{"meta":{"exportedAt":"2026-09-30T05:36:30.084Z","formatVersion":2,"selection":{"q":"evidence","system":"","harm":"","context":"","country":"","role":"","relation":"","evidence":"","year":"","response":"regulatory","severity":"","verification":"","view":"incidents","sort":"added"},"totalIncidents":2,"coverage":{"cases":2,"countries":2,"languages":2,"unknownLocation":0,"locationPending":0,"unknownLanguage":0,"unknownDate":0,"lawsuits":0,"regulatory":2,"minors":0,"coreRelations":1,"contextualRelations":0,"mixedRelations":0,"unknownRelations":1,"relationPending":0,"relationUnknown":1},"countingNote":"Distinct public cases in this selection. People counts apply within individual cases only; cross-case person overlap has not been resolved. No population incidence estimate.","affectedCountNote":"Interpret person counts with affectedCountStatus and the reported effects. Unquantified zeros are placeholders, not a measured zero.","source":"AI incidents","publisher":"NOPE","url":"https://nope.net/incidents","license":"CC BY 4.0"},"incidents":[{"id":"2025-nsw-resilient-homes-program-applicant-data-uploaded-to-chatgpt","caseFacts":{"claims":[{"id":"c1","status":"reported","evidence":[{"locator":"The upload took place between 12 and 15 March 2025.","relation":"supports","source_id":"s1"},{"locator":"The breach occurred when a former temporary staff member of the RA uploaded data containing personal information to an unsecured Artificial Intelligence (AI) tool which was not authorised by RA.","relation":"supports","source_id":"s1"},{"locator":"The data shared was contained in a Microsoft Excel spreadsheet with 10 columns and more than 12,000 rows of information.","relation":"supports","source_id":"s1"},{"locator":"Between 12 and 15 March 2025, personal information was uploaded by a former contractor of the RA to the Artificial Intelligence platform ChatGPT.","relation":"supports","source_id":"s4"},{"locator":"\"Personal information was uploaded by a former contractor of the RA to the artificial intelligence platform ChatGPT,\" an RA spokesperson said.","relation":"supports","source_id":"s2"},{"locator":"although it actually occurred over six months ago, between March 12 and 15.","relation":"supports","source_id":"s3"}],"assertion":"Between 12 and 15 March 2025 a former temporary staff member or contractor of the NSW Reconstruction Authority uploaded a spreadsheet of Northern Rivers Resilient Homes Program applicant data (10 columns, more than 12,000 rows) to ChatGPT, an AI tool the Authority had not authorised.","causal_attribution":"The Authority's own statements report the upload and its dates. The role is described as a former temporary staff member on the current page and a former contractor on the earlier notice and in the press."},{"id":"c2","status":"reported","evidence":[{"locator":"2031 people who provided information to the RA for the RHP had some of their data uploaded to ChatGPT.","relation":"supports","source_id":"s1"},{"locator":"Sensitive personal information","relation":"supports","source_id":"s1"},{"locator":"no driver's licence numbers, Medicare numbers, passport numbers, or Tax File Numbers were disclosed in the breach.","relation":"supports","source_id":"s1"},{"locator":"The breach shared the names and addresses of program applicants, as well as email addresses, phone numbers, and other personal and health information.","relation":"supports","source_id":"s2"},{"locator":"Up to 3000 individuals may be impacted by the breach.","relation":"supports","source_id":"s4"},{"locator":"Sensitive health information","relation":"supports","source_id":"s1"}],"assertion":"The Authority confirmed through external forensic analysis that 2031 program participants had some of their data uploaded to ChatGPT, including name, contact details, address, date of birth and sensitive personal information (an earlier notice said up to 3000 people and included health information); it said no driver licence, Medicare, passport or Tax File Numbers were disclosed.","causal_attribution":"The Authority's own statements report the count and data categories from its forensic analysis."},{"id":"c3","status":"reported","evidence":[{"locator":"There is no evidence that any of the uploaded data is publicly available online or has been accessed by a third party at this stage.","relation":"supports","source_id":"s1"},{"locator":"There is no evidence that any information has been made public, however this cannot be ruled out,","relation":"supports","source_id":"s2"}],"assertion":"The Authority said it found no evidence that the uploaded data was publicly available or accessed by a third party, and that this could not be ruled out at the time of the first notice.","causal_attribution":"The Authority's statement. Whether OpenAI retained or used the data is not addressed in the inspected sources."