Aug 2026Event location unknownUnidentified OpenAI generative AI service (reported)
Notices from RIZAP's client insurers say that on 20 August 2026 it emerged that a staff member of RIZAP, the company they contract for specific health guidance, had entered data containing members' personal information into an external generative AI service that RIZAP had not permitted for work. The National Civil Engineering and Construction National Health Insurance Association (Doken Kokuho) puts the whole data set at 19,996 people, 1,167 of them its own members, and says the service was not under a corporate contract and that the matter was found when the employee noticed the transmission and reported it. A local-government employees' mutual aid association counts 726 of its members across 14 branches, and the IHI group health insurance society 210, according to a security news site that reads these as subsets of the 19,996. The data included membership numbers, email addresses, names, dates of birth, sex, some addresses and phone numbers, the type of health guidance and, for members with them, high blood pressure, diabetes or dyslipidaemia. The IHI society's notice, as relayed, names OpenAI as the provider and says OpenAI answered on 1 September that the data had not been used for model training. RIZAP's release, as described in an ITmedia column, says no third party other than the service operator could have viewed the data. Doken Kokuho says RIZAP confirmed to it that no third party viewed or used the information through the service; whether the provider's staff could view it was still being checked when the mutual aid association and the IHI society published.
Contextual tracker case Medium reported severity
AI involvement reported · Causal attribution supported · 5 sources, 4 underlying accounts · Added 12/10/2026
23 Sept 2025 to 23 Oct 2025NetherlandsChatGPT (reported)
The municipality of Eindhoven in the Netherlands told its council in an information letter shared on Thursday 18 December 2025 that a sample of staff data traffic from 23 September to 23 October 2025 showed files containing personal data of residents and employees had been sent to public AI websites such as ChatGPT, according to Omroep Brabant and Binnenlands Bestuur. The files included youth-care (Jeugdwet) documents, internal reports and CVs, mostly from departments that provide care and support to residents. According to Omroep Brabant's account of findings by the advisory firm Hooghiemstra & Partners, the youth-care documents held information about the mental and physical health of minor children, and social-support (WMO) documents and applicants' CVs were also entered. The municipality reported the breach to the Dutch Data Protection Authority on 23 October, blocked public AI websites and asked OpenAI to delete the files. The council says the scale cannot be determined because the data was kept for only 30 days, so it cannot inform those affected, and that the risk of misuse is limited but cannot be ruled out. A spokesperson said OpenAI had not yet replied.
Contextual tracker case High reported severity
AI involvement reported · Causal attribution supported · 3 sources, 2 underlying accounts · Added 12/10/2026
29 Apr 2026Event location unknownChatGPT
Community First Health Plans, a nonprofit health plan in San Antonio, Texas, said in a 29 June 2026 release that on the evening of 29 April 2026 one of its employees uploaded a file containing personal information of some members to ChatGPT from a home computer network, circumventing the plan's firewall safeguards and violating its policy. The plan says it does not use ChatGPT and that its systems detected the violation and alerted its IT department. According to the release, the file may have included members' names, addresses, dates of birth, member identification numbers and prescription drug information. The next morning the plan revoked the employee's access, directed and verified deletion of the data from the employee's ChatGPT account, asked OpenAI to delete any related data, and ended its relationship with the employee. It notified affected members and federal and state agencies, offered 12 months of identity monitoring and says it is not aware of any misuse. The release gives no number of affected members.
Contextual tracker case Medium reported severity
AI involvement reported · Causal attribution supported · 1 source · Added 12/10/2026
11 Apr 2026 to 11 Oct 2026Event location unknownChatGPT
In a Reddit post of 11 October 2026, a ChatGPT Plus subscriber who says they are an adult (36, by the post's own account) writes that when OpenAI's age checks rolled out their account was classified as a teen account and put on a restricted account. The poster says they had earlier emailed OpenAI asking for verification options without ID or a photo, received a canned reply about the verification provider Persona, and on escalating to data protection was told they had to be profiled first. The poster says they then cancelled the subscription. OpenAI's Help Center says ChatGPT uses an age prediction system that reads account signals, automatically enables the teen experience when it predicts an account may belong to someone under 18, can get this wrong, and lets adults verify their age to remove it. The account is the poster's own and is not corroborated.
