation":"supports","source_id":"s1"},{"locator":"'一方、IHIグループ健康保険組合は、現時点で第三者への情報漏えい等の事実は確認されていないとする一方、OpenAIによる閲覧の有無については確認を継続しています。'","relation":"supports","source_id":"s2"},{"locator":"'当該生成AIサービスの運営事業者以外の第三者に閲覧された可能性と、生成AIの学習に利用された可能性はないことを確認したとしています。'","relation":"supports","source_id":"s3"}],"assertion":"The IHI society said no third-party leak had been confirmed, and both insurers said that whether the AI provider viewed or accessed the data was still being checked; RIZAP's release says it confirmed no possibility of viewing by third parties other than the operator and no training use.","causal_attribution":"Statements by the insurers and RIZAP about the limits of the exposure; not independently verified."},{"id":"c5","status":"reported","evidence":[{"locator":"'漏えいの可能性のある対象者に対しては、委託先から令和８年９月４日１０時に電子メールによりご'","relation":"supports","source_id":"s1"}],"assertion":"RIZAP notified affected members by email on 4 September 2026.","causal_attribution":"The association's statement of the notification."}],"effects":[{"label":"insured members' identifying details and disease information entered into an external generative AI service without their knowledge (insurers' notices)","claim_id":"c1","direction":"negative"}],"sources":[{"id":"s1","url":"https://www.chikyosai.or.jp/info/pdf/info_260904.pdf","kind":"official_record","access":"read","language":"ja","translation_note":"Read in Japanese on 2026-10-12; quoted passages were translated into English by the research agent (an AI), not by a human translator. Text extracted from the PDF with pdftotext; the notice relays what RIZAP reported to the association.","independence_group":"chikyosai-notice"},{"id":"s2","url":"https://rocket-boys.co.jp/security-measures-lab/ihi-rizap-openai-210-incident/","kind":"news_report","access":"read","language":"ja","translation_note":"Read in Japanese on 2026-10-12; quoted passages were translated into English by the research agent (an AI), not by a human translator. A security news site's report of the IHI group health insurance society's 2 September notice; the society's own page was not read.","independence_group":"ihi-kenpo-notice"},{"id":"s3","url":"https://monoist.itmedia.co.jp/mn/spv/2609/18/news007.html","kind":"news_report","access":"read","language":"ja","translation_note":"Read in Japanese on 2026-10-12; quoted passages were translated into English by the research agent (an AI), not by a human translator. A columnist's description of RIZAP group's release; the release page itself rendered no text to the fetcher and was not read directly. The page was decoded from Shift_JIS.","independence_group":"rizap-group-release"}],"version":1,"ai_roles":["others_use"],"contexts":["health","work","privacy"],"unknowns":["Whether 20 August 2026 is the date the data was entered or the date it was discovered.","The total number of people across all of RIZAP's client insurers, and whether the 726 and 210 counts overlap.","Which OpenAI product and account type the employee used; RIZAP's release does not name the service.","Whether the provider's staff viewed or accessed the data.","Whether the Personal Information Protection Commission has taken any action."],"geography":{"basis":"The affected members belong to Japanese insurers; the mutual aid association lists them by Japanese prefectural branches (Iwate, Akita, Osaka and others). The notices do not state where the employee did the data-extraction work, so no event country is recorded. No court is involved.","court_countries":[],"event_countries":[],"affected_person_countries":["JP"]},"publication":{"basis":"Published under the 2026-10-06 private-information ruling: two insurers' notices describe their contractor's employee actually entering members' identifying and disease information into an external generative AI service the contractor had not authorised, without the members' knowledge. The account rests on RIZAP's own admission as relayed by its clients and its release; the provider's answer on training and the open question of provider access are recorded.","reviewed_on":"2026-10-12"},"ai_involvement":{"basis":"The insurers' notices state that a contractor's staff member entered data containing members' personal information, including disease information, into an external generative AI service the contractor had not permitted, and that the data was deleted from the service afterwards; the provider was asked to delete stored copies. The privacy harm is that transfer of members' health-guidance data to an AI service without their knowledge. The notices record transmission and a provider answer that the data was not used for training; whether provider staff viewed it was unresolved, and no generated output about the members is reported.","status":"reported"},"person_relations":["received_personal_information"]},"name":"Health-guidance contractor says an employee entered insured members' names and disease information into an unauthorised