{"meta":{"exportedAt":"2026-10-12T09:11:48.397Z","formatVersion":2,"selection":{"q":"insurance","system":"","harm":"","context":"","country":"","role":"","relation":"contextual","evidence":"","year":"","response":"","severity":"","verification":"","view":"incidents","sort":"added"},"totalIncidents":2,"coverage":{"cases":2,"countries":0,"languages":2,"unknownLocation":2,"locationPending":0,"unknownLanguage":0,"unknownDate":0,"lawsuits":0,"regulatory":0,"minors":0,"coreRelations":0,"contextualRelations":2,"mixedRelations":0,"unknownRelations":0,"relationPending":0,"relationUnknown":0},"countingNote":"Distinct public cases in this selection. People counts apply within individual cases only; cross-case person overlap has not been resolved. No population incidence estimate.","affectedCountNote":"Interpret person counts with affectedCountStatus and the reported effects. Unquantified zeros are placeholders, not a measured zero.","source":"AI incidents","publisher":"NOPE","url":"https://nope.net/incidents","license":"CC BY 4.0"},"incidents":[{"id":"2026-japan-health-guidance-contractor-employee-uploaded-insured-members-health-data-to-unauthorised-ai-service","caseFacts":{"claims":[{"id":"c1","status":"reported","evidence":[{"locator":"'令和８年８月 20 日、委託先におけるデータ抽出業務において、委託先担当者が個人情報を含む'; 'データを、委託先が利用を許可していない AI サービスに入力等を行ったことが判明しました。'","relation":"supports","source_id":"s1"},{"locator":"'RIZAPの特定保健指導運営事務局で、従業員がデータ抽出業務を行う際、2024年度、2025年度、2026年度にRIZAPの特定保健指導を利用した210名分の個人情報を生成AIへ参照させたことが、当該従業員の自己申告で判明したとしています。'","relation":"supports","source_id":"s2"},{"locator":"'個人で利用している外部の生成AIサービスへ、要配慮個人情報を含む顧客情報を誤ってアップロードしていたという事象です。'","relation":"supports","source_id":"s3"}],"assertion":"RIZAP reported to its client insurers that it came to light on 20 August 2026 that, in data-extraction work, one of its staff had entered data containing members' personal information into an external generative AI service the company had not authorised.","causal_attribution":"All three accounts rest on RIZAP's own report of its employee's action, relayed by each insurer and by RIZAP's release; the transfer to the AI service is admitted by the company."},{"id":"c2","status":"reported","evidence":[{"locator":"'対象者は 726 名で、対象支部は 14 支部'; '疾患情報（高血圧症、糖尿病、脂質異常症のいずれかに該当する方）'","relation":"supports","source_id":"s1"}],"assertion":"The mutual aid association says 726 of its members across 14 branches are covered, and that the data included membership numbers, email addresses, names, dates of birth and sex, some addresses and phone numbers, the type of health guidance and disease information on high blood pressure, diabetes or dyslipidaemia.","causal_attribution":"The association's count of its own members, from its notice."},{"id":"c3","status":"reported","evidence":[{"locator":"'対象は2024年度、2025年度、2026年度にRIZAPの特定保健指導を利用した210名です。'; '当該従業員の自己申告で判明したとしています。'; '9月1日、OpenAIから「当該データはモデルの学習に利用されていない」との回答を得ています。'","relation":"supports","source_id":"s2"}],"assertion":"The IHI group health insurance society reported 210 of its members, said the matter was found through the employee's self-report, and said OpenAI answered on 1 September that the data had not been used for model training.","causal_attribution":"Relayed from the society's notice by a security news site; the notice itself was not read."},{"id":"c4","status":"reported","evidence":[{"locator":"'ビスに入力等を行ったデータについて、AI サービス提供事業者による閲覧・アクセスの有無に関し'","relation":"supports","source_id":"s1"},{"locator":"'一方、IHIグループ健康保険組合は、現時点で第三者への情報漏えい等の事実は確認されていないとする一方、OpenAIによる閲覧の有無については確認を継続しています。'","relation":"supports","source_id":"s2"},{"locator":"'当該生成AIサービスの運営事業者以外の第三者に閲覧された可能性と、生成AIの学習に利用された可能性はないことを確認したとしています。'","relation":"supports","source_id":"s3"}],"assertion":"The IHI society said no third-party leak had been confirmed, and both insurers said that whether the AI provider viewed or accessed the data was still being checked; RIZAP's release says it confirmed no possibility of viewing by third parties other than the operator and no training use.","causal_attribution":"Statements by the insurers and RIZAP about the limits of the exposure; not independently verified."