Contextual tracker case Low reported severity
AI involvement reported · Causal attribution alleged · 2 sources · Added 11/10/2026
Oct 2026Event location unknownChatGPT (reported)
In a public Reddit account, a patient says a nurse asked whether AI could take notes at a medical appointment. After the patient objected, the nurse picked up a phone that the patient described as showing ChatGPT already recording. The patient describes the recording as occurring without prior notice and says their objection was dismissed. In replies, the author says the phone had Chrome open to ChatGPT, that recording had started when the nurse entered the room, before she asked consent, and that the recording was disabled only after the author insisted. This is an uncorroborated first-person account. It does not establish what was captured, whether anything was sent to a server, retained or used for training, or whether a law was broken. The clinic’s location, account type and response are unknown.
Contextual tracker case Low reported severity
AI involvement reported · Causal attribution alleged · 3 sources, 1 underlying account · Added 06/10/2026
17 Sept 2023United StatesUnidentified facial recognition system
Jason Killinger, a UPS truck driver, alleges in a federal civil-rights complaint filed in July 2025 that on 17 September 2023 the Peppermill Casino in Reno reported to police that its AI facial recognition software had identified him as a man barred from the casino months earlier. According to the complaint, casino security handcuffed him, and the responding Reno police officer, told the system had found a 100 percent match, did not examine his other identification and took him to jail as an unidentified person, where fingerprints confirmed who he was. The complaint says he was handcuffed for about four hours, starting in the casino security office, spent about eleven hours in police and jail custody, and was treated the next day for bruised wrists. According to the complaint, he was then charged with trespassing, and a prosecutor dismissed the charge without prejudice at the bench trial. Casino.org reports that he settled a suit against the casino. In March 2026 the court let him add the City of Reno and a municipal liability claim over facial recognition policies, but refused a new wrongful arrest claim against the officer on qualified immunity grounds. In September 2026 the ACLU, the ACLU of Nevada and the Innocence Project filed a proposed amicus brief supporting him. His September 2026 motion for partial summary judgment says a Reno police detective later concluded that the match was wrong and that he and the barred man were different people, and it cites a declaration by a former casino security officer, who worked there from about October 2024, that the system often alerted at 100 percent on the wrong people; in a declaration reported by Casino.org, the officer said he had never known the system to misidentify anyone. The case is ongoing.
Contextual tracker case Medium reported severity Lawsuit Ongoing
AI involvement reported · Causal attribution alleged · 9 sources, 3 underlying accounts · Added 04/10/2026
26 Sept 2026 to 27 Sept 2026United StatesClaude (reported)
According to a Lee County Sheriff's Office arrest report, as reported by WINK News and by Guessing Headlights (on Yahoo News, citing a copy obtained by Gulf Coast News Now), a user of Anthropic's AI platform wrote on 26 September 2026 that she was going to 'shoot up' the Lee County Sheriff's Office, and the next day wrote that she had a new gun. The arrest report says the platform's safety measures flagged the messages, a human review team examined them and reported them to law enforcement. Deputies went to the 30-year-old woman's Bonita Springs home and detained her without incident; she is charged with making a written threat of violence under Florida law. The sheriff told WINK News that she later said she uses AI like a 'diary'. Anthropic had not commented on the case in either report. The charge is an allegation and the case is pending.
Core + contextual relations Medium reported severity Criminal Charges
AI involvement reported · Causal attribution supported · 2 sources, 1 underlying account · Added 03/10/2026
2 Sept 2026 to 2 Oct 2026Event location unknownCharacter.AI age verification
In a public post to r/CharacterAI at 21:47 UTC on 2 October 2026, a person who describes themselves as a veteran user of the Character.AI app says they returned about a month earlier to verify their age, and that the AI verification by Persona assumed they were a minor although they are not. They say they sent photos of their ID, tried desktop and different lighting, and kept getting an error message; that more than five support tickets asking for manual verification drew only replies from automated bots; and that the age verification system has now locked them out of their account. In a reply they say the system should identify people properly instead of "locking it out on permenent basis". A commenter says the same check called them underage. The account is uncorroborated, and Character.AI's and Persona's handling is described only by the poster.