external generative AI service","summary":"A local-government employees' mutual aid association said in a notice dated 4 September 2026 that RIZAP, the company it contracts for specific health guidance, had reported that on 20 August 2026 it emerged that a RIZAP staff member, during data-extraction work, had entered data containing personal information into an external generative AI service that RIZAP did not permit. The association says 726 of its members across 14 branches are covered and lists the data as membership numbers, email addresses, names, dates of birth, sex, some addresses and phone numbers, the type of health guidance and, for members with them, high blood pressure, diabetes or dyslipidaemia. The IHI group health insurance society reported 210 of its members in a 2 September notice that, according to a security news site, names OpenAI as the provider, says the matter came to light through the employee's own report, and says OpenAI answered on 1 September that the data had not been used for model training. RIZAP's own release, as described in an ITmedia column, says the information was uploaded by mistake to a generative AI service the employee used privately, and that the company confirmed no possibility of viewing by third parties other than the service operator or of use in training. Whether the provider's staff could view the data was still being checked when the insurers published.","incidentDate":"2026-08-01","incidentKind":"single_event","incidentDatePrecision":"month","exposurePattern":"single_interaction","reportedDate":"2026-09-02","aiSystem":"An external generative AI service that the contractor had not authorised for work; RIZAP's own release calls it an external generative AI service used privately by the employee, and the IHI group health insurance society's notice, as relayed by a security news site, names OpenAI as the provider","aiProduct":"Unidentified OpenAI generative AI service (reported)","severity":"medium","verificationStatus":"credible","harmCategories":[],"harmOutcomes":["other_material_harm"],"harmOutcomeSummary":"According to notices from two client insurers, an employee of their health-guidance contractor RIZAP entered personal data on insured members, including names, birth dates, insurance numbers, contact details and, for some, high blood pressure, diabetes or dyslipidaemia, into an external generative AI service that the company had not authorised; one insurer counts 726 affected members and another 210.","frameworkFacets":[],"causationStatus":"supported","participantUsersAffectedMin":0,"otherPeopleHarmedMin":726,"affectedCountStatus":"partial","affectedCountEvidence":"One insurer's notice (a local-government employees' mutual aid association) states that 726 of its members were covered by the data entered into the AI service, across 14 branches; that is the counted minimum. A second client, the IHI group health insurance society, separately reported 210 of its members, as relayed by a security news site; these people are additional but the two lists are not shown to be disjoint, so they are left in the unquantified remainder. RIZAP's own release, as described in an ITmedia column, gives no total. The employee who entered the data is not counted.","victimAgeRange":"adult","jurisdiction":"JP","platformType":"other","outcomeStatus":"ongoing","primarySourceUrl":"https://www.chikyosai.or.jp/info/pdf/info_260904.pdf","primarySourceLabel":"Local-government employees' mutual aid association (Chikyosai), notice of 4 September 2026 on its contractor's AI-service data entry","firstPublishedAt":"2026-10-12T03:35:18.489537+00:00","updatedAt":"2026-10-12T03:35:18.489537+00:00","scopeVersion":"facts-v3","tags":["privacy","health-data","generative-ai","unauthorised-ai-use","contractor","insurance","japan","openai"]},{"id":"2026-singapore-pandan-reservoir-ai-crocodile-image-search-false-message-charges","caseFacts":{"claims":[{"id":"c1","status":"reported","evidence":[{"locator":"'water activities in the reservoir were suspended for two days, with PUB and the National Parks Board (NParks) launching search-and-capture operations in the area'; 'it had ceased search operations, and water activities in the reservoir were allowed to resume from Aug 22'; 'On Aug 20, national water agency PUB received a report of a crocodile sighting at the reservoir, accompanied by a photo'; 'On Aug 21, PUB said in a Facebook post that it had filed a police report after verifying that the photograph of the supposed crocodile was fake'","relation":"supports","source_id":"s2"},{"locator":"'The Singapore Rowing Association and Singapore Canoe Federation were told the suspend their activities'","relation":"supports","source_id":"s4"}],"assertion":"After PUB received a report of a crocodile sighting with a photo on 20 August 2026, water activities at Pandan Reservoir were suspended for two days, rowing and canoe bodies were told to suspend activities, and PUB and the National Parks Board ran search-and-capture operations until PUB found the photo fake on 21 August; activities resumed on 22 August.","causal_attribution":"PUB's own statements as reported."