RIZAP employee leaks client data via personal AI

RIZAP Group's apology highlights the risks of employees using personal AI tools for work-related tasks. The company, which provides health guidance services to corporations and health insurance associations, saw a worker upload sensitive client data during a data aggregation task. The leak included names, medical conditions, and insurance details—information that could cause significant harm if misused.

The company says the AI operator confirmed that files containing personally identifiable information are not used for model training, and because the data was deleted within 24 hours, it believes the data was not used for learning. However, RIZAP is still checking whether the operator's staff could have viewed the information. This uncertainty is a key concern for affected clients.

In response, RIZAP is reiterating its ban on using unauthorized generative AI for business, continuing education on data protection, and considering adopting an AI management system alongside its existing information security management system. This incident serves as a reminder that even with safeguards, the human factor remains a critical vulnerability in data security.