Contextual tracker case Low reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 03/10/2026
17 Apr 2026 to 31 May 2026Event location unknownMeta AI support assistant
Meta announced the rollout of its AI support assistant on Facebook and Instagram on 19 March 2026. Meta's filing with the Maine Attorney General (notice dated 5 June 2026) says unauthorized third parties exploited a vulnerability in its AI-assisted Instagram account recovery tool (High Touch Support) to receive password reset links for accounts they did not own, and the listing gives 17 April 2026 as the breach date and 31 May 2026 as the discovery date. Videos that attackers posted, as described by TechCrunch, 404 Media and Krebs on Security, show attackers asking the assistant in a chat to link a new email address to a target username. Reported victims include the security researcher Jane Manchun Wong, who posted that her password was changed without her knowledge, the Instagram account of the U.S. Space Force's Chief Master Sergeant, and the accounts of Sephora and a dormant Obama White House page (TechCrunch marks the last as disputed by Meta). Krebs and the BBC report pro-Iran defacement of some accounts, and TechCrunch reports that some victims were locked out and that short handles were offered for resale. The filing gives 20225 persons affected in total and 30 in Maine, and the notice calls the Maine figure an upper bound. Meta says the tool worked as intended, that a bug in a separate code path failed to check the email address, and (through a spokesperson to Gizmodo) that the failure was not due to the AI agent itself. Meta says it disabled the tool on 31 May 2026, the day it discovered the exploitation.
Contextual tracker case Low reported severity
AI involvement supported · Causal attribution disputed · 12 sources, 2 underlying accounts · Added 29/09/2026
2026Event location unknownGrok
In early 2026 (404 Media and the performer's 19 February post say early February, while Stern reports she found the reply weeks after it appeared) an X user replied to a clip of adult performer Siri Dahl, asking who the performer was and what her name was, and tagged Grok. According to 404 Media, Grok answered with her stage name, her birthdate and her legal name, and the user likely wanted only to know which performer appeared in the clip. Dahl has used the stage name since 2012 according to 404 Media, and she says she had paid for data removal services for at least six years to keep the legal name private. She reports that impersonating Facebook accounts and leak-site posts under the legal name then appeared and that the name spread across hundreds of websites. 404 Media reports that users asked Grok for the make and model of her car and her address without an accurate reply, and that she is calling family members to put defensive plans in place. Grok's reply to her protest said the details were already public, which she denies. Where Grok obtained the name is unknown. Dahl spoke publicly about the event and asked 404 Media to publish her legal name. This record omits the legal name and birthdate.
Core + contextual relations Medium reported severity
AI involvement reported · Causal attribution alleged · 6 sources, 3 underlying accounts · Added 29/09/2026
1 Mar 2026IndiaAI roommate kitchen monitor (reported)
On 1 March 2026 a Bengaluru-based technology professional posted on X that he had deployed a home "AI roommate" (a kitchen camera with an AI vision model, which he said was Claude Haiku 4.5) that monitored his cook while she cooked, alerted him when she took anything and sent weekly reports. The post said the system "caught her red handed", that he "caught her twice this week" and that he had "just fired" her. Screenshots quoted by Hindustan Times show the bot listing apples and a banana as gone, reporting the cook eating blueberries, and giving hand-washing and cleaning observations. All coverage derives from the employer's post: the post carries no video, the cook's account is not reported and the alleged taking is unverified.
Contextual tracker case Medium reported severity
AI involvement reported · Causal attribution alleged · 4 sources, 1 underlying account · Added 29/09/2026
8 Jan 2026United KingdomUnidentified facial recognition system
The Guardian, in a joint report with Liberty Investigates, reported on 25 February 2026 that Alvi Choudhury, a 26-year-old software engineer, was arrested at his home in Southampton in January 2026 on suspicion of a £3,000 burglary in Milton Keynes, about 100 miles away, and held in custody for nearly 10 hours. Thames Valley Police had used automated retrospective facial recognition software, which matched him with CCTV footage of the burglary suspect. Choudhury says the man in the footage looked about 10 years younger and had different features. Thames Valley Police wrote to him that the arrest may have been the result of bias within facial recognition technology, and told the Guardian that the decision rested on the investigating officers’ own visual assessment and was not influenced by racial profiling. Choudhury is claiming damages from Thames Valley Police and Hampshire Constabulary.
