Event date unknownEstoniaUnidentified AI web service
In its overview of personal-data breach notifications for the third quarter of 2026, published on 8 October 2026, Estonia's Data Protection Inspectorate (AKI) listed a case in which a bank employee uploaded employment contracts to a widely used AI web service, making them available to other employees who used the same AI account. Answering questions from the technology outlet Geenius, AKI said the employment contracts of a few individual employees had been entered into the AI system and became accessible to other employees using the same account; Geenius reports that those colleagues could view and download them. According to the report, the bank informed the people affected and blocked its employees from using that AI system. AKI did not name the bank, the AI service or further circumstances.
Contextual tracker case Low reported severity Internal Action
AI involvement supported · Causal attribution supported · 2 sources, 1 underlying account · Added 31/10/2026
1 Mar 2023 to 22 Jun 2023Event location unknownChatGPT
In a passenger's personal-injury suit against the airline Avianca in the US District Court for the Southern District of New York, an opposition brief filed on 1 March 2023 cited judicial opinions that did not exist. The court found that the lawyer who did the research had used ChatGPT, which fabricated the cases, and that when he asked the chatbot whether one of them was real it replied that it had supplied real authorities that could be found on legal databases. On 22 June 2023 the court found bad faith by the two lawyers, based on their conduct after the citations were questioned, and imposed a USD 5,000 penalty jointly on them and their firm, together with letters to the client and to each judge falsely named as an author of the fake opinions.
Core + contextual relations Medium reported severity Regulatory Action
AI involvement supported · Causal attribution established · 2 sources · Added 28/10/2026
2024United StatesGaggle
The Lawrence, Kansas, school district began using Gaggle, a student-monitoring service, on school accounts in November 2023. A federal lawsuit filed on 1 August 2025 by current and former students alleges that Gaggle, which the complaint says operates through artificial intelligence that flags items for review by Gaggle moderators, flagged original photography assignments uploaded by art and photography students. According to the complaint, in early 2024 security officers took students out of class to the front office of a Lawrence high school, where administrators told them their images had been flagged by Gaggle for indecent exposure and child pornography; an assistant principal accused a photography student of having such material, refused to let her view the images, and questioned her about them from memory, and administrators admitted they had not seen the flagged content. The student told them she had uploaded that day a photography assignment showing a fully clothed friend; the complaint says the flagged content consisted of original photographs taken for class assignments, that students found their photographs removed from their school accounts only by comparing them with personal backups, that one student had to explain each image in her portfolio to district staff and became concerned that future assignments would bring more scrutiny, and that the district restored the images only after months of advocacy. The Associated Press, in reporting that included an analysis of the district's Gaggle alert records, said the photos had been automatically deleted and that students with backups showed it was a false alarm, and that district officials said they later adjusted the software's settings to reduce false alerts. On 8 April 2026 the federal court dismissed, on qualified immunity, the claims against the assistant principal and another official, saying it had found no law establishing that a school official cannot rely on an AI surveillance flag to call in a student for questioning; other claims against the district continue, and the docket shows depositions noticed in October 2026.
Contextual tracker case Medium reported severity Lawsuit Ongoing
AI involvement reported · Causal attribution alleged · 5 sources · Added 27/10/2026
2024GermanyMicrosoft Copilot
A court reporter from the Tübingen area found in 2024 that Microsoft's Copilot, asked about him, described him as a man charged in a child abuse case, an escapee from a psychiatric institution and a fraudster who cheated widows, according to his account to the public broadcaster SWR as relayed by heise and ComputerBild. All were defendants in trials he had covered as a journalist. heise and ComputerBild, both citing SWR, report that Copilot also gave his private phone number and full home address and offered a route there. He told The Register that seeing his name tied to these crimes was traumatising and that prosecutors had rejected his criminal complaint in two instances; according to the SWR account relayed by heise, the complaint failed because no real person was the author. After the Bavarian data-protection authority contacted Microsoft the claims were briefly unavailable and then returned. Microsoft told The Register it had investigated and taken appropriate and immediate action.
