{"meta":{"exportedAt":"2026-10-12T08:02:38.692Z","formatVersion":2,"selection":{"q":"unauthorised-ai-use","system":"","harm":"","context":"","country":"","role":"","relation":"","evidence":"","year":"","response":"","severity":"","verification":"","view":"incidents","sort":"added"},"totalIncidents":3,"coverage":{"cases":3,"countries":1,"languages":3,"unknownLocation":2,"locationPending":0,"unknownLanguage":0,"unknownDate":0,"lawsuits":0,"regulatory":0,"minors":0,"coreRelations":0,"contextualRelations":3,"mixedRelations":0,"unknownRelations":0,"relationPending":0,"relationUnknown":0},"countingNote":"Distinct public cases in this selection. People counts apply within individual cases only; cross-case person overlap has not been resolved. No population incidence estimate.","affectedCountNote":"Interpret person counts with affectedCountStatus and the reported effects. Unquantified zeros are placeholders, not a measured zero.","source":"AI incidents","publisher":"NOPE","url":"https://nope.net/incidents","license":"CC BY 4.0"},"incidents":[{"id":"2026-japan-health-guidance-contractor-employee-uploaded-insured-members-health-data-to-unauthorised-ai-service","caseFacts":{"claims":[{"id":"c1","status":"reported","evidence":[{"locator":"'令和８年８月 20 日、委託先におけるデータ抽出業務において、委託先担当者が個人情報を含む'; 'データを、委託先が利用を許可していない AI サービスに入力等を行ったことが判明しました。'","relation":"supports","source_id":"s1"},{"locator":"'RIZAPの特定保健指導運営事務局で、従業員がデータ抽出業務を行う際、2024年度、2025年度、2026年度にRIZAPの特定保健指導を利用した210名分の個人情報を生成AIへ参照させたことが、当該従業員の自己申告で判明したとしています。'","relation":"supports","source_id":"s2"},{"locator":"'個人で利用している外部の生成AIサービスへ、要配慮個人情報を含む顧客情報を誤ってアップロードしていたという事象です。'","relation":"supports","source_id":"s3"}],"assertion":"RIZAP reported to its client insurers that it came to light on 20 August 2026 that, in data-extraction work, one of its staff had entered data containing members' personal information into an external generative AI service the company had not authorised.","causal_attribution":"All three accounts rest on RIZAP's own report of its employee's action, relayed by each insurer and by RIZAP's release; the transfer to the AI service is admitted by the company."},{"id":"c2","status":"reported","evidence":[{"locator":"'対象者は 726 名で、対象支部は 14 支部'; '疾患情報（高血圧症、糖尿病、脂質異常症のいずれかに該当する方）'","relation":"supports","source_id":"s1"}],"assertion":"The mutual aid association says 726 of its members across 14 branches are covered, and that the data included membership numbers, email addresses, names, dates of birth and sex, some addresses and phone numbers, the type of health guidance and disease information on high blood pressure, diabetes or dyslipidaemia.","causal_attribution":"The association's count of its own members, from its notice."},{"id":"c3","status":"reported","evidence":[{"locator":"'対象は2024年度、2025年度、2026年度にRIZAPの特定保健指導を利用した210名です。'; '当該従業員の自己申告で判明したとしています。'; '9月1日、OpenAIから「当該データはモデルの学習に利用されていない」との回答を得ています。'","relation":"supports","source_id":"s2"}],"assertion":"The IHI group health insurance society reported 210 of its members, said the matter was found through the employee's self-report, and said OpenAI answered on 1 September that the data had not been used for model training.","causal_attribution":"Relayed from the society's notice by a security news site; the notice itself was not read."},{"id":"c4","status":"reported","evidence":[{"locator":"'ビスに入力等を行ったデータについて、AI サービス提供事業者による閲覧・アクセスの有無に関し'","relation":"supports","source_id":"s1"},{"locator":"'一方、IHIグループ健康保険組合は、現時点で第三者への情報漏えい等の事実は確認されていないとする一方、OpenAIによる閲覧の有無については確認を継続しています。'","relation":"supports","source_id":"s2"},{"locator":"'当該生成AIサービスの運営事業者以外の第三者に閲覧された可能性と、生成AIの学習に利用された可能性はないことを確認したとしています。'","relation":"supports","source_id":"s3"}],"assertion":"The IHI society said no third-party leak had been confirmed, and both insurers said that whether the AI provider viewed or accessed the data was still being checked; RIZAP's release says it confirmed no possibility of viewing by third parties other than the operator and no training use.","causal_attribution":"Statements by the insurers and RIZAP about the limits of the exposure; not independently verified."},{"id":"c5","status":"reported","evidence":[{"locator":"'漏えいの可能性のある対象者に対しては、委託先から令和８年９月４日１０時に電子メールによりご'","relation":"supports","source_id":"s1"}],"assertion":"RIZAP notified affected members by email on 4 September 2026.","causal_attribution":"The association's statement of the notification."