Aug 2026Event location unknownUnidentified OpenAI generative AI service (reported)
A local-government employees' mutual aid association said in a notice dated 4 September 2026 that RIZAP, the company it contracts for specific health guidance, had reported that on 20 August 2026 it emerged that a RIZAP staff member, during data-extraction work, had entered data containing personal information into an external generative AI service that RIZAP did not permit. The association says 726 of its members across 14 branches are covered and lists the data as membership numbers, email addresses, names, dates of birth, sex, some addresses and phone numbers, the type of health guidance and, for members with them, high blood pressure, diabetes or dyslipidaemia. The IHI group health insurance society reported 210 of its members in a 2 September notice that, according to a security news site, names OpenAI as the provider, says the matter came to light through the employee's own report, and says OpenAI answered on 1 September that the data had not been used for model training. RIZAP's own release, as described in an ITmedia column, says the information was uploaded by mistake to a generative AI service the employee used privately, and that the company confirmed no possibility of viewing by third parties other than the service operator or of use in training. Whether the provider's staff could view the data was still being checked when the insurers published.
Contextual tracker case Medium reported severity
AI involvement reported · Causal attribution supported · 3 sources · Added 12/10/2026
29 Apr 2026Event location unknownChatGPT
Community First Health Plans, a nonprofit health plan in San Antonio, Texas, said in a 29 June 2026 release that on the evening of 29 April 2026 one of its employees uploaded a file containing personal information of some members to ChatGPT from a home computer network, circumventing the plan's firewall safeguards and violating its policy. The plan says it does not use ChatGPT and that its systems detected the violation and alerted its IT department. According to the release, the file may have included members' names, addresses, dates of birth, member identification numbers and prescription drug information. The next morning the plan revoked the employee's access, directed and verified deletion of the data from the employee's ChatGPT account, asked OpenAI to delete any related data, and ended its relationship with the employee. It notified affected members and federal and state agencies, offered 12 months of identity monitoring and says it is not aware of any misuse. The release gives no number of affected members.
Contextual tracker case Medium reported severity
AI involvement reported · Causal attribution supported · 1 source · Added 12/10/2026
13 Aug 2026 to 8 Sept 2026United StatesSentinel AI (reported)
NorthJersey.com reported on 5 October 2026 that a former remote employee of Sutherland Healthcare Solutions, based in Clifton, New Jersey, sued the company in New Jersey Superior Court in Atlantic City on 23 September 2026. According to the complaint as reported, the employer told the employee it would start monitoring her through her work laptop's webcam with software called Sentinel AI, which would use AI and facial recognition to confirm that she was the person at the desk, taking 160 still images in an eight-hour shift. The employee raised concerns in writing about the AI seeing inside her home and about whether the data would be securely stored, said the monitoring had increased her anxiety and stress and worsened a medical condition, and asked for a full or partial exemption as a reasonable accommodation. The suit says the request was denied, she was given a 24-hour ultimatum on 13 August 2026 to submit to the monitoring or resign, an offer to avoid the software by commuting to the office was rejected because it would require six hours of travel time, and her employment was terminated on 8 September 2026. The suit alleges that the employer violated New Jersey's anti-discrimination laws and retaliated against her for requesting reasonable accommodations. Sutherland did not respond to the outlet's requests for comment, and the allegations have not been tested in court.
AI relation unknown Medium reported severity Lawsuit Filed
AI involvement reported · Causal attribution alleged · 1 source · Added 06/10/2026
25 Apr 2026SingaporeUnidentified code-generation tool
On 25 April 2026 Bee Cheng Hiang, the Singapore bak kwa and food products company, sent a marketing email in batches of 1,000 with every recipient's address visible in the To field, so each affected member's email address was disclosed to up to 999 other recipients. Mothership, reporting the findings of the Personal Data Protection Commission (PDPC), puts the number of affected members at 95,364 (The Straits Times says more than 95,000), and the PDPC says email addresses were the only personal data involved. According to the PDPC, an employee had written the email distribution script with a generative AI tool and the prompt did not ask for recipients to be hidden from one another. Mothership reports that a missing bracket in the generated code grouped each batch into one To field. The PDPC says the AI tool did not malfunction and attributes the breach to human error in developing the code with an AI tool. It says the incident likely happened because the company did not test the script sufficiently, had no supervisory review of the employee's work and had no policy on staff use of generative AI. It reports no evidence of further misuse. The company notified the PDPC on 27 April, notified affected members, and gave a voluntary undertaking that the PDPC accepted on 2 September. The PDPC told The Straits Times it was the first AI-related data breach reported to it.