Contextual tracker case Medium reported severity Internal Action
AI involvement supported · Causal attribution supported · 4 sources, 3 underlying accounts · Added 25/10/2026
23 Oct 2026SpainPangram AI-text detector
El País checked the winning novel of the first Almadía Ventosa-Arrufat short-novel prize (20,000 euros; the rules banned generative AI) with the Pangram AI-text detector, which scored 99% of the roughly 26,000-word text as AI-generated, according to outlets relaying the investigation. El País passed its suspicions to the Mexican publisher Almadía, which on Friday 23 October 2026 announced a detailed review, saying it would not anticipate conclusions, and suspended all activities presenting the book, including a planned tour in Madrid, Barcelona, Seville and Cádiz. The publisher said the Peruvian author had declared in his contract and personally that he did not use AI, and that neither the jury nor its editors had seen signs of AI use. In a statement on Instagram reported by La Nación on 29 October 2026, the author said he conceived, wrote and revised the novel without generative AI tools and was gathering earlier manuscript versions, his notebook and research materials to give to the publisher for its review. Writers objected that a detector score is not conclusive proof of authorship. Whether AI was used is unestablished.
Contextual tracker case Low reported severity Investigation Opened
AI involvement reported · Causal attribution supported · 5 sources, 4 underlying accounts · Added 25/10/2026
20 Oct 2026Event location unknownUnidentified video tool (suspected)
On 20 October 2026, during early voting in Texas, a newly created X account posted two videos in which a man presented himself as a former student of James Talarico, the Democratic US Senate candidate and a former middle-school teacher, and accused him of sexual assault in 2012. The threat-intelligence firm Graphika said the account very likely impersonated a real Facebook user of the same name who had been Talarico's student and had praised him, assessed the videos as very likely deepfakes because the face moved unnaturally or out of sync with the audio and AI analysis tools indicated AI generation, and attributed them with high confidence to the Russia-aligned influence operation Storm-1516. PolitiFact reported that NewsGuard found many signs of AI generation and a 98 percent detector score, and that the real former student told the fact-checkers Lead Stories the video was not of him and denied accusing Talarico. Talarico's campaign said he was being slandered with AI deepfakes, foreign bots and conspiracy theories. PolitiFact rated the claim Pants on Fire. Who made the videos and how many people saw them is not established.
Core + contextual relations Medium reported severity Media Coverage
AI involvement suspected · Causal attribution supported · 2 sources · Added 25/10/2026
13 Apr 2024BrazilUnidentified facial recognition system
During the half-time interval of the Sergipe state football championship final at the Batistão stadium in Aracaju on 13 April 2024, military police took a personal trainer from the stands to a police room after the stadium's facial recognition system flagged him as a man with an open arrest warrant; he was searched and questioned and released once police confirmed he was not the person sought (G1, his lawyer and the military police). Sergipe's governor publicly regretted 'the failure of the facial recognition tool' and suspended its use until a new protocol was adopted. In June 2024 the man sued the state for 550,000 reais in moral damages; the state argued that the Aracaju municipality, not the state, had contracted the system. In December 2025 the judge rejected that preliminary objection, according to Mangue Jornalismo, which read the court file. No final judgment is reported.
Contextual tracker case Medium reported severity Lawsuit Ongoing
AI involvement reported · Causal attribution supported · 3 sources, 2 underlying accounts · Added 24/10/2026
Event date unknownEvent location unknownUnidentified chatbot
Panasonic Operational Excellence, a Panasonic Holdings subsidiary, announced on 23 October 2026 that a member of an in-house project introducing a personnel information system had uploaded part of that system's data, as registered in April 2026, to an external generative AI service whose use the company prohibits. According to the announcement as reported by ITmedia and CNET Japan, the data covered about 75,000 current and about 178,000 former employees of Panasonic group companies in Japan (employee numbers, addresses, phone numbers and email addresses, without names) and about 81,000 family members registered as emergency contacts (names, addresses, phone numbers and email addresses), about 334,000 people in all. The company says the upload broke internal rules and was not an outside attack, that the employee deleted the chat history and the local data immediately after the problem came to light, and that it reported the matter to Japan's Personal Information Protection Commission on 29 September. The provider told the company that training on the data was switched off at upload but that deleted data is kept for 30 days, until 25 October. No public exposure or misuse had been confirmed. The company has not named the AI service.
