What kind of data was leaked?

The leaked data included names, insurance certificate symbols, email addresses, birth dates, gender, and some addresses and phone numbers. It also included disease information such as hypertension, diabetes, and dyslipidemia.

How many people were affected?

The number of affected individuals has not been disclosed.

What is RIZAP doing in response?

RIZAP reported to the Personal Information Protection Commission and is notifying affected individuals. It is also promoting a ban on unauthorized AI use, reviewing access rights, and considering AI management system implementation.

AI Safety & AlignmentAI Regulation & PolicyTop Companies' AI MovesTop Companies AISep 5, 2026Sep 6, 2026, 06:30 JST

RIZAP leaks client health data to AI service

Send on LINE

3 Key Points

What happened
RIZAP announced on September 3 that a subsidiary employee mistakenly uploaded personal data of certain health guidance participants to an external generative AI service. The data included names, insurance certificate symbols, and disease information such as hypertension and diabetes.
Why it matters
The company stated it confirmed with the service operator that there was no possibility of third-party viewing or AI learning use. However, whether the operator's staff could view the data is still under confirmation, highlighting governance risks around sensitive health information.
What to watch
The test is whether the operator’s staff could view the data, as the company has only confirmed no third-party viewing or AI learning use. Watch for the completion of the ongoing confirmation with the service operator.

Not sure about something? Ask the AI

Questions and answers are published on this page.

Summaries like this, in your inbox every morning.

Get news like this every morning, free

Context & Analysis

This incident underscores the risks of using generative AI tools in handling sensitive personal data, especially health information. RIZAP's quick confirmation that the data was unlikely used for AI training offers some reassurance, but the ongoing uncertainty about operator staff access highlights gaps in oversight. The company's response—reporting to the regulator and tightening internal controls—reflects a growing need for robust governance in the era of generative AI. As similar mistakes surface across industries, businesses may need to reassess how they manage AI tools and access permissions to prevent such leaks, potentially making AIMS adoption more widespread.

FAQ

What kind of data was leaked?: The leaked data included names, insurance certificate symbols, email addresses, birth dates, gender, and some addresses and phone numbers. It also included disease information such as hypertension, diabetes, and dyslipidemia.
How many people were affected?: The number of affected individuals has not been disclosed.
What is RIZAP doing in response?: RIZAP reported to the Personal Information Protection Commission and is notifying affected individuals. It is also promoting a ban on unauthorized AI use, reviewing access rights, and considering AI management system implementation.

AI news that matters for your work, delivered every morning.

Pick your industry and the AI tools you use, and get news related to your work every day.

Get it free

Free · 30 seconds with Google · unsubscribe anytimeWhat is AIToday? →

Ask AI

Ask AI anything about this article. The AI reads this article, earlier AIToday articles, and Wikipedia, and cites its sources. Q&As are published on this page for other readers too.