AI relation unknown Low reported severity Regulatory Action
AI involvement supported · Causal attribution supported · 3 sources, 1 underlying account · Added 02/10/2026
20 Jul 2026BangladeshUnidentified voice-cloning tool
According to a press release from Special Response Battalion-13 (SRB-13), relayed by Ajker Patrika, DBC News and NTV, on 20 July 2026 a man who works at the Natore Sadar upazila health complex received a call saying that his younger son had been arrested by police with drugs. The callers then used AI to imitate the son's voice so that the father believed the story, and demanded money to get the son released. He sent a total of Tk 40,000 in two payments through the mobile financial service Nagad, and realised it was a fraud when he reached his son directly. He filed a fraud case at Natore Sadar police station on 25 September 2026. That evening SRB-13 arrested two men, described as the ring's leader and an associate, at their homes in Gobindaganj, Gaibandha, seizing nine mobile phones, a passport and Tk 14,100 in cash; SRB says they admitted involvement during initial questioning and handed them to the police for further legal action, and NTV reports they were sent to Gaibandha district jail through the court on 26 September.
Core concern Low reported severity Criminal Charges
AI involvement reported · Causal attribution alleged · 3 sources, 1 underlying account · Added 01/10/2026
17 Jan 2026GermanyUnidentified video tool
Welt, dpa (in Tagesspiegel, news.de and t-online) and a press release of the CDU parliamentary group in the Lower Saxony state parliament report the following. On 17 January 2026 an employee of the parliamentary group posted a short AI-generated video showing a colleague in a sexualized manner in a private WhatsApp group connected to the group's staff. The Hannover public prosecutor's office had viewed the video, and a spokesperson said it was obviously an AI montage. After the group's leaders were informed (on 27 March according to press reports), the employee who created the video was dismissed without notice and a second employee, who had reportedly asked chat members in January to delete the video and keep silent, was suspended. The group informed the prosecutor's office, which said, as reported on 1 April 2026, that it had received no criminal complaint. On 9 July 2026 dpa reported, citing the prosecutor's office, that the Wennigsen local court had fined the former employee, who had made the video with the colleague's picture without consent and shared it in a chat group, 30 daily rates for a violation of the Kunsturhebergesetz, and that the decision is final. NDR reported on 10 April 2026 that the depicted employee had filed a criminal complaint, that the prosecutor's office had received the employee's application for prosecution, and that the employee did not want to comment publicly. The colleague and the former employee are not named.
Core concern Medium reported severity
AI involvement reported · Causal attribution alleged · 6 sources, 4 underlying accounts · Added 30/09/2026
23 Mar 2026 to 24 Mar 2026United StatesUnidentified voice-cloning tool
The Spokesman-Review (8 May 2026) reported that a 75-year-old man in Washington state took a call on Monday 23 March in which a crying voice presented as the man's adult daughter said an accident had happened and asked for help. Male voices then described a collision and said the daughter had been taken hostage. The newspaper states that the daughter's voice on the call was an AI-generated copy and that investigators later surmised the callers used a recording of the daughter's voice with a program that mimicked the speech pattern. Over about 30 hours the callers directed the man to banks and stores in Washington and Idaho, where $13,000 was wired. The man was about to withdraw $17,000 when a bank employee stalled and police were alerted, and police then reached the daughter, who confirmed being at home and safe. The newspaper says none of the wired money had been recovered when the article was published. The man says it took days to start feeling normal again. The report rests on the man's account, a bank employee's account and a police report quoted by the newspaper. The article gives the call date as Monday 23 March without a year. The record uses 2026 because 23 March fell on a Monday only in 2026 among the years 2023 to 2026. The range starts at 2023 because the article says the Federal Trade Commission began warning about AI voice-copy scams as early as 2023, and it ends at 2026 because the article was published on 8 May 2026.