}],"effects":[{"label":"insured members' identifying details and disease information entered into an external generative AI service without their knowledge (insurers' notices)","claim_id":"c1","direction":"negative"}],"sources":[{"id":"s1","url":"https://www.chikyosai.or.jp/info/pdf/info_260904.pdf","kind":"official_record","access":"read","language":"ja","translation_note":"Read in Japanese on 2026-10-12; quoted passages were translated into English by the research agent (an AI), not by a human translator. Text extracted from the PDF with pdftotext; the notice relays what RIZAP reported to the association.","independence_group":"chikyosai-notice"},{"id":"s2","url":"https://rocket-boys.co.jp/security-measures-lab/ihi-rizap-openai-210-incident/","kind":"news_report","access":"read","language":"ja","translation_note":"Read in Japanese on 2026-10-12; quoted passages were translated into English by the research agent (an AI), not by a human translator. A security news site's report of the IHI group health insurance society's 2 September notice; the society's own page was not read.","independence_group":"ihi-kenpo-notice"},{"id":"s3","url":"https://monoist.itmedia.co.jp/mn/spv/2609/18/news007.html","kind":"news_report","access":"read","language":"ja","translation_note":"Read in Japanese on 2026-10-12; quoted passages were translated into English by the research agent (an AI), not by a human translator. A columnist's description of RIZAP group's release; the release page itself rendered no text to the fetcher and was not read directly. The page was decoded from Shift_JIS.","independence_group":"rizap-group-release"}],"version":1,"ai_roles":["others_use"],"contexts":["health","work","privacy"],"unknowns":["Whether 20 August 2026 is the date the data was entered or the date it was discovered.","The total number of people across all of RIZAP's client insurers, and whether the 726 and 210 counts overlap.","Which OpenAI product and account type the employee used; RIZAP's release does not name the service.","Whether the provider's staff viewed or accessed the data.","Whether the Personal Information Protection Commission has taken any action."],"geography":{"basis":"The affected members belong to Japanese insurers; the mutual aid association lists them by Japanese prefectural branches (Iwate, Akita, Osaka and others). The notices do not state where the employee did the data-extraction work, so no event country is recorded. No court is involved.","court_countries":[],"event_countries":[],"affected_person_countries":["JP"]},"publication":{"basis":"Published under the 2026-10-06 private-information ruling: two insurers' notices describe their contractor's employee actually entering members' identifying and disease information into an external generative AI service the contractor had not authorised, without the members' knowledge. The account rests on RIZAP's own admission as relayed by its clients and its release; the provider's answer on training and the open question of provider access are recorded.","reviewed_on":"2026-10-12"},"ai_involvement":{"basis":"The insurers' notices state that a contractor's staff member entered data containing members' personal information, including disease information, into an external generative AI service the contractor had not permitted, and that the data was deleted from the service afterwards; the provider was asked to delete stored copies. The privacy harm is that transfer of members' health-guidance data to an AI service without their knowledge. The notices record transmission and a provider answer that the data was not used for training; whether provider staff viewed it was unresolved, and no generated output about the members is reported.","status":"reported"},"person_relations":["received_personal_information"]},"name":"Health-guidance contractor says an employee entered insured members' names and disease information into an unauthorised external generative AI service","summary":"A local-government employees' mutual aid association said in a notice dated 4 September 2026 that RIZAP, the company it contracts for specific health guidance, had reported that on 20 August 2026 it emerged that a RIZAP staff member, during data-extraction work, had entered data containing personal information into an external generative AI service that RIZAP did not permit. The association says 726 of its members across 14 branches are covered and