Event date unknownEstoniaUnidentified AI web service
In its overview of personal-data breach notifications for the third quarter of 2026, published on 8 October 2026, Estonia's Data Protection Inspectorate (AKI) listed a case in which a bank employee uploaded employment contracts to a widely used AI web service, making them available to other employees who used the same AI account. Answering questions from the technology outlet Geenius, AKI said the employment contracts of a few individual employees had been entered into the AI system and became accessible to other employees using the same account; Geenius reports that those colleagues could view and download them. According to the report, the bank informed the people affected and blocked its employees from using that AI system. AKI did not name the bank, the AI service or further circumstances.
Contextual tracker case Low reported severity Internal Action
AI involvement supported · Causal attribution supported · 2 sources, 1 underlying account · Added 31/10/2026
Event date unknownEvent location unknownUnidentified chatbot
Panasonic Operational Excellence, a Panasonic Holdings subsidiary, announced on 23 October 2026 that a member of an in-house project introducing a personnel information system had uploaded part of that system's data, as registered in April 2026, to an external generative AI service whose use the company prohibits. According to the announcement as reported by ITmedia and CNET Japan, the data covered about 75,000 current and about 178,000 former employees of Panasonic group companies in Japan (employee numbers, addresses, phone numbers and email addresses, without names) and about 81,000 family members registered as emergency contacts (names, addresses, phone numbers and email addresses), about 334,000 people in all. The company says the upload broke internal rules and was not an outside attack, that the employee deleted the chat history and the local data immediately after the problem came to light, and that it reported the matter to Japan's Personal Information Protection Commission on 29 September. The provider told the company that training on the data was switched off at upload but that deleted data is kept for 30 days, until 25 October. No public exposure or misuse had been confirmed. The company has not named the AI service.
Contextual tracker case Medium reported severity
AI involvement reported · Causal attribution supported · 3 sources, 1 underlying account · Added 24/10/2026
Event date unknownEvent location unknownFacebook video face-scan check
In a public post to r/facebook on 28 September 2026, a user writes that their five-year-old Facebook account was hit with a security check that asked for a video face scan, which 'failed completely'. They say their face had changed a lot through recent life circumstances and 'The AI simply didn't recognize me.' Facebook then asked for ID, and 'the automated system instantly rejected' their government ID because their profile uses a shortened nickname. The poster says they are locked out of years of memories, friends and active Marketplace listings and are looking for a way to reach a human or download their data. Meta has said that video selfies used to regain access to compromised accounts are compared with the account's profile pictures using facial recognition; whether this check worked that way is not known. The account is uncorroborated.
Contextual tracker case Low reported severity
AI involvement reported · Causal attribution alleged · 2 sources · Added 29/09/2026
Event date unknownEvent location unknownGemini note-taking in Google Meet
In a public post to r/LegalAdviceUK on 28 September 2026, an employee of a marketing agency in England writes that their boss pitched a prospective client and the client's business partner on a Google Meet call with Gemini note-taking switched on. After the boss said goodbye and left, the two business partners stayed on the call to discuss the proposal and the other agencies they were considering, and Gemini kept taking notes. The boss then sent the employee the notes and transcript, which named a competing agency and included 'personal details of who they spoke to specifically on the call', and asked for a follow-up deck built on what the partners liked and disliked. The poster believes the partners did not know they were still being transcribed. Google's help page says Meet tells all participants when notes are being taken; whether the partners noticed is not known. The account is uncorroborated.
Contextual tracker case Low reported severity
AI involvement reported · Causal attribution alleged · 4 sources, 2 underlying accounts · Added 29/09/2026
Event date unknownBrazilUnidentified facial recognition system
The Espírito Santo Civil Police (Defa, the fraud and forgery unit) said a 27-year-old man was arrested on a warrant in Serra on 22 September 2026, suspected of defrauding a personal trainer of more than R$100,000. According to the police, the suspect offered a car in exchange for the victim's motorcycle; during the negotiation he persuaded the victim to perform a facial-recognition procedure, saying it was needed to transfer the car's ownership; the biometric was later used to contract a vehicle financing in the victim's name without his authorisation, and weeks after the exchange the victim discovered that the car he had received did not belong to the suspect and was a rental. The loss, combining the motorcycle and the fraudulently contracted financing, exceeded R$100,000. The suspect, who police say had been arrested in São Paulo in July 2025 in a 'love scam' case, was taken to the Centro de Triagem at the Rodrigo Figueiredo da Rosa prison complex and remains at the disposal of the courts. The financing provider and the facial-recognition system are not identified, and the reports do not say how the captured biometric was used to pass the financing.
Contextual tracker case Medium reported severity Criminal Charges
AI involvement reported · Causal attribution alleged · 4 sources, 1 underlying account · Added 26/09/2026
Event date unknownEvent location unknownChatGPT
Barnevakten, a Norwegian child-safety organisation, reported on 23 September 2026 that one of its staff members was suddenly told by ChatGPT that their account was now in teen mode. ChatGPT's own pages, as described by Barnevakten, say the system turns the filter on when a user's behaviour indicates an age under 18, reducing sensitive or potentially harmful content (graphic violence, viral challenges, sexual or violent role-play, extreme beauty ideals) and offering parental controls and a study mode. Because there is no age check at sign-up, the system estimates age afterwards from conversation topics and times of use, and Barnevakten notes that such guesses can be wrong. An adult who wants out of teen mode can go through an age check run by the company Persona, which depending on the country asks for a real-time selfie and a government ID; Barnevakten questions whether that process is privacy-safe (Persona's terms mention retention of up to three years) and advises using only age checks one trusts. The account's own experience is limited to the unexpected switch and the verification route; no further consequence is described.
Core + contextual relations Low reported severity Media Coverage
AI involvement supported · Causal attribution supported · 1 source · Added 24/09/2026