},{"id":"c5","status":"reported","evidence":[{"locator":"'漏えいの可能性のある対象者に対しては、委託先から令和８年９月４日１０時に電子メールによりご'","relation":"supports","source_id":"s1"}],"assertion":"RIZAP notified affected members by email on 4 September 2026.","causal_attribution":"The association's statement of the notification."}],"effects":[{"label":"insured members' identifying details and disease information entered into an external generative AI service without their knowledge (insurers' notices)","claim_id":"c1","direction":"negative"}],"sources":[{"id":"s1","url":"https://www.chikyosai.or.jp/info/pdf/info_260904.pdf","kind":"official_record","access":"read","language":"ja","translation_note":"Read in Japanese on 2026-10-12; quoted passages were translated into English by the research agent (an AI), not by a human translator. Text extracted from the PDF with pdftotext; the notice relays what RIZAP reported to the association.","independence_group":"chikyosai-notice"},{"id":"s2","url":"https://rocket-boys.co.jp/security-measures-lab/ihi-rizap-openai-210-incident/","kind":"news_report","access":"read","language":"ja","translation_note":"Read in Japanese on 2026-10-12; quoted passages were translated into English by the research agent (an AI), not by a human translator. A security news site's report of the IHI group health insurance society's 2 September notice; the society's own page was not read.","independence_group":"ihi-kenpo-notice"},{"id":"s3","url":"https://monoist.itmedia.co.jp/mn/spv/2609/18/news007.html","kind":"news_report","access":"read","language":"ja","translation_note":"Read in Japanese on 2026-10-12; quoted passages were translated into English by the research agent (an AI), not by a human translator. A columnist's description of RIZAP group's release; the release page itself rendered no text to the fetcher and was not read directly. The page was decoded from Shift_JIS.","independence_group":"rizap-group-release"}],"version":1,"ai_roles":["others_use"],"contexts":["health","work","privacy"],"unknowns":["Whether 20 August 2026 is the date the data was entered or the date it was discovered.","The total number of people across all of RIZAP's client insurers, and whether the 726 and 210 counts overlap.","Which OpenAI product and account type the employee used; RIZAP's release does not name the service.","Whether the provider's staff viewed or accessed the data.","Whether the Personal Information Protection Commission has taken any action."],"geography":{"basis":"The affected members belong to Japanese insurers; the mutual aid association lists them by Japanese prefectural branches (Iwate, Akita, Osaka and others). The notices do not state where the employee did the data-extraction work, so no event country is recorded. No court is involved.","court_countries":[],"event_countries":[],"affected_person_countries":["JP"]},"publication":{"basis":"Published under the 2026-10-06 private-information ruling: two insurers' notices describe their contractor's employee actually entering members' identifying and disease information into an external generative AI service the contractor had not authorised, without the members' knowledge. The account rests on RIZAP's own admission as relayed by its clients and its release; the provider's answer on training and the open question of provider access are recorded.","reviewed_on":"2026-10-12"},"ai_involvement":{"basis":"The insurers' notices state that a contractor's staff member entered data containing members' personal information, including disease information, into an external generative AI service the contractor had not permitted, and that the data was deleted from the service afterwards; the provider was asked to delete stored copies. The privacy harm is that transfer of members' health-guidance data to an AI service without their knowledge. The notices record transmission and a provider answer that the data was not used for training; whether provider staff viewed it was unresolved, and no generated output about the members is reported.","status":"reported"},"person_relations":["received_personal_information"]},"name":"Health-guidance contractor says an employee entered insured members' names and disease information into an unauthorised external generative AI service","summary":"A