Contextual tracker case Medium reported severity
AI involvement reported · Causal attribution supported · 3 sources, 1 underlying account · Added 24/10/2026
Sept 2023AustraliaChatGPT
Victoria's Information Commissioner (OVIC) found in a report published on 24 September 2024 that a child protection worker at the Department of Families, Fairness and Housing (DFFH) used ChatGPT in or around September 2023 to draft a Protection Application Report submitted to the Children's Court about a young child. On the balance of probabilities, OVIC found the worker entered personal information, including names, about the child, mother, father and carer, disclosing it to OpenAI; the worker admitted using ChatGPT but denied entering personal information. OVIC found generated content in the report described a doll that the father had reportedly used for sexual purposes as a parental strength ('age-appropriate toys'), downplaying the risk to the child, although the court's and the department's decisions did not change. The report was withdrawn and replaced, and the mother, father and carer described anxiety when told of the disclosure. OVIC found serious breaches of two privacy principles and issued a compliance notice requiring DFFH to ban and block generative AI text tools for child protection staff until November 2026; DFFH accepted the breach findings.
Contextual tracker case Medium reported severity Regulatory Action
AI involvement supported · Causal attribution supported · 2 sources, 1 underlying account · Added 22/10/2026
23 Sept 2024CanadaOtter.ai (reported)
An Ontario hospital reported to the provincial privacy commissioner that on 23 September 2024 the Otter.ai transcription tool, installed on a personal device by a physician who had left the hospital in June 2023 and was still on the meeting invite, joined a virtual hepatology rounds meeting, recorded it without notice and then emailed a summary and transcript access to the invite list. The personal health information of seven patients, including diagnoses and treatment, was captured; 12 of the 65 recipients appeared to have left the hospital. The commissioner's letter of 27 October 2025 recommended that the hospital itself ask Otter.ai to delete the retained patient data.
Contextual tracker case Medium reported severity Regulatory Action
AI involvement supported · Causal attribution supported · 3 sources, 1 underlying account · Added 21/10/2026
Aug 2026Event location unknownGoogle AI Mode
In late August 2026 a colleague told a German physician, until that summer a chief physician at a hospital, that searching his name with the word for suspension in Google's AI Mode produced what read like a factual report: that he had been suspended and dismissed and had received a suspended sentence for sexual coercion. According to legal news site beck-aktuell, none of it concerned him; the AI had apparently attached facts about another former senior employee of the same hospital to his name, and the newspaper articles it linked as sources did not name him. Google said it had reviewed his complaint and would take no action, and a lawyer's warning letter also failed. On 24 September 2026 the Aachen Regional Court issued a preliminary injunction (8 O 268/26) barring Google Ireland Limited from spreading the claims through AI Mode, finding that they violated his personality rights and that Google is responsible for its AI search answers.
Contextual tracker case Medium reported severity Lawsuit Ongoing
AI involvement supported · Causal attribution established · 2 sources, 1 underlying account · Added 15/10/2026
Aug 2026Event location unknownUnidentified OpenAI generative AI service (reported)
Notices from RIZAP's client insurers say that on 20 August 2026 it emerged that a staff member of RIZAP, the company they contract for specific health guidance, had entered data containing members' personal information into an external generative AI service that RIZAP had not permitted for work. The National Civil Engineering and Construction National Health Insurance Association (Doken Kokuho) puts the whole data set at 19,996 people, 1,167 of them its own members, and says the service was not under a corporate contract and that the matter was found when the employee noticed the transmission and reported it. A local-government employees' mutual aid association counts 726 of its members across 14 branches, and the IHI group health insurance society 210, according to a security news site that reads these as subsets of the 19,996. The data included membership numbers, email addresses, names, dates of birth, sex, some addresses and phone numbers, the type of health guidance and, for members with them, high blood pressure, diabetes or dyslipidaemia. The IHI society's notice, as relayed, names OpenAI as the provider and says OpenAI answered on 1 September that the data had not been used for model training. RIZAP's release, as described in an ITmedia column, says no third party other than the service operator could have viewed the data. Doken Kokuho says RIZAP confirmed to it that no third party viewed or used the information through the service; whether the provider's staff could view it was still being checked when the mutual aid association and the IHI society published.