Core concern Medium reported severity
AI involvement reported · Causal attribution alleged · 2 sources, 1 underlying account · Added 30/09/2026
16 Apr 2026KenyaMeta AI (reported)
On 16 April 2026 Sama, an outsourcing company with operations in Nairobi that did AI data-annotation work for Meta, announced that Meta had given formal notice ending its contract and that a redundancy process would affect more than 1,000 employees. Sama put the figure at 1,108 workers, and the Oversight Lab said the workers had six days' notice. The decision came less than two months after the SvD and GP investigation in which Sama annotators said they had seen intimate footage from users of Meta's AI glasses. Meta said it paused its work with Sama the month before while it looked into those claims and then decided to end the work because Sama does not meet its standards. Sama says it was never notified of any failure to meet those standards. A Kenyan workers' organisation alleges Meta's decision was caused by staff speaking out, which Meta had not addressed when the BBC reported it on 30 April 2026. Employees told SvD that Sama tightened security and tried to identify who had spoken to journalists, which Sama denies. The workers are described by role and are not named.
AI relation unknown Medium reported severity
AI involvement disputed · Causal attribution disputed · 5 sources, 4 underlying accounts · Added 29/09/2026
Feb 2026Event location unknownClaude Cowork
In February 2026 Nick Davidov, a venture capitalist, posted on X that Anthropic's Claude Cowork agent, which he had asked to organise his wife's desktop, deleted a folder holding all the photos his wife had taken on her camera over the previous 15 years. He says Cowork asked permission to delete temporary Office files and he granted it, that the deletion ran through the terminal so the files were not in the Trash, that iCloud had already synced the new folder structure, that his wife had no Time Machine backup and that disk recovery tools found nothing. Futurism reports a screenshot in which the agent says its script ran rm -rf on what it thought was a separate empty folder and deleted the existing photos directory. Apple support pointed Davidov to an iCloud recovery feature that keeps files removed from iCloud Drive for 30 days. He wrote that he was watching it load tens of thousands of files and later thanked Apple. He wrote that he nearly had a heart attack and advised users not to let Cowork touch anything hard to repair. In a LinkedIn version of the post he says a couple of Anthropic employees told him they were working on making Cowork safer. Every account traces to Davidov's own posts.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 6 sources, 1 underlying account · Added 29/09/2026
Feb 2026Event location unknownUnidentified AI writing and image tools
In February 2026 Insider Gaming and the A.V. Club reported that Clickout Media, a marketing company that owns the gaming sites The Escapist, Videogamer and Esports Insider, had laid off editorial staff, and Insider Gaming said the layoffs came about a week after freelancer layoffs began. Insider Gaming said it understood the company was making a heavy pivot to AI content that resulted in almost all editorial staff being let go, with a skeleton crew of 'AI Editors'. Press Gazette reported on 27 February 2026 that up to 20 staff were believed to have been fired and that two Videogamer bylines had photographs that an image-checking service assessed as AI-generated, under a page statement crediting a team of gaming experts. Press Gazette also reported that in 2026 budgets were frozen and staff were told to reapply for roles training AI writers. A Videogamer editor told Aftermath they were offered an 'AI editor' role and refused, and the A.V. Club reported that editor posted that they and their team were laid off. An Escapist writer said their role was up for redundancy. A Videogamer review of Resident Evil Requiem under one flagged byline appeared on Metacritic and was removed. Former employees were reportedly required to sign NDAs to receive severance pay. Clickout Media had not responded to Insider Gaming or Press Gazette at publication, and Aftermath reported no response to its questions about AI-generated author images. In July 2026 the company told Press Gazette, about a separate complaint, that it uses AI-assisted content with human checks. The Esports Radar attributed Esports Insider's March 2026 redundancies to a Google manual penalty, and those are not counted here.