local-government employees' mutual aid association said in a notice dated 4 September 2026 that RIZAP, the company it contracts for specific health guidance, had reported that on 20 August 2026 it emerged that a RIZAP staff member, during data-extraction work, had entered data containing personal information into an external generative AI service that RIZAP did not permit. The association says 726 of its members across 14 branches are covered and lists the data as membership numbers, email addresses, names, dates of birth, sex, some addresses and phone numbers, the type of health guidance and, for members with them, high blood pressure, diabetes or dyslipidaemia. The IHI group health insurance society reported 210 of its members in a 2 September notice that, according to a security news site, names OpenAI as the provider, says the matter came to light through the employee's own report, and says OpenAI answered on 1 September that the data had not been used for model training. RIZAP's own release, as described in an ITmedia column, says the information was uploaded by mistake to a generative AI service the employee used privately, and that the company confirmed no possibility of viewing by third parties other than the service operator or of use in training. Whether the provider's staff could view the data was still being checked when the insurers published.","incidentDate":"2026-08-01","incidentKind":"single_event","incidentDatePrecision":"month","exposurePattern":"single_interaction","reportedDate":"2026-09-02","aiSystem":"An external generative AI service that the contractor had not authorised for work; RIZAP's own release calls it an external generative AI service used privately by the employee, and the IHI group health insurance society's notice, as relayed by a security news site, names OpenAI as the provider","aiProduct":"Unidentified OpenAI generative AI service (reported)","severity":"medium","verificationStatus":"credible","harmCategories":[],"harmOutcomes":["other_material_harm"],"harmOutcomeSummary":"According to notices from two client insurers, an employee of their health-guidance contractor RIZAP entered personal data on insured members, including names, birth dates, insurance numbers, contact details and, for some, high blood pressure, diabetes or dyslipidaemia, into an external generative AI service that the company had not authorised; one insurer counts 726 affected members and another 210.","frameworkFacets":[],"causationStatus":"supported","participantUsersAffectedMin":0,"otherPeopleHarmedMin":726,"affectedCountStatus":"partial","affectedCountEvidence":"One insurer's notice (a local-government employees' mutual aid association) states that 726 of its members were covered by the data entered into the AI service, across 14 branches; that is the counted minimum. A second client, the IHI group health insurance society, separately reported 210 of its members, as relayed by a security news site; these people are additional but the two lists are not shown to be disjoint, so they are left in the unquantified remainder. RIZAP's own release, as described in an ITmedia column, gives no total. The employee who entered the data is not counted.","victimAgeRange":"adult","jurisdiction":"JP","platformType":"other","outcomeStatus":"ongoing","primarySourceUrl":"https://www.chikyosai.or.jp/info/pdf/info_260904.pdf","primarySourceLabel":"Local-government employees' mutual aid association (Chikyosai), notice of 4 September 2026 on its contractor's AI-service data entry","firstPublishedAt":"2026-10-12T03:35:18.489537+00:00","updatedAt":"2026-10-12T03:35:18.489537+00:00","scopeVersion":"facts-v3","tags":["privacy","health-data","generative-ai","unauthorised-ai-use","contractor","insurance","japan","openai"]},{"id":"2025-lacey-insurance-discovery-relief-denied-ai-citations","caseFacts":{"claims":[{"id":"c1","status":"documented","evidence":[{"locator":"ECF 119 p. 8 para 20: 'I have struck, and decline to'; 'consider, any of the supplemental briefs'; 'I decline to award any of the discovery relief'; p. 7 para 17: 'The initial, undisclosed use of AI products to'; 'generate the first draft of the brief was flat-out wrong.'","relation":"supports","source_id":"s1"}],"assertion":"The special master struck the claimant's supplemental briefs and denied the discovery relief she sought because her lawyers filed briefs built on unverified AI-generated legal research.","causal_attribution":"The order itself connects the struck briefs and denial of relief to counsel's undisclosed AI use, failure to cite-check and re-submission of the defective brief (paras 17-20)."