What happened
Fitness company RIZAP reported on September 3 that an employee mistakenly uploaded customer information to an external generative AI service used for personal purposes during work on data for the government's specific health guidance program.
Why it matters
The data included insurance symbols, email addresses, names, birth dates, genders, partial addresses and phone numbers, plus sensitive personal details like support type and disease info. RIZAP said it confirmed no third-party viewing or use for AI training, but is still checking if the service provider's staff could have seen the data.
What to watch
The test is whether RIZAP’s ongoing check confirms that the AI service provider’s staff never viewed the data, since that determines the breach’s full scope. Watch for the company’s follow-up report to the Personal Information Protection Commission once that check is complete.
Summaries like this, every morning.
This incident highlights risks when employees use personal AI tools for work tasks. RIZAP's data was part of a national health checkup and guidance system, making the breach sensitive. The company's confirmation that no third party saw the data or used it for training is a key mitigation, but ongoing checks about the provider's access suggest uncertainty remains.
RIZAP's response—reporting to the commission and notifying affected individuals—shows standard procedure for such leaks. The company's reminder about its ban on unauthorized AI services indicates a focus on internal policy enforcement. However, the fact that an employee used a personal service for work suggests a gap between policy and practice. This could drive other firms to reassess their own AI usage guidelines.
Pick your industry and the AI tools you use, and get news related to your work every day.
Free · 30 seconds with Google · unsubscribe anytimeWhat is AIToday? →
Ask AI anything about this article. The AI reads this article, earlier AIToday articles, and Wikipedia, and cites its sources. Q&As are published on this page for other readers too.
Tomek Korbak, Mikita Balesni, and Jasmine Wang deny sharing confidential information and say OpenAI never told…
Block unveiled Dessa, which it says is the first AI model trained entirely on human speech with no text data…
At Anthropic's "Machines of Loving Grace" exhibition and DevelopersIO 2026 TOKYO, Claude and Claude Code power…
A FitLog developer replaced repeated prompt warnings with a harness — a 48-line CLAUDE.md "map" linking six do…
Across five tasks and 18 Ollama calls, Muse Glimmer 30B's 352-character log and Qwen3 30B-A3B's 3,040-characte…
zg (zvec-grep) combines ripgrep, BM25 keyword ranking and vector-based semantic search into one local index yo…
