RIZAP data leak found only via self-report

The case arose inside RIZAP's commissioned work on specific health guidance, meaning the data involved belonged to clients of health insurance associations that had outsourced the work. RIZAP moved quickly once the self-report came in: within 24 hours it deleted chat histories and files, stopped learning, and queried the AI service operator. It also said the uploaded information had not been viewed by third parties outside that operator and had not been used for AI training, though it was still checking whether the operator's staff could have seen it.

The legal exposure runs on two tracks. Under personal information protection law, the questions are safety measures and supervision of employees; in civil terms, breach of the outsourcing contract and employer liability can be at issue. The lawyer notes that because the data went into an account the company could not control at all, governance-wise this can be treated as more serious than an incident in a company-managed account. On the third-party transfer question, the analysis turns on the facts of who actually handles the data, which is why a company AI environment under a data processing agreement is treated as outsourcing and does not require consent.

The wider context is the revised personal information protection law, enacted and promulgated in July 2026, which for the first time spells out a ban on contractors handling personal data beyond the entrusted purpose; it is expected to take effect within two years of enactment. That puts more weight on how outsourcing contracts address AI use. Whether this becomes a one-off incident or a template hinges on how quickly contractors adopt approved AI environments and self-reporting channels, and on whether contracting parties tighten notification deadlines and audit rights in writing.