},{"id":"c2","status":"documented","evidence":[{"locator":"ECF 119 p. 2 para 5: 'approximately nine of the 27 legal'; 'citations in the ten-page brief were incorrect in some way. At least two of the'; 'authorities cited do not exist at all.'","relation":"supports","source_id":"s1"}],"assertion":"The order records that about nine of the 27 citations in the ten-page brief were incorrect and that at least two cited authorities do not exist.","causal_attribution":"The special master's own after-the-fact review, as recorded in the order."},{"id":"c3","status":"documented","evidence":[{"locator":"ECF 119 p. 10 para 24: 'clearly not at fault for the AI debacle'; 'She will not, however, be financially'; para 25: 'I decline to order any sanction'; conclusion: 'aggregate amount of $31,100.'","relation":"supports","source_id":"s1"}],"assertion":"The order makes the two firms jointly and severally pay $31,100 in aggregate, states the client was not at fault and will not be financially responsible for the awards, and declines any sanction against individual lawyers.","causal_attribution":"Allocation of financial responsibility is directly recorded in the order."},{"id":"c4","status":"reported","evidence":[{"locator":"ECF 119 appendix, declaration p. 46 para 3: 'generative AI capabilities found in CoCounsel and Westlaw Precision and'; p. 47 para 4: 'It is unclear to me whether'; 'research tools I utilized returned some erroneous information.'","relation":"supports","source_id":"s1"}],"assertion":"One lawyer's sworn declaration says the outline he circulated relied in part on generative AI features in CoCounsel, Westlaw Precision and Google Gemini, and that he cannot tell whether particular errors arose from his transcription or from a tool.","causal_attribution":"The declarant's own statement; the order does not determine which tool produced each error."},{"id":"c5","status":"reported","evidence":[{"locator":"ECF 119 appendix, joint response section II p. 76: 'None of the K&L Gates attorneys who worked on the subject brief used any'; order p. 3 para 7: 'the attorneys at K&L Gates didn’t'","relation":"supports","source_id":"s1"}],"assertion":"The second firm states that none of its lawyers who worked on the brief used or had access to AI tools or knew that AI had been used until the special master's inquiries.","causal_attribution":"The firm's own submission; the order records that the special master had no reason to doubt the sworn statements."}],"effects":[{"label":"Loss of requested discovery relief after the claimant's briefs were struck","claim_id":"c1","direction":"negative"}],"sources":[{"id":"s1","url":"https://www.lawnext.com/wp-content/uploads/2025/05/C.D.-Cal.-24-cv-05205-dckt-000119_000-filed-2025-05-06.pdf","kind":"court_order","access":"read","language":"en","translation_note":"English; read on 2026-10-09 from the retained PDF text of the 77-page filing: order pp. 2-10, appendix inventory p. 11, originating lawyer's declaration pp. 46-47 and the firms' joint response section II p. 76. PDF page 1 yielded no text. Not every appended exhibit was read.","independence_group":"lacey-ecf119"}],"version":1,"ai_roles":["others_use"],"contexts":["justice"],"unknowns":["Which tool, if any, produced each erroneous citation or quotation; the declarant says he cannot distinguish his transcription errors from tool output.","Whether the requested discovery relief would have been granted had the briefs been accurate.","The later course of the insurance action and where the AI-assisted drafting took place.","Paragraph 1 of the order (PDF page 1) was not inspected because the page yielded no extractable text."],"geography":{"basis":"The order was issued by a special master in the US District Court for the Central District of