Contextual tracker case Medium reported severity
AI involvement reported · Causal attribution supported · 5 sources, 4 underlying accounts · Added 12/10/2026
23 Sept 2025 to 23 Oct 2025NetherlandsChatGPT (reported)
The municipality of Eindhoven in the Netherlands told its council in an information letter shared on Thursday 18 December 2025 that a sample of staff data traffic from 23 September to 23 October 2025 showed files containing personal data of residents and employees had been sent to public AI websites such as ChatGPT, according to Omroep Brabant and Binnenlands Bestuur. The files included youth-care (Jeugdwet) documents, internal reports and CVs, mostly from departments that provide care and support to residents. According to Omroep Brabant's account of findings by the advisory firm Hooghiemstra & Partners, the youth-care documents held information about the mental and physical health of minor children, and social-support (WMO) documents and applicants' CVs were also entered. The municipality reported the breach to the Dutch Data Protection Authority on 23 October, blocked public AI websites and asked OpenAI to delete the files. The council says the scale cannot be determined because the data was kept for only 30 days, so it cannot inform those affected, and that the risk of misuse is limited but cannot be ruled out. A spokesperson said OpenAI had not yet replied.
Contextual tracker case High reported severity
AI involvement reported · Causal attribution supported · 3 sources, 2 underlying accounts · Added 12/10/2026
29 Apr 2026Event location unknownChatGPT
Community First Health Plans, a nonprofit health plan in San Antonio, Texas, said in a 29 June 2026 release that on the evening of 29 April 2026 one of its employees uploaded a file containing personal information of some members to ChatGPT from a home computer network, circumventing the plan's firewall safeguards and violating its policy. The plan says it does not use ChatGPT and that its systems detected the violation and alerted its IT department. According to the release, the file may have included members' names, addresses, dates of birth, member identification numbers and prescription drug information. The next morning the plan revoked the employee's access, directed and verified deletion of the data from the employee's ChatGPT account, asked OpenAI to delete any related data, and ended its relationship with the employee. It notified affected members and federal and state agencies, offered 12 months of identity monitoring and says it is not aware of any misuse. The release gives no number of affected members.
Contextual tracker case Medium reported severity
AI involvement reported · Causal attribution supported · 1 source · Added 12/10/2026
10 Mar 2026Event location unknownGrok
On 10 March 2026, according to CH Media reporting published by watson, a Swiss X user taking part in a "roast" thread asked xAI's chatbot Grok to attack Federal Councillor Karin Keller-Sutter, Switzerland's finance minister, in hard street slang. Grok agreed and posted a reply on X with vulgar insults, attacks on her body and character, and degrading, sexualised language. The Aargauer Zeitung reported that the output was publicly visible and shareable, that Keller-Sutter learned of it the next day, and that the post was deleted shortly afterwards; watson reported that the user deleted his prompt and Grok's reply. The finance department first said she was having a criminal complaint for insult examined. Keystone-SDA later reported that she had filed a criminal complaint against unknown persons and that the Bern public prosecutor's office had opened an investigation for insult and defamation. Her spokesperson said such misogyny must not be seen as normal or acceptable. The user told Tamedia, as relayed by the Aargauer Zeitung, that it was a harmless technical exercise. No outcome of the investigation is reported.
Contextual tracker case Low reported severity Investigation Opened
AI involvement reported · Causal attribution supported · 4 sources, 2 underlying accounts · Added 12/10/2026
26 Jun 2025 to 17 Nov 2025United KingdomUnidentified AI tool
Judicial review grounds lodged in the Upper Tribunal (Immigration and Asylum Chamber) on 26 June 2025 by a solicitors' firm cited four authorities that the judge could not find or that carried wrong citations and propositions. The firm's compliance officer, a solicitor whose name was on the claim form, said a junior fee-earner had drafted the grounds under his supervision; his written explanation named an outdated precedent, practitioner blogs and personal notes as the sources. After a Hamid hearing on 5 November 2025, the tribunal recorded that he accepted the fee-earner had relied on false citations generated by AI, and in a judgment promulgated on 17 November 2025 it referred him to the Solicitors Regulation Authority for the false citations and his failure to supervise. The tribunal said it does not matter how such errors come about. It also announced that the Upper Tribunal judicial review claim form now requires a statement of truth that cited authorities exist and support the propositions they are cited for.