Contextual tracker case Medium reported severity
AI involvement supported · Causal attribution disputed · 4 sources, 3 underlying accounts · Added 29/09/2026
1 Jul 2025 to 17 Dec 2025United StatesEightfold Match Score
Two job applicants filed a proposed class action on 20 January 2026 in California state court (removed to federal court on 2 March 2026) against Eightfold AI Inc. The complaint alleges that Eightfold's hiring tools collect applicant data and produce a 0-to-5 'Match Score' that employers use to rank candidates, without the notice, access and dispute rights the Fair Credit Reporting Act and a California statute require. One plaintiff says she applied to Microsoft in or around July 2025 and again in December 2025 and received an automated rejection two days after the first application. The other says she applied to PayPal in December 2025. Both say they were not interviewed or hired and believe Eightfold's tools played a role. Eightfold says it does not scrape social media and operates on data candidates or customers provide. The allegations are unproven and Eightfold filed a motion to dismiss (no ruling appears in the docket entries inspected).
Contextual tracker case Low reported severity
AI involvement reported · Causal attribution alleged · 4 sources, 2 underlying accounts · Added 29/09/2026
12 Mar 2025 to 15 Mar 2025AustraliaChatGPT
The NSW Reconstruction Authority says that between 12 and 15 March 2025 a former temporary staff member (called a former contractor in its first notice) uploaded a Microsoft Excel spreadsheet of Northern Rivers Resilient Homes Program information, 10 columns and more than 12,000 rows, to ChatGPT, an AI platform the Authority had not authorised. The Authority disclosed the breach on 6 October 2025, estimating that up to 3000 people were affected, and later said external forensic analysis confirmed that 2031 people had some of their data uploaded, including names, contact details, addresses, dates of birth, sensitive personal and health information and limited financial commentary. It says no driver licence, Medicare, passport or Tax File Numbers were disclosed and that there is no evidence the data is publicly available or was accessed by a third party; whether OpenAI retained or used the data is not addressed. The Authority apologised, contacted affected people with ID Support NSW, offered to compensate the replacement of compromised identity documents and notified the NSW Privacy Commissioner. A program participant told the ABC the information was deeply personal and that they felt concerned. No misuse of the data is reported.
Contextual tracker case Low reported severity Investigation Opened
AI involvement supported · Causal attribution alleged · 4 sources, 1 underlying account · Added 29/09/2026
Mar 2024 to May 2025United StatesOtter Notetaker
Seven people in California, Illinois and Washington state are suing Otter.ai in a consolidated class action in the Northern District of California. Each says another meeting participant used Otter's AI Notetaker on a Zoom or Microsoft Teams call they joined, and that Otter recorded, transcribed and stored their conversation without their consent; six of them date their calls between March 2024 and May 2025. They say they were not Otter account holders. The calls they describe include a medical consultation, meetings with a financial professional and work discussions. They allege that Otter keeps the recordings and uses them to train its speech-recognition models, that it captured voiceprints of the Illinois plaintiffs, and one of them says learning of the recording left him frustrated, embarrassed and stressed. On 13 August 2026 the court found that the alleged interception of private conversations was a concrete injury and let the federal wiretap, California eavesdropping and Illinois biometric claims proceed, while dismissing some claims. Otter's answer to the consolidated complaint, filed on 17 September 2026, says it lacks knowledge of the plaintiffs' experiences and denies the allegations.
Contextual tracker case Low reported severity Lawsuit Ongoing
AI involvement reported · Causal attribution alleged · 6 sources, 3 underlying accounts · Added 29/09/2026
Event date unknownEvent location unknownFacebook video face-scan check
In a public post to r/facebook on 28 September 2026, a user writes that their five-year-old Facebook account was hit with a security check that asked for a video face scan, which 'failed completely'. They say their face had changed a lot through recent life circumstances and 'The AI simply didn't recognize me.' Facebook then asked for ID, and 'the automated system instantly rejected' their government ID because their profile uses a shortened nickname. The poster says they are locked out of years of memories, friends and active Marketplace listings and are looking for a way to reach a human or download their data. Meta has said that video selfies used to regain access to compromised accounts are compared with the account's profile pictures using facial recognition; whether this check worked that way is not known. The account is uncorroborated.