California. The record does not state where the AI-assisted drafting took place or where the claimant lives, so event and affected-person countries are left unknown.","court_countries":["US"],"event_countries":[],"affected_person_countries":[]},"publication":{"basis":"A filed court order directly establishes that the claimant's briefs were struck and her discovery relief denied because of AI-generated false citations in her lawyers' filings, with the monetary award placed on the firms. The tool identities are attributed to the declarant and kept as reported.","reviewed_on":"2026-10-09"},"ai_involvement":{"basis":"The filed order records that a lawyer used AI tools to generate the research outline for the claimant's brief and that the resulting brief contained false citations and quotations (about nine of 27 wrong, at least two non-existent). The special master read those authorities, found they did not exist, and on that basis struck the briefs and denied the discovery relief, writing that the use of AI affirmatively misled him. The declarant names CoCounsel, Westlaw Precision and Google Gemini but cannot say which tool produced each error, so the per-tool contribution is unestablished.","status":"supported"},"person_relations":["informed_decision_about"]},"name":"Insurance claimant loses discovery relief after her lawyers file AI-generated false citations; special master's order sanctions the two firms $31,100","summary":"In an order dated 5 May 2025 and filed on 6 May in Lacey v. State Farm (C.D. Cal.), a special master struck the claimant's supplemental briefs and denied the discovery relief she sought after her lawyers filed briefs built on unverified AI-generated legal research: about nine of 27 citations were wrong and at least two cited authorities did not exist. One lawyer's sworn declaration says the outline he circulated relied on generative AI features in CoCounsel, Westlaw Precision and Google Gemini, and that he could not tell whether particular errors came from his transcription or from a tool; co-counsel at the second firm say they used no AI tools and did not know AI had been used. The order makes the two firms jointly pay $31,100, states the client was not at fault and will not bear the awards, and imposes no penalty on individual lawyers.","incidentDate":"2025-04-01","incidentEndDate":"2025-05-05","incidentKind":"bounded_series","incidentDatePrecision":"month","exposurePattern":"unknown","reportedDate":"2025-05-06","aiSystem":"CoCounsel, Westlaw Precision and Google Gemini, named in one lawyer's sworn declaration as the generative AI tools used for the research outline; the order itself refers to 'various AI tools' and does not establish which tool produced each error","aiProduct":"CoCounsel, Westlaw Precision and Gemini (reported)","severity":"medium","verificationStatus":"verified","harmCategories":[],"harmOutcomes":["legal_harm"],"harmOutcomeSummary":"The special master struck the claimant's supplemental briefs and denied the discovery relief she sought after her lawyers filed briefs built on unverified AI-generated citations; the $31,100 award falls on the firms, not on her.","frameworkFacets":[],"causationStatus":"supported","participantUsersAffectedMin":0,"otherPeopleHarmedMin":1,"affectedCountStatus":"documented_minimum","affectedCountEvidence":"One claimant whose briefs were struck and whose discovery relief was denied (order paras 20 and 24). She did not use the AI tools herself, so participant users is 0. The lawyers and firms bear the monetary award but are not counted as harmed persons.","victimAgeRange":"unknown","jurisdiction":"US","platformType":"assistant","primarySourceUrl":"https://www.lawnext.com/wp-content/uploads/2025/05/C.D.-Cal.-24-cv-05205-dckt-000119_000-filed-2025-05-06.pdf","primarySourceLabel":"Lacey v. State Farm General Insurance Co., C.D. Cal. 2:24-cv-05205, ECF 119: special master's sanctions order dated 5 May 2025, filed 6 May 2025 (with appendix)","firstPublishedAt":"2026-09-29T10:29:01.113121+00:00","updatedAt":"2026-10-09T03:12:38.363121+00:00","scopeVersion":"facts-v3","tags":["historical-2025","ai-citations","court-sanction","legal-research","consequential-response"]}]}