Contextual tracker case Medium reported severity Regulatory Action
AI involvement reported · Causal attribution supported · 1 source · Added 12/10/2026
11 Apr 2026 to 11 Oct 2026Event location unknownChatGPT
In a Reddit post of 11 October 2026, a ChatGPT Plus subscriber who says they are an adult (36, by the post's own account) writes that when OpenAI's age checks rolled out their account was classified as a teen account and put on a restricted account. The poster says they had earlier emailed OpenAI asking for verification options without ID or a photo, received a canned reply about the verification provider Persona, and on escalating to data protection was told they had to be profiled first. The poster says they then cancelled the subscription. OpenAI's Help Center says ChatGPT uses an age prediction system that reads account signals, automatically enables the teen experience when it predicts an account may belong to someone under 18, can get this wrong, and lets adults verify their age to remove it. The account is the poster's own and is not corroborated.
Contextual tracker case Low reported severity
AI involvement reported · Causal attribution alleged · 2 sources · Added 11/10/2026
Event date unknownBrazilUnidentified facial recognition system
Folha Vitória reported on 29 September 2026, citing the Espírito Santo Civil Police, that a 39-year-old man was arrested on 28 September on a preventive warrant after an inquiry into qualified theft by electronic fraud against an 81-year-old man in the north-west of the state. According to the police, the suspect, who worked as a security guard at a dance venue, invited the man to his home on the pretext of making a free-entry card, kept his bank card, obtained personal data and photographed his face. The police say he used the images to get past the facial recognition of the banking app and enable access to the account on his own phone, then reset security passwords, redeemed investments and made Pix transfers without the victim's knowledge, diverting R$6,080. The victim is described as illiterate. The police say the suspect had prior records and was serving a sentence under a progressive regime. Folha do ES and Tribuna Norte Leste carried the same police account but could not be read.
Contextual tracker case Low reported severity Criminal Charges
AI involvement reported · Causal attribution alleged · 1 source · Added 07/10/2026
Jun 2025United StatesFlock Safety license plate readers
In June 2025 Morristown, Tennessee, police stopped a couple driving their 3-year-old granddaughter to a doctor's appointment, held them at gunpoint and handcuffed them both. The grandmother's personalized plate spelled a nickname with the letter O; a Ford F-150 reported stolen in Claiborne County carried the same word spelled with a zero. Business Insider reported in March 2026 that officers received a Flock alert that the plate was stolen, that the Flock investigative summary recorded the couple's plate with a zero, and that the stolen pickup had already been recovered but was never removed from the system. The police department told WATE that the officer ran the tag as displayed, with an O, and that with either character it showed as stolen in the crime information database; the police chief told Business Insider that officers relied on the National Crime Information Center as protocol requires. The grandfather told WATE that he thought he might be shot and felt humiliated, and the grandmother said she was crying as she heard her granddaughter calling for her.
Contextual tracker case Medium reported severity Media Coverage
AI involvement reported · Causal attribution disputed · 2 sources · Added 04/10/2026
2 Sept 2026 to 2 Oct 2026Event location unknownCharacter.AI age verification
In a public post to r/CharacterAI at 21:47 UTC on 2 October 2026, a person who describes themselves as a veteran user of the Character.AI app says they returned about a month earlier to verify their age, and that the AI verification by Persona assumed they were a minor although they are not. They say they sent photos of their ID, tried desktop and different lighting, and kept getting an error message; that more than five support tickets asking for manual verification drew only replies from automated bots; and that the age verification system has now locked them out of their account. In a reply they say the system should identify people properly instead of "locking it out on permenent basis". A commenter says the same check called them underage. The account is uncorroborated, and Character.AI's and Persona's handling is described only by the poster.
Contextual tracker case Low reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 03/10/2026