},{"id":"c2","status":"reported","evidence":[{"locator":"'preliminary investigations found that the man had used artificial intelligence to generate a fake image of a crocodile at Pandan Reservoir and sent it to his colleague'","relation":"supports","source_id":"s2"},{"locator":"'The man subsequently deleted the image and the related application in an attempt to conceal his actions,'","relation":"supports","source_id":"s4"}],"assertion":"Police said preliminary investigations found the man used artificial intelligence to generate the fake image, sent it to a colleague, and then deleted the image and the related application to conceal his actions.","causal_attribution":"The police statement; the allegations are untested in court."},{"id":"c3","status":"reported","evidence":[{"locator":"'allegedly sent the AI-generated image of a crocodile at Pandan Reservoir to another person on Aug 20'; 'deleted the digitally edited image and the Gemini AI application history log from his phone on Aug 21'; 'said he intends to plead guilty and will not be engaging a lawyer'; 'was charged in court on Sept 29'; 'was handed one charge for transmitting a false message, and another for obstructing the course of justice'","relation":"supports","source_id":"s1"},{"locator":"'deleting the image and the Gemini app from his phone'","relation":"context","source_id":"s5"}],"assertion":"On 29 September 2026 the 30-year-old was charged with transmitting a false message and with obstructing the course of justice; the charge sheets, as reported, say he sent the AI-generated image to another person on 20 August and deleted the image and the Gemini AI application history log from his phone on 21 August. He said he intended to plead guilty.","causal_attribution":"Court reporting of the charge sheets; the charge sheets were not read directly."},{"id":"c4","status":"reported","evidence":[{"locator":"'It then tried to verify the image using'; 'various AI checker tools'; 'with no definite results'; 'PUB acted quickly and took the necessary precautionary measures'; 'is a worker employed by its reservoir maintenance contractor'; 'supervisor had alerted PUB to the image on Aug 20'","relation":"supports","source_id":"s3"}],"assertion":"PUB said it had tried to verify the image with various AI checker tools without definite results and acted as a precaution, and that the man is employed by its reservoir maintenance contractor; his supervisor alerted PUB to the image.","causal_attribution":"PUB's 1 October Facebook post as reported by The Straits Times."}],"effects":[{"label":"water activities at a public reservoir suspended for two days and a search mounted after a fake AI image was reported","claim_id":"c1","direction":"negative"},{"label":"the worker who allegedly made the image charged with transmitting a false message and obstructing justice","claim_id":"c3","direction":"negative"}],"sources":[{"id":"s1","url":"https://www.straitstimes.com/singapore/courts-crime/man-charged-over-fake-image-of-crocodile-at-pandan-reservoir","kind":"news_report","access":"read","language":"en","translation_note":"Read live in English on 2026-10-02 (The Straits Times court desk, 29 September 2026): the charges and the charge-sheet particulars.","independence_group":"sg-court-charges"},{"id":"s2","url":"https://www.straitstimes.com/singapore/man-to-be-charged-over-fake-photo-of-crocodile-sighting-at-pandan-reservoir","kind":"news_report","access":"read","language":"en","translation_note":"Read live in English on 2026-10-02 (The Straits Times, 28 September 2026): the police statement and PUB's earlier statements.","independence_group":"spf-pub-statements"},{"id":"s3","url":"https://www.straitstimes.com/singapore/fake-image-of-crocodile-in-reservoir-put-through-ai-checks-but-results-were-inconclusive-pub","kind":"news_report","access":"read","language":"en","translation_note":"Read live in English on 2026-10-02 (The Straits Times, 1 October 2026): PUB's 1 October Facebook post on its AI checks and the man's employment.","independence_group":"spf-pub-statements"},{"id":"s4","url":"https://www.bbc.com/news/articles/c6grveg7d9zro","kind":"news_report","access":"read","language":"en","translation_note":"Read live in English on 2026-10-02 (BBC, 29 September 2026); quotes the police statement and relays local court reporting.","independence_group":"spf-pub-statements"},{"id":"s5","url":"https://www.techspot.com/news/114061-ai-image-crocodile-reservoir-triggers-search-leaves-singapore.html","kind":"news_report","access":"read","language":"en","translation_note":"Read live in English on 2026-10-02 (TechSpot, 1 October 2026); a rewrite of Singapore reporting, not independent. It attributes the Gemini app deletion to the police, whose