},{"id":"c4","status":"reported","evidence":[{"locator":"we are deeply sorry for the distress it may cause for those involved in the program.","relation":"supports","source_id":"s1"},{"locator":"I feel concerned — the information with the RA was deeply personal,","relation":"supports","source_id":"s2"}],"assertion":"The Authority apologised for the distress the breach may cause, and one program participant told the ABC the information held by the Authority was deeply personal and that they felt concerned.","causal_attribution":"Concern is one participant's stated reaction. No sources report identity misuse or other realised loss."},{"id":"c5","status":"reported","evidence":[{"locator":"The NSW Reconstruction Authority will provide compensation for any reasonable out of pocket expenses if any compromised identity documents need to be replaced.","relation":"supports","source_id":"s4"},{"locator":"We are working with Social Futures to reach out to people who have been impacted and ID Support NSW, a government identity and cyber security support service, to assist anyone whose data may have been compromised.","relation":"supports","source_id":"s1"}],"assertion":"The Authority offered support through ID Support NSW and said it would compensate reasonable out-of-pocket expenses to replace compromised identity documents.","causal_attribution":"The Authority's statements about its response."}],"effects":[{"label":"personal and sensitive information of 2031 Resilient Homes Program participants was uploaded to ChatGPT without authorisation","claim_id":"c2","direction":"negative"},{"label":"one participant reports concern about the deeply personal information held; the Authority apologised for possible distress","claim_id":"c4","direction":"negative"}],"sources":[{"id":"s1","url":"https://www.nsw.gov.au/departments-and-agencies/nsw-reconstruction-authority/resilient-homes-program-data-breach","kind":"official_statement","access":"read","language":"en","translation_note":"Full body read by curl on 2026-09-29 (page last updated 26 March 2026, with previous updates listed).","independence_group":"nsw-ra-statement"},{"id":"s2","url":"https://www.abc.net.au/news/2025-10-06/data-breach-northern-rivers-resilient-homes-program-chatgpt/105855284","kind":"news_report","access":"read","language":"en","translation_note":"Full body read by curl. Relays the Authority statement; the participant quote is a separate interview within the same article, used only for that person's stated concern.","independence_group":"nsw-ra-statement"},{"id":"s3","url":"https://www.itnews.com.au/news/nsw-gov-contractor-uploaded-excel-spreadsheet-of-flood-victims-data-to-chatgpt-620815","kind":"news_report","access":"read","language":"en","translation_note":"Full body read by curl. Relays the Authority breach notice; the monitoring comment is the outlet's own.","independence_group":"nsw-ra-statement"},{"id":"s4","url":"https://www.nsw.gov.au/departments-and-agencies/nsw-reconstruction-authority/media-releases/northern-rivers-resilient-homes-program-data-breach","kind":"official_statement","access":"read","language":"en","translation_note":"Full body read by curl. Authority media release of the first notice (October 2025).","independence_group":"nsw-ra-statement"}],"version":1,"ai_roles":["institutional_use"],"contexts":["privacy","public_services","everyday_life"],"unknowns":["Whether ChatGPT (OpenAI) retained or used the uploaded data, and any deletion outcome.","Whether any participant suffered identity misuse or other realised loss; none is reported.","Exact number of affected people at the first notice (up to 3000) versus the confirmed 2031.","Whether the uploader was a temporary staff member or a contractor (the Authority uses both terms).","The findings of the independent review beyond the Authority's summary of it."],"geography":{"basis":"The upload was made by a person working for the NSW Reconstruction Authority (a New South Wales Government agency) using data from its Northern Rivers Resilient Homes Program; the ABC describes the affected people as northern NSW residents.","court_countries":[],"event_countries":["AU"],"affected_person_countries":["AU"]},"publication":{"basis":"Published as a concrete government-agency privacy incident involving an unauthorised AI upload with a confirmed count of affected people. The facts of the upload rest on the agency's own notices, which the press relayed. No misuse of the data is reported and the harm is exposure of personal and sensitive information. The uploader and affected people are not named.","reviewed_on":"2026-09-29"},"ai_involvement":{"basis":"The Authority states the data was uploaded to ChatGPT and that its forensic analysis confirmed 2031 people had data uploaded. The AI system received the data; the sources do not report any ChatGPT output affecting the participants.","status":"supported"},"person_relations":["unknown"]},"name":"New South Wales: a former staff member