lists the data as membership numbers, email addresses, names, dates of birth, sex, some addresses and phone numbers, the type of health guidance and, for members with them, high blood pressure, diabetes or dyslipidaemia. The IHI group health insurance society reported 210 of its members in a 2 September notice that, according to a security news site, names OpenAI as the provider, says the matter came to light through the employee's own report, and says OpenAI answered on 1 September that the data had not been used for model training. RIZAP's own release, as described in an ITmedia column, says the information was uploaded by mistake to a generative AI service the employee used privately, and that the company confirmed no possibility of viewing by third parties other than the service operator or of use in training. Whether the provider's staff could view the data was still being checked when the insurers published.","incidentDate":"2026-08-01","incidentKind":"single_event","incidentDatePrecision":"month","exposurePattern":"single_interaction","reportedDate":"2026-09-02","aiSystem":"An external generative AI service that the contractor had not authorised for work; RIZAP's own release calls it an external generative AI service used privately by the employee, and the IHI group health insurance society's notice, as relayed by a security news site, names OpenAI as the provider","aiProduct":"Unidentified OpenAI generative AI service (reported)","severity":"medium","verificationStatus":"credible","harmCategories":[],"harmOutcomes":["other_material_harm"],"harmOutcomeSummary":"According to notices from two client insurers, an employee of their health-guidance contractor RIZAP entered personal data on insured members, including names, birth dates, insurance numbers, contact details and, for some, high blood pressure, diabetes or dyslipidaemia, into an external generative AI service that the company had not authorised; one insurer counts 726 affected members and another 210.","frameworkFacets":[],"causationStatus":"supported","participantUsersAffectedMin":0,"otherPeopleHarmedMin":726,"affectedCountStatus":"partial","affectedCountEvidence":"One insurer's notice (a local-government employees' mutual aid association) states that 726 of its members were covered by the data entered into the AI service, across 14 branches; that is the counted minimum. A second client, the IHI group health insurance society, separately reported 210 of its members, as relayed by a security news site; these people are additional but the two lists are not shown to be disjoint, so they are left in the unquantified remainder. RIZAP's own release, as described in an ITmedia column, gives no total. The employee who entered the data is not counted.","victimAgeRange":"adult","jurisdiction":"JP","platformType":"other","outcomeStatus":"ongoing","primarySourceUrl":"https://www.chikyosai.or.jp/info/pdf/info_260904.pdf","primarySourceLabel":"Local-government employees' mutual aid association (Chikyosai), notice of 4 September 2026 on its contractor's AI-service data entry","firstPublishedAt":"2026-10-12T03:35:18.489537+00:00","updatedAt":"2026-10-12T03:35:18.489537+00:00","scopeVersion":"facts-v3","tags":["privacy","health-data","generative-ai","unauthorised-ai-use","contractor","insurance","japan","openai"]},{"id":"2025-eindhoven-municipal-staff-uploaded-residents-youth-care-and-social-support-files-to-public-ai-websites","caseFacts":{"claims":[{"id":"c1","status":"reported","evidence":[{"locator":"'Uit die steekproef is aan het licht gekomen dat er bestanden met persoonlijke gegevens naar openbare AI-websites zoals ChatGPT zijn gestuurd.'; 'Denk aan Jeugdwetdocumenten, interne verslagen en cv'; 'De steekproef ging over de periode van 23 september tot 23 oktober'","relation":"supports","source_id":"s1"},{"locator":"'In een steekproef over de periode van 23 september tot 23 oktober 2025 constateerde de gemeente dat verschillende soorten bestanden met persoonsgegevens waren geüpload naar openbare AI-websites.'","relation":"supports","source_id":"s3"}],"assertion":"According to the council letter as reported, a sample of staff data traffic from 23 September to 23 October 2025 found that files containing personal data of residents and employees had been uploaded to public AI websites such as ChatGPT, including youth-care documents, internal reports and CVs, mostly from care and support departments.","causal_attribution":"The municipality's own account in its council letter, relayed by two outlets that share that origin."