statement names no application.","independence_group":"sg-court-charges"}],"version":1,"ai_roles":["own_use"],"contexts":["public_services","justice","work"],"unknowns":["Why the image was made and how it passed from the colleague to the supervisor and PUB.","The outcome of the case when it returns to court in November.","The public cost of the search operations."],"geography":{"basis":"Pandan Reservoir is in Singapore; PUB and the National Parks Board responded there, and the man was charged in a Singapore court (The Straits Times; BBC). He is a Myanmar national working in Singapore; his nationality does not change the event location.","court_countries":["SG"],"event_countries":["SG"],"affected_person_countries":["SG"]},"publication":{"basis":"Published under the 2026-09-15 charter as a case of an AI-generated false image that triggered a two-day public-safety response by a national agency and led to criminal charges against the person who allegedly made it. The facts rest on PUB and police statements and court reporting. The accused is not named here.","reviewed_on":"2026-10-02"},"ai_involvement":{"basis":"The police said preliminary investigations found the man used artificial intelligence to generate the image (The Straits Times; BBC). The charge sheets, as reported by The Straits Times, say he deleted the image and the Gemini AI application history log from his phone. PUB said its AI checker tools gave no definite result before it found the photo fake. The image was not inspected and the court has not ruled.","status":"reported"},"person_relations":["unknown"]},"name":"Singapore: an AI-generated photo of a crocodile at Pandan Reservoir led PUB to suspend water activities and search the reservoir in August 2026; a contractor's worker who allegedly made it was charged with transmitting a false message and with obstructing justice for allegedly deleting the image and the Gemini app history","summary":"On 20 August 2026 Singapore's national water agency PUB received a report of a crocodile sighting at Pandan Reservoir, with a photo. PUB said it tried to verify the image with several AI checker tools without a definite result, so it suspended water activities, told the Singapore Rowing Association and Singapore Canoe Federation to stop all activities there, put up warning signs and, with the National Parks Board, ran search-and-capture operations. On 21 August PUB found the photo was fake, stopped searching and filed a police report; water activities resumed on 22 August. Police said on 28 September that preliminary investigations found a man had used artificial intelligence to generate the image, sent it to a colleague, and then deleted the image and the related application to conceal his actions. On 29 September the 30-year-old, a worker employed by PUB's reservoir maintenance contractor, was charged with transmitting a false message and with obstructing the course of justice; the charge sheets, as reported by The Straits Times, say he deleted the image and the Gemini AI application history log from his phone on 21 August. He told the court he intended to plead guilty, and the case returns to court in November.","incidentDate":"2026-08-20","incidentKind":"single_event","incidentDatePrecision":"day","exposurePattern":"unknown","reportedDate":"2026-09-28","aiSystem":"AI-generated image of a crocodile at Pandan Reservoir; the charge sheets as reported refer to the Gemini AI application history log the accused deleted","aiProduct":"Gemini (reported)","aiCompany":"Google","severity":"low","verificationStatus":"credible","harmCategories":[],"harmOutcomes":["legal_harm","other_material_harm"],"harmOutcomeSummary":"An AI-generated crocodile photo led PUB to suspend water activities and search Pandan Reservoir for two days, and the worker who allegedly made and shared it now faces charges carrying up to three and seven years' jail (PUB and police statements and court reporting via The Straits Times and the BBC).","frameworkFacets":[],"causationStatus":"alleged","participantUsersAffectedMin":1,"otherPeopleHarmedMin":0,"affectedCountStatus":"exact","affectedCountEvidence":"One person, the man charged over the image (The Straits Times; BBC). Reservoir users whose activities were suspended are not individually reported and are not counted. Exact 1.","victimAgeRange":"adult","jurisdiction":"SG","platformType":"assistant","outcomeType":"criminal_charges","outcomeStatus":"ongoing","primarySourceUrl":"https://www.straitstimes.com/singapore/courts-crime/man-charged-over-fake-image-of-crocodile-at-pandan-reservoir","primarySourceLabel":"The Straits Times, 29 September 2026: Man charged over fake image of crocodile at Pandan Reservoir","firstPublishedAt":"2026-10-02T03:15:06.027318+00:00","updatedAt":"2026-10-02T03:15:06.027318+00:00","scopeVersion":"facts-v3","tags":["ai-generated-images","hoax","false-message","public-services","criminal-charges","gemini","singapore"]}]}