or contractor of the NSW Reconstruction Authority uploaded a spreadsheet of Resilient Homes Program applicant data to ChatGPT; the Authority confirmed 2031 people had data uploaded","summary":"The NSW Reconstruction Authority says that between 12 and 15 March 2025 a former temporary staff member (earlier described as a former contractor) uploaded an Excel spreadsheet with 10 columns and more than 12,000 rows from the Northern Rivers Resilient Homes Program to ChatGPT, an AI tool the Authority had not authorised. The Authority first disclosed the breach on 6 October 2025 as affecting up to 3000 people and later confirmed through external forensic analysis that 2031 people had data uploaded, including names, contact details, addresses, dates of birth and sensitive personal information (an earlier notice also listed health information). It reports no evidence that the data was made public or accessed by a third party, and that no driver licence, Medicare, passport or Tax File Numbers were included. The Authority apologised, offered ID Support NSW assistance and committed to compensate reasonable document replacement costs. One participant told the ABC they were concerned. No misuse of the data is reported.","incidentDate":"2025-03-12","incidentEndDate":"2025-03-15","incidentKind":"bounded_series","incidentDatePrecision":"range","exposurePattern":"single_interaction","reportedDate":"2025-10-06","aiSystem":"ChatGPT (OpenAI), used through an unauthorised upload of program data by a person working for the NSW Reconstruction Authority","aiProduct":"ChatGPT","aiCompany":"OpenAI","severity":"low","verificationStatus":"credible","harmCategories":[],"harmOutcomes":["other_material_harm"],"harmOutcomeSummary":"The NSW Reconstruction Authority reports that personal and sensitive information of 2031 Resilient Homes Program participants was uploaded to ChatGPT without authorisation; it reports no evidence of public exposure or third-party access, and no realised misuse is reported (the Authority's notices and press coverage relaying them).","frameworkFacets":[],"causationStatus":"alleged","participantUsersAffectedMin":0,"otherPeopleHarmedMin":0,"affectedCountStatus":"unquantified","affectedCountEvidence":"The Authority states that external forensic analysis confirmed 2031 people had some of their data uploaded to ChatGPT. Those people are exposed people and are not counted as harmed: no source reports a consequence to them beyond the exposure. One participant told the ABC of concern, and the ABC does not state that this person is among the 2031. The earlier estimate of up to 3000 is not used. The uploader is not counted.","victimAgeRange":"unknown","jurisdiction":"AU-NSW","platformType":"chatbot","outcomeType":"investigation_opened","outcomeStatus":"resolved","primarySourceUrl":"https://www.nsw.gov.au/departments-and-agencies/nsw-reconstruction-authority/resilient-homes-program-data-breach","primarySourceLabel":"NSW Reconstruction Authority: Resilient Homes Program data breach","firstPublishedAt":"2026-09-29T12:41:19.196147+00:00","updatedAt":"2026-09-30T01:17:12.628427+00:00","scopeVersion":"facts-v3","tags":["historical-2025"]},{"id":"2025-hku-deepfake-scandal","caseFacts":{"claims":[{"id":"c1","status":"corroborated","evidence":[{"locator":"'a University of Hong Kong (HKU) law student fabricated pornographic deepfakes of at least 20 women'; 'no allegation so far that the student spread the deepfake images'; 'a friend discovered the images on the student's laptop'.","relation":"supports","source_id":"s1"},{"locator":"'Around 20 to 30 women... were affected'; 'in February, the student had admitted to using screenshots of the social media accounts... to generate pornographic images using free online artificial intelligence software'; 'there were 700 images involved - including deepfakes as well as unedited images'.","relation":"supports","source_id":"s3"},{"locator":"'The images were organized into folders named after the victims, totaling 700+ images'; 'discovered on his laptop reported to the university in February'; 'not known to have been widely distributed'.","relation":"supports","source_id":"s2"}],"assertion":"In February 2025 an HKU law student was found to have used free online AI software to make indecent/deepfake images of some 20 to 30 women (about 700 image files including deepfakes and unedited saved photos), taken from their social-media accounts; there was no allegation he distributed them.","causal_attribution":"The victims' Instagram account (carried by HKFP and NBC) and AFP reporting (CBS); the 700 figure is images, and outlets vary between 'at least 20' and '20 to 30' women."