RIZAP: employee uploaded 726 members' health records to personal generative AI chat
Severity: medium · Patch status: no-fix-needed · Since 2026-10-29
On 20 August 2026 an employee of RIZAP Inc., a Japanese fitness and health-guidance group, extracted records from the health-guidance management system RIZAP operates for insurers and uploaded them to a generative AI service on a personal account that the company had never approved. The records covered 726 members of insurers using the service, exposing health-related personal data to a third-party AI platform outside corporate control. The incident is insider misuse rather than an external attack; no CVE or vendor patch applies. Remediation centres on policy enforcement, DLP, and AI access controls rather than software fixes.
What to do
- Review and restrict use of unapproved generative AI services on corporate systems and accounts
- Deploy DLP/egress monitoring to detect bulk extraction of member records
- Audit employee access to the health-guidance management system and enforce least privilege
- Notify affected insurers and members as required by Japanese privacy law
- Provide staff training on handling health data and approved AI tooling
Sources
All live incidents on Threat Watch