},{"id":"c2","status":"reported","evidence":[{"locator":"'documenten uit de Jeugdwet met daarin informatie over de mentale en fysieke gezondheid van minderjarige kinderen'; 'Maar ook documenten van de Wet Maatschappelijke Ondersteuning (WMO) zijn ingevoerd.'; 'van sollicitanten en reflectieverslagen van medewerkers met daarin informatie over werkprestaties zijn in de Ai-tool terechtgekomen.'","relation":"supports","source_id":"s2"}],"assertion":"According to Omroep Brabant's account of the advisory firm's findings, the youth-care documents contained information about the mental and physical health of minor children, and social-support (WMO) documents, applicants' CVs and employees' reflection reports were also entered into the AI tool.","causal_attribution":"The advisory firm's findings as reported by one outlet; the report itself was not read."},{"id":"c3","status":"reported","evidence":[{"locator":"'Het datalek is op 23 oktober gemeld bij de Autoriteit Persoonsgegevens.'; 'De gemeente heeft OpenAI (het bedrijf achter ChatGPT) verzocht om de bestanden die vanuit Eindhoven zijn geüpload te verwijderen.'","relation":"supports","source_id":"s1"},{"locator":"'Sinds 23 oktober kunnen medewerkers alleen nog gebruikmaken van Copilot binnen de beveiligde gemeente-omgeving.'","relation":"supports","source_id":"s3"}],"assertion":"The municipality reported the breach to the Dutch Data Protection Authority on 23 October, stopped staff using public AI websites (allowing only Copilot in its secured environment), and asked OpenAI to delete the uploaded files.","causal_attribution":"The municipality's statements of its response, relayed by two outlets sharing the council-letter origin."},{"id":"c4","status":"reported","evidence":[{"locator":"'Daarom is het volgens het college ook niet mogelijk om mensen van wie gegevens gelekt zijn te informeren.'; 'Individuele gegevens die zijn geüpload in een AI-tool kunnen niet eenvoudig door derden uit de tool worden gehaald en worden misbruikt.'","relation":"supports","source_id":"s1"},{"locator":"'De gemeente Eindhoven heeft van OpenAi nog geen reactie gehad op hun verzoek, zo liet een woordvoerder vrijdag weten.'","relation":"supports","source_id":"s2"},{"locator":"'De totale omvang van de gedeelde gegevens is niet vast te stellen, omdat deze gegevens maximaal 30 dagen beschikbaar zijn.'","relation":"supports","source_id":"s3"}],"assertion":"The council says the scale of the uploads cannot be established because the data was kept for only 30 days, that it therefore cannot inform those affected, and that individual uploaded data cannot easily be extracted by third parties though the risk cannot be fully excluded; a spokesperson said OpenAI had not yet replied.","causal_attribution":"The council's and a spokesperson's statements about scope and risk."}],"effects":[{"label":"residents' youth-care and social-support files and job applicants' CVs uploaded to public AI websites without their knowledge (council letter, as reported)","claim_id":"c1","direction":"negative"}],"sources":[{"id":"s1","url":"https://www.omroepbrabant.nl/nieuws/6001041/datalek-gemeente-eindhoven-deelt-persoonsgegevens-met-openbare-ai-websites","kind":"news_report","access":"read","language":"nl","translation_note":"Read in Dutch on 2026-10-12; quoted passages were translated into English by the research agent (an AI), not by a human translator. Omroep Brabant's report of the council information letter.","independence_group":"eindhoven-council-letter"},{"id":"s2","url":"https://www.omroepbrabant.nl/nieuws/6001062/datalek-eindhoven-met-kwetsbare-burgers-verwijderverzoek-is-kansloos","kind":"news_report","access":"read","language":"nl","translation_note":"Read in Dutch on 2026-10-12; quoted passages were translated into English by the research agent (an AI), not by a human translator. Omroep Brabant's follow-up citing the advisory firm's findings and a municipal spokesperson; the firm's report itself was not read.","independence_group":"omroep-brabant-hooghiemstra-findings"},{"id":"s3","url":"https://www.binnenlandsbestuur.nl/digitaal/gemeente-eindhoven-blokkeert-chatgpt-na-datalek","kind":"news_report","access":"read","language":"nl","translation_note":"Read in Dutch on 2026-10-12; quoted passages were translated into English by