},{"id":"c2","status":"corroborated","evidence":[{"locator":"'The University has already issued him a warning letter and demanded him a formal apology'; the 60-word apology letter; 'class adjustments'.","relation":"supports","source_id":"s2"},{"locator":"'HKU proposed a verbal reprimand and warning letter'; the ~60-word apology 'most victims found... insincere'.","relation":"supports","source_id":"s3"},{"locator":"'The university said it had issued a warning letter to the student and told him to apologise'; lawmakers/advocates' criticism.","relation":"supports","source_id":"s4"}],"assertion":"HKU initially issued a warning letter and demanded an apology (about 60 words, shown to victims in April 2025), and made class adjustments; the response drew wide criticism after victims went public on 12 July 2025.","causal_attribution":"HKU statements and the victims' account, carried by three outlets."},{"id":"c3","status":"corroborated","evidence":[{"locator":"'Hong Kong's Office of the Privacy Commissioner for Personal Data said Tuesday... has begun a criminal investigation into the incident'.","relation":"supports","source_id":"s1"},{"locator":"'The probe, announced Tuesday by the Office of the Privacy Commissioner for Personal Data'.","relation":"supports","source_id":"s2"}],"assertion":"Hong Kong's Privacy Commissioner opened a criminal investigation on 15 July 2025.","causal_attribution":"PCPD announcement, 15 July 2025."},{"id":"c4","status":"documented","evidence":[{"locator":"'私隱專員公署今日（17 日）宣布，因證據不足未能進一步跟進... 由於未有受害人願意提供進一步資料，目前未有足夠證據提出起訴'; 'AI 深度偽造技術（Deepfake）投訴... 5 宗'; new school/parent guidance.","relation":"supports","source_id":"s5"}],"assertion":"On 17 December 2025 the PCPD announced it was ending the investigation for insufficient evidence, as no victim was willing to provide further information, and released anti-deepfake guidance for schools and parents.","causal_attribution":"unwire.hk report of the PCPD press conference (Privacy Commissioner Ada Chung), 17 December 2025."},{"id":"c5","status":"corroborated","evidence":[{"locator":"'under section 159AAE of the Crimes Ordinance, it is unlawful to disseminate deepfake intimate images... without their consent'; creation not covered.","relation":"supports","source_id":"s3"},{"locator":"'the city's regulations covered acts of voyeurism and the publication or distribution of images - rather than their creation'.","relation":"supports","source_id":"s4"},{"locator":"'Hong Kong law only criminalises the distribution of intimate images... but not the generation of them'.","relation":"supports","source_id":"s1"}],"assertion":"Hong Kong law criminalises publication or distribution of non-consensual intimate images (including AI-generated ones) but not their mere creation, leaving victims without a clear route to prosecution.","causal_attribution":"Legal analysis carried by three outlets and the victims' statement."}],"effects":[{"label":"some 20 to 30 women had indecent and deepfake images generated from their social-media photos; distress, shared classes with the accused, and no redress after the probe closed","claim_id":"c1","direction":"negative"}],"sources":[{"id":"s1","url":"https://www.cbsnews.com/news/ai-generated-porn-scandal-university-of-hong-kong/","kind":"news_report","access":"read","language":"en","translation_note":"Read in English on 2026-09-17 via the Internet Archive capture 20251105074941 (CBS live returns HTTP 406); datePublished 2025-07-15. CBS/AFP: at least 20 women, PCPD criminal probe, legal gap.","independence_group":"afp"},{"id":"s2","url":"https://www.nbcnews.com/world/asia/hong-kong-opens-criminal-probe-ai-generated-porn-scandal-citys-oldest-rcna219046","kind":"news_report","access":"read","language":"en","translation_note":"Read in English on 2026-09-17 (live, datePublished 2025-07-17). NBC News: 700+ images in victim-named folders, warning letter and 60-word apology, class adjustments, John Lee comment.","independence_group":"nbc"},{"id":"s3","url":"https://hongkongfp.com/2025/07/14/hku-student-who-allegedly-made-700-ai-generated-indecent-images-inc-of-classmates-gets-warning-letter/","kind":"news_report","access":"read","language":"en","translation_note":"Read in English on 2026-09-17 (live, datePublished 2025-07-13, correction 2025-07-14). HKFP: 20-30 women, February discovery, 700 images (deepfakes plus unedited), March disciplinary request, ragging analysis.","independence_group":"hkfp"},{"id":"s4","url":"https://www.scmp.com/news/hong-kong/law-and-crime/article/3318047/hong-kong-should-ban-ai-generated-porn-protect-victims-ngo-and-lawmakers","kind":"news_report","access":"read","language":"en","translation_note":"Read in English on 2026-09-17 (live, datePublished 2025-07-13). SCMP: advocates and lawmakers on the creation-vs-distribution legal gap; Education Bureau comment.","independence_group":"scmp"},{"id":"s5","url":"https://unwire.hk/2025/12/17/hku-ai-deepfake-case-privacy-investigation-insufficient-evidence/fun-tech/","kind":"news_report","access":"read","language":"zh","translation_note":"Read in Chinese on 2026-09-17 (datePublished 2025-12-17). unwire.hk on the PCPD