Core concern Medium reported severity
AI involvement reported · Causal attribution alleged · 7 sources, 6 underlying accounts · Added 29/09/2026
20 May 2026United StatesMeta internal AI systems (reported)
On 20 May 2026 Meta began notifying about 8,000 employees (roughly 10 percent of its workforce) that they had been selected for layoff. On 13 July 2026 twenty-six anonymous employees who had taken or requested medical, pregnancy, parental or family leave, or a disability accommodation, sued Meta in the US District Court for the Northern District of California. The complaint alleges, on information and belief, that Meta used internal AI-assisted systems (including the Metamate assistant, keystroke and activity monitoring, AI-token-usage dashboards and algorithmic performance ranking) to score, rank and select employees, and that these inputs could not accumulate during protected leave, so plaintiffs on leave were disproportionately selected. Meta says workforce decisions were made by people, not AI, and that no selection decision was made by AI. On 17 July 2026 the court denied a temporary restraining order, recording that the parties dispute whether Meta used AI in the terminations and finding serious questions on the merits but no shown likelihood of success. One plaintiff was voluntarily dismissed on 3 August 2026. The preliminary injunction motion was argued on 24 August 2026 and taken under submission. The plaintiffs are pursuing their merits claims in arbitration and the allegations are unproven.
Contextual tracker case Medium reported severity
AI involvement disputed · Causal attribution disputed · 10 sources, 5 underlying accounts · Added 29/09/2026
1 Apr 2026 to 22 Jun 2026United StatesMeta Model Capability Initiative
From April 2026 Meta installed its Model Capability Initiative (MCI) on US employees' work computers, recording mouse movements, clicks, keystrokes and screen content on designated apps and sites so that its AI agents could learn how people use software. Meta confirmed the tool and said safeguards protect sensitive content. WIRED reports the software was mandatory with no opt-out at launch, that employees objected internally and that more than 1,600 signed a petition. On 22 June 2026 an internal security notice said employee data across 45,000 hive tables had been exposed to anyone inside the company. Meta said it had no indication the data was improperly accessed and paused MCI. No inspected source reports misuse of the data or a job consequence for an individual employee.
AI relation unknown Low reported severity
AI involvement reported · Causal attribution unclear · 7 sources, 4 underlying accounts · Added 29/09/2026
11 Sept 2026 to 23 Sept 2026United States, CanadaChatGPT
The chief executive of Family First Credit Union in Saginaw, Michigan, told WJRT (ABC12) that before boarding a flight to Halifax, Nova Scotia, on 11 September 2026 she and family members took a photo and put it through ChatGPT to show them wearing 'Lake America' sweatshirts, a joke about the US president's order renaming Lake Ontario. She posted it to her private Facebook page with a marker saying it contained AI content; her sister reposted it publicly without the marker while they were in Halifax, and it spread in Canada as if the family had worn the shirts. The backlash concerned the image's political message; she said she would understand the anger of anyone in Halifax who thought the family had walked in wearing those sweatshirts. She said she was getting death threats and the family returned early; by 16 September she was back in the US. She called the post poor judgment, said she would not use AI again and that AI 'can make people think something's real that's not'. On 23 September the credit union said she was no longer an employee, effective immediately; it has not said whether she resigned or was dismissed, or why.
Core concern Medium reported severity Internal Action
AI involvement reported · Causal attribution unclear · 5 sources, 1 underlying account · Added 28/09/2026
4 Jan 2026IndiaUnidentified image tool
From 4 January 2026 several employees of a Chennai company received follow requests from unknown Instagram accounts that then circulated defamatory content, including obscene AI-morphed images of a senior woman employee. On her complaint the State Cyber Crime Investigation Centre of the Tamil Nadu police traced the digital footprints, social-media activity and IP logs to a former employee of the same company who had resigned in October 2025 and, according to police, acted out of resentment and previous enmity to threaten, harass and publicly humiliate the victim; she had taken the photographs from the company's official website and morphed them using various artificial-intelligence applications. She was arrested, produced before a magistrate and remanded in judicial custody; the police press release was reported on 4 and 5 February 2026 and the cyber-crime DGP issued a public warning about social-media misuse. The victim alleged the images were circulated to damage her reputation and cause mental distress.
Core concern High reported severity Criminal Charges
AI involvement reported · Causal attribution supported · 3 sources, 1 underlying account · Added 15/06/2026