Event date unknownEstoniaUnidentified AI web service
In its overview of personal-data breach notifications for the third quarter of 2026, published on 8 October 2026, Estonia's Data Protection Inspectorate (AKI) listed a case in which a bank employee uploaded employment contracts to a widely used AI web service, making them available to other employees who used the same AI account. Answering questions from the technology outlet Geenius, AKI said the employment contracts of a few individual employees had been entered into the AI system and became accessible to other employees using the same account; Geenius reports that those colleagues could view and download them. According to the report, the bank informed the people affected and blocked its employees from using that AI system. AKI did not name the bank, the AI service or further circumstances.
Contextual tracker case Low reported severity Internal Action
AI involvement supported · Causal attribution supported · 2 sources, 1 underlying account · Added 31/10/2026
Dec 2025 to Aug 2026United StatesPega Voice AI (reported)
Four U.S. Bank account holders in California, Massachusetts and Pennsylvania allege in a federal class action filed on 2 October 2026 that Pegasystems' Pega Voice AI, which they say U.S. Bank uses in its contact centres, transcribed their customer-service calls in real time, analysed them with natural language processing and generated suggestions to the agent, without their prior consent. They say they gave account numbers, a date of birth and a home address on the calls, made between about December 2025 and August 2026. The claims are allegations; The CourtListener index of the docket, checked on 21 October 2026, listed the summons as returned executed on 16 October and no response from Pegasystems.
Contextual tracker case Low reported severity Lawsuit Ongoing
AI involvement reported · Causal attribution alleged · 1 source · Added 21/10/2026
8 Oct 2026IsraelUnidentified AI tool
On 8 October 2026 the Magistrates' Court in Nof HaGalil-Nazareth, Israel, struck from the file a banking expert's opinion that a defendant in a civil negligence suit had filed, finding that the heart of the opinion and its annexes rested on clear 'AI hallucinations': a Supreme Court ruling the court could not locate, a book it could not find and statutory sections quoted with text the statute does not contain. The court also refused the defendant's request to amend her third-party notice against two banks, partly because the amendment relied on the struck opinion, and ordered her to pay costs of 2,500 shekels to each bank. No AI tool is named, and the decision records no response from the expert.
Contextual tracker case Medium reported severity
AI involvement supported · Causal attribution supported · 1 source · Added 16/10/2026
Event date unknownBrazilUnidentified facial recognition system
Folha Vitória reported on 29 September 2026, citing the Espírito Santo Civil Police, that a 39-year-old man was arrested on 28 September on a preventive warrant after an inquiry into qualified theft by electronic fraud against an 81-year-old man in the north-west of the state. According to the police, the suspect, who worked as a security guard at a dance venue, invited the man to his home on the pretext of making a free-entry card, kept his bank card, obtained personal data and photographed his face. The police say he used the images to get past the facial recognition of the banking app and enable access to the account on his own phone, then reset security passwords, redeemed investments and made Pix transfers without the victim's knowledge, diverting R$6,080. The victim is described as illiterate. The police say the suspect had prior records and was serving a sentence under a progressive regime. Folha do ES and Tribuna Norte Leste carried the same police account but could not be read.
Contextual tracker case Low reported severity Criminal Charges
AI involvement reported · Causal attribution alleged · 1 source · Added 07/10/2026