press conference: probe ended for insufficient evidence, no victim willing to provide further information, 20-30 victims, five deepfake complaints that year, new school/parent guidance. Model reading; no human bilingual review.","independence_group":"unwire"}],"version":1,"ai_roles":["others_use"],"contexts":["education","privacy","justice"],"unknowns":["The student is not identified beyond 'a male law student' and faced no prosecution; whether HKU took any further disciplinary action is not established.","The exact number of women is reported as 20 to 30 (NBC: 'more than a dozen'); the precise count is unresolved.","The creation start date is reported by The Standard as about May 2024 but is not firmly established in the sources read here.","Whether any victim later came forward with evidence after the December 2025 closure is not established."],"geography":{"basis":"Event: the University of Hong Kong; victims are HKU-connected women in Hong Kong (CBS, NBC, HKFP, SCMP). The PCPD is a regulator, not a court, and no prosecution followed, so court_countries is empty.","court_countries":[],"event_countries":["HK"],"affected_person_countries":["HK"]},"publication":{"basis":"Restored from the deletion of historical artifact rows and converted to facts-v3 under the 2026-09-15 charter, which brings non-consensual AI imagery and harmful artifacts into scope. Some 20 to 30 women had indecent AI images generated from their photos; the harm and the closed investigation are documented across CBS/AFP, NBC, HKFP, SCMP and unwire.hk. First-publication timestamp preserved.","reviewed_on":"2026-09-17"},"ai_involvement":{"basis":"Multiple outlets and the victims' own account report the student used free online AI software to generate indecent/deepfake images from the women's social-media photos; the student admitted using the software (per the victims' account carried by HKFP and NBC). The specific tools are not named.","status":"supported"},"person_relations":["depicted_or_impersonated"]},"name":"University of Hong Kong: a law student made about 700 indecent AI-generated images of some 20 to 30 classmates and teachers; the privacy watchdog opened then closed a criminal probe","summary":"In February 2025 a University of Hong Kong (HKU) law student was found, by friends who saw the files on his laptop, to have used free online AI software to make about 700 indecent and deepfake images of some 20 to 30 women, including university and former schoolmates and secondary-school teachers, using photos taken from their social media. Victims went public in July 2025, and HKU's initial response, a warning letter and a demand that he apologise, drew wide criticism. Hong Kong's Privacy Commissioner opened a criminal investigation on 15 July 2025 but announced on 17 December 2025 that it was ending the probe for insufficient evidence, as no victim was willing to provide further information. Hong Kong law criminalised distribution, not creation, of such images.","incidentDate":"2025-02-01","incidentKind":"bounded_series","incidentDatePrecision":"month","exposurePattern":"unknown","reportedDate":"2025-07-12","aiSystem":"AI deepfake / image-generation software (free online tools, not named)","aiProduct":"Unidentified image tool","severity":"high","verificationStatus":"credible","harmCategories":[],"harmOutcomes":["psychological_distress","reputational_harm","exploitation_or_abuse"],"harmOutcomeSummary":"Some 20 to 30 women had indecent and deepfake images of themselves generated with AI from their social-media photos; victims reported distress and had to share classes with the accused, and the criminal investigation was closed for insufficient evidence, leaving them without redress.","frameworkFacets":[],"causationStatus":"supported","participantUsersAffectedMin":0,"otherPeopleHarmedMin":20,"affectedCountStatus":"documented_minimum","affectedCountEvidence":"CBS and Hong Kong Free Press report 20 to 30 women affected; NBC reports 'more than a dozen'; the PCPD (December 2025) referred to 20 to 30 victims. Documented minimum of 20; the ~700 figure counts images (deepfakes plus unedited saved photos), not people, and is not used as a person count.","victimAgeRange":"adult","jurisdiction":"HK","platformType":"other","outcomeType":"investigation_opened","outcomeStatus":"resolved","primarySourceUrl":"https://hongkongfp.com/2025/07/14/hku-student-who-allegedly-made-700-ai-generated-indecent-images-inc-of-classmates-gets-warning-letter/","primarySourceLabel":"Hong Kong Free Press, 13-14 July 2025: HKU student who allegedly made 700 AI-generated indecent images, inc. of classmates, gets warning letter","firstPublishedAt":"2026-01-29T09:52:32.902523+00:00","updatedAt":"2026-09-30T01:17:04.827976+00:00","scopeVersion":"facts-v3","tags":["deepfakes","hong-kong","university","ncii","sexual-images","legal-gap","investigation","east-asia","depicted-or-impersonated"]}]}