the research agent (an AI), not by a human translator. Binnenlands Bestuur's report of the same council letter, so it shares the first source's group.","independence_group":"eindhoven-council-letter"}],"version":1,"ai_roles":["others_use"],"contexts":["public_services","health","work","privacy"],"unknowns":["How many residents, children, applicants and employees had data uploaded.","Whether uploads happened before or after the 23 September to 23 October 2025 sample window.","Which AI websites other than ChatGPT received files, and which account types staff used.","Whether OpenAI deleted the files, and whether any data was retained or used for training.","Whether the Dutch Data Protection Authority has taken a decision on the notification."],"geography":{"basis":"The uploads were found in the data traffic of the municipality of Eindhoven's staff, and the files concern residents and employees of that Dutch municipality. No court is involved.","court_countries":[],"event_countries":["NL"],"affected_person_countries":["NL"]},"publication":{"basis":"Published under the 2026-10-06 private-information ruling: the municipality's council letter, as reported by two outlets, describes staff actually uploading files with residents' youth-care and social-support data and applicants' CVs to public AI websites such as ChatGPT, without the knowledge of the people concerned. The scale is unknown and is recorded as such; the council's view that misuse risk is limited is recorded with it.","reviewed_on":"2026-10-12"},"ai_involvement":{"basis":"The municipality's council letter, as reported by two outlets, states that a sample of staff data traffic found files with residents' and employees' personal data, including youth-care documents, had been sent to public AI websites such as ChatGPT, and the municipality asked OpenAI to delete the uploaded files. The privacy harm is that transfer of residents' and employees' records into AI services without their knowledge. The sources report the uploads; they report no output about the people concerned, and whether the data was retained or used for training is not established (an expert's view on training is opinion).","status":"reported"},"person_relations":["received_personal_information"]},"name":"Eindhoven municipality says staff uploaded files with residents' youth-care and social-support data and applicants' CVs to public AI websites such as ChatGPT","summary":"The municipality of Eindhoven in the Netherlands told its council in an information letter shared on Thursday 18 December 2025 that a sample of staff data traffic from 23 September to 23 October 2025 showed files containing personal data of residents and employees had been sent to public AI websites such as ChatGPT, according to Omroep Brabant and Binnenlands Bestuur. The files included youth-care (Jeugdwet) documents, internal reports and CVs, mostly from departments that provide care and support to residents. According to Omroep Brabant's account of findings by the advisory firm Hooghiemstra & Partners, the youth-care documents held information about the mental and physical health of minor children, and social-support (WMO) documents and applicants' CVs were also entered. The municipality reported the breach to the Dutch Data Protection Authority on 23 October, blocked public AI websites and asked OpenAI to delete the files. The council says the scale cannot be determined because the data was kept for only 30 days, so it cannot inform those affected, and that the risk of misuse is limited but cannot be ruled out. A spokesperson said OpenAI had not yet replied.","incidentDate":"2025-09-23","incidentEndDate":"2025-10-23","incidentKind":"bounded_series","incidentDatePrecision":"day","exposurePattern":"repeated_interactions","reportedDate":"2025-12-18","aiSystem":"Public AI websites, which the municipality's council letter, as reported, names with ChatGPT as the example; the municipality asked OpenAI to delete the uploaded files","aiProduct":"ChatGPT (reported)","severity":"high","verificationStatus":"credible","harmCategories":[],"harmOutcomes":["other_material_harm"],"harmOutcomeSummary":"According to the municipality's council letter as reported, staff uploaded files containing personal data of residents and employees, including youth-care documents about children's mental and physical health and social-support files, to public AI websites such as ChatGPT; the