Contextual tracker case Low reported severity
AI involvement reported · Causal attribution alleged · 2 sources · Added 29/09/2026
Event date unknownEvent location unknownGemini note-taking in Google Meet
In a public post to r/LegalAdviceUK on 28 September 2026, an employee of a marketing agency in England writes that their boss pitched a prospective client and the client's business partner on a Google Meet call with Gemini note-taking switched on. After the boss said goodbye and left, the two business partners stayed on the call to discuss the proposal and the other agencies they were considering, and Gemini kept taking notes. The boss then sent the employee the notes and transcript, which named a competing agency and included 'personal details of who they spoke to specifically on the call', and asked for a follow-up deck built on what the partners liked and disliked. The poster believes the partners did not know they were still being transcribed. Google's help page says Meet tells all participants when notes are being taken; whether the partners noticed is not known. The account is uncorroborated.
Contextual tracker case Low reported severity
AI involvement reported · Causal attribution alleged · 4 sources, 2 underlying accounts · Added 29/09/2026
Event date unknownBrazilUnidentified facial recognition system
The Espírito Santo Civil Police (Defa, the fraud and forgery unit) said a 27-year-old man was arrested on a warrant in Serra on 22 September 2026, suspected of defrauding a personal trainer of more than R$100,000. According to the police, the suspect offered a car in exchange for the victim's motorcycle; during the negotiation he persuaded the victim to perform a facial-recognition procedure, saying it was needed to transfer the car's ownership; the biometric was later used to contract a vehicle financing in the victim's name without his authorisation, and weeks after the exchange the victim discovered that the car he had received did not belong to the suspect and was a rental. The loss, combining the motorcycle and the fraudulently contracted financing, exceeded R$100,000. The suspect, who police say had been arrested in São Paulo in July 2025 in a 'love scam' case, was taken to the Centro de Triagem at the Rodrigo Figueiredo da Rosa prison complex and remains at the disposal of the courts. The financing provider and the facial-recognition system are not identified, and the reports do not say how the captured biometric was used to pass the financing.
Contextual tracker case Medium reported severity Criminal Charges
AI involvement reported · Causal attribution alleged · 4 sources, 1 underlying account · Added 26/09/2026
Event date unknownEvent location unknownChatGPT
Barnevakten, a Norwegian child-safety organisation, reported on 23 September 2026 that one of its staff members was suddenly told by ChatGPT that their account was now in teen mode. ChatGPT's own pages, as described by Barnevakten, say the system turns the filter on when a user's behaviour indicates an age under 18, reducing sensitive or potentially harmful content (graphic violence, viral challenges, sexual or violent role-play, extreme beauty ideals) and offering parental controls and a study mode. Because there is no age check at sign-up, the system estimates age afterwards from conversation topics and times of use, and Barnevakten notes that such guesses can be wrong. An adult who wants out of teen mode can go through an age check run by the company Persona, which depending on the country asks for a real-time selfie and a government ID; Barnevakten questions whether that process is privacy-safe (Persona's terms mention retention of up to three years) and advises using only age checks one trusts. The account's own experience is limited to the unexpected switch and the verification route; no further consequence is described.
Core + contextual relations Low reported severity Media Coverage
AI involvement supported · Causal attribution supported · 1 source · Added 24/09/2026
24 Jul 2026 to 26 Jul 2026IndiaUnidentified facial recognition system
In an affidavit of 17 August 2026 before the Supreme Court of India, Delhi Police said its Facial Recognition System (FRS) had identified 2,873 people with criminal antecedents at the Jantar Mantar protests of 20 to 26 July 2026 (2,402 through its 'Crime Kundli' biometric database and 471 through other criminal records). On 1 September the Court quashed the FIRs against the student protesters but let the police proceed against the 2,873; the police say any action will follow field verification. The Indian Express checked the 205 listed people facing murder, attempted-murder, rape or child-sexual-offence charges against police, prison and court records and found that at least 25 of them (17 accused of murder, four of rape (two or three under POCSO; the Express's narrative and its list differ), four of attempted murder) were lodged in Delhi's Tihar, Mandoli or Rohini prisons when the system logged them at the protest site with timestamps on 24, 25 and 26 July; some had been in custody for years. Delhi Police told the newspaper that further verification of the 2,873 was pending and, in its affidavit, that no action is taken solely on a facial-recognition result and that field verification follows each match. The police disclosed in 2022, in reply to a Right to Information request, that it treats a match with an 80 per cent similarity score as positive. Whether any of the 25 has since been named in the fresh FIR or visited for verification is not reported.
Contextual tracker case Medium reported severity Investigation Opened
AI involvement reported · Causal attribution supported · 4 sources, 2 underlying accounts · Added 24/09/2026