council says it cannot determine the scale or inform those affected.","frameworkFacets":[],"causationStatus":"supported","participantUsersAffectedMin":0,"otherPeopleHarmedMin":0,"affectedCountStatus":"unquantified","affectedCountEvidence":"The council says the scale cannot be established because the uploaded data was kept for only 30 days, and that it therefore cannot inform the people concerned. No count of residents, children, applicants or employees is given, so numeric zero placeholders are recorded. The staff who uploaded the files are not counted.","victimAgeRange":"unknown","jurisdiction":"NL","platformType":"other","outcomeStatus":"ongoing","primarySourceUrl":"https://www.omroepbrabant.nl/nieuws/6001041/datalek-gemeente-eindhoven-deelt-persoonsgegevens-met-openbare-ai-websites","primarySourceLabel":"Omroep Brabant, 19 December 2025: Eindhoven data breach, municipality shares personal data with public AI websites","firstPublishedAt":"2026-10-12T03:35:14.550754+00:00","updatedAt":"2026-10-12T03:35:14.550754+00:00","scopeVersion":"facts-v3","tags":["privacy","government","municipality","youth-care","health-data","chatgpt","unauthorised-ai-use","netherlands"]},{"id":"2026-texas-health-plan-employee-uploaded-members-personal-and-prescription-data-to-chatgpt","caseFacts":{"claims":[{"id":"c1","status":"reported","evidence":[{"locator":"'On the evening of April 29, 2026, a Community First employee uploaded a file containing personal information of some Community First members to ChatGPT from a home computer network'; 'Community First does not utilize ChatGPT, and our systems immediately detected the violation and notified our IT department.'","relation":"supports","source_id":"s1"}],"assertion":"The health plan says that on the evening of 29 April 2026 an employee uploaded a file containing personal information of some members to ChatGPT from a home computer network, circumventing its firewall safeguards and violating its policy, and that its systems detected the violation.","causal_attribution":"The plan's own account of its employee's action; no independent account was inspected."},{"id":"c2","status":"reported","evidence":[{"locator":"'name, address, date of birth, member identification number, and prescription drug information'","relation":"supports","source_id":"s1"}],"assertion":"The plan says the affected information may have included members' names, addresses, dates of birth, member identification numbers and prescription drug information.","causal_attribution":"The plan's description of the file's contents."},{"id":"c3","status":"reported","evidence":[{"locator":"'directed and verified that the employee had deleted all personal information from their ChatGPT account'; 'contacted OpenAI, LLC (the operator of ChatGPT) to demand deletion of any related data'; 'promptly ended with its relationship with the employee'; 'complimentary identity monitoring services for twelve (12) months'; 'Community First is not aware of any impacted information having been misused'","relation":"supports","source_id":"s1"}],"assertion":"The plan says it had the employee delete the data from their ChatGPT account, asked OpenAI to delete related data, ended its relationship with the employee, notified agencies and members, offered identity monitoring and is not aware of any misuse.","causal_attribution":"The plan's statement of its response; OpenAI's reply, if any, is not reported."}],"effects":[{"label":"health-plan members' personal and prescription information uploaded to ChatGPT without their knowledge (plan's release)","claim_id":"c1","direction":"negative"}],"sources":[{"id":"s1","url":"https://communityfirsthealthplans.com/press-release/community-first-health-plans-announces-data-security-incident/","kind":"official_statement","access":"read","language":"en","translation_note":"Read in English on 2026-10-12 from the plan's own press-release page; no translation needed. The research agent (an AI) read the text directly.","independence_group":"community-first-release"}],"version":1,"ai_roles":["others_use"],"contexts":["health","work","privacy"],"unknowns":["How many members' information was in the uploaded file.","What the employee was using ChatGPT for and which account type was used.","Whether OpenAI replied or confirmed deletion, and whether the data was retained or used for training.","Where the employee's home network was located.","Whether any regulator has acted on the notification."],"geography":{"basis":"The affected people are members of a nonprofit health plan that the release places in San Antonio, Texas and the Bexar service area. The release says the upload was made from a home computer network without saying where, so no event country is recorded. No court is involved.","court_countries":[],"event_countries":[],"affected_person_countries":["US"]},"publication":{"basis":"Published under the 2026-10-06 private-information ruling: the health plan's own release describes an employee actually uploading a file of members' personal and prescription information to ChatGPT, without the members' knowledge and against the plan's policy. All facts are attributed to that release; the number of members and OpenAI's response are unknown.","reviewed_on":"2026-10-12"},"ai_involvement":{"basis":"The health plan states that its employee uploaded a file of members' personal information, including prescription drug information, to ChatGPT from a home network in breach of policy, that its systems detected the upload, and that it had the data deleted from the employee's ChatGPT account and asked OpenAI to delete related data. The privacy harm is that transfer of members' information into an AI service without their knowledge. The release reports the transmission; it does not report any ChatGPT output about the members, any retention finding or any use in training.","status":"reported"},"person_relations":["received_personal_information"]},"name":"Texas health plan says an employee uploaded a file of members' personal and prescription data to ChatGPT from a home network, against its policy","summary":"Community First Health Plans, a nonprofit health plan in San Antonio, Texas, said in a 29 June 2026 release that on the evening of 29 April 2026 one of its employees uploaded a file containing personal information of some members to ChatGPT from a home computer network, circumventing the plan's firewall safeguards and violating its policy. The plan says it does not use ChatGPT and that its systems detected the violation and alerted its IT department. According to the release, the file may have included members' names, addresses, dates of birth, member identification numbers and prescription drug information. The next morning the plan revoked the employee's access, directed and verified deletion of the data from the employee's ChatGPT account, asked OpenAI to delete any related data, and ended its relationship with the employee. It notified affected members and federal and state agencies, offered 12 months of identity monitoring and says it is not aware of any misuse. The release gives no number of affected members.","incidentDate":"2026-04-29","incidentKind":"single_event","incidentDatePrecision":"day","exposurePattern":"single_interaction","reportedDate":"2026-06-29","aiSystem":"ChatGPT (OpenAI), used by an employee from a home computer network in breach of the health plan's policy; the plan says it does not use ChatGPT","aiProduct":"ChatGPT","severity":"medium","verificationStatus":"credible","harmCategories":[],"harmOutcomes":["other_material_harm"],"harmOutcomeSummary":"According to the health plan, an employee uploaded a file containing some members' names, addresses, dates of birth, member identification numbers and prescription drug information to ChatGPT on 29 April 2026, in breach of its policy; the plan notified members, offered identity monitoring and says it knows of no misuse.","frameworkFacets":[],"causationStatus":"supported","participantUsersAffectedMin":0,"otherPeopleHarmedMin":0,"affectedCountStatus":"unquantified","affectedCountEvidence":"The plan's release refers to 'some Community First members' and 'affected Members' but gives no number, so no count is recorded (numeric zero placeholders). The employee who uploaded the file is not counted.","victimAgeRange":"unknown","jurisdiction":"US","platformType":"other","outcomeStatus":"ongoing","primarySourceUrl":"https://communityfirsthealthplans.com/press-release/community-first-health-plans-announces-data-security-incident/","primarySourceLabel":"Community First Health Plans press release, 29 June 2026: data security incident","firstPublishedAt":"2026-10-12T03:35:10.75316+00:00","updatedAt":"2026-10-12T03:35:10.75316+00:00","scopeVersion":"facts-v3","tags":["privacy","health-data","chatgpt","unauthorised-ai-use","health-plan","employee"]}]}