{
 "public_id": "AIR-2025-0091",
 "incident_id": "2025-03-nsw-reconstruction-authority-chatgpt-upload",
 "date_disclosed": "2025-08-11",
 "date_occurred": "2025-03",
 "title": "NSW Reconstruction Authority contractor uploaded flood-victim personal and health data for ~3,000 people to ChatGPT",
 "class": "in_the_wild",
 "attack_surface": "enterprise_assistant",
 "initial_vector": "none_autonomous_action",
 "agent_capability_abused": [
  "file_upload",
  "retrieval",
  "data_retention"
 ],
 "target_product": "ChatGPT",
 "target_vendor": "OpenAI / NSW Reconstruction Authority (deployer)",
 "autonomy_level": "assistant",
 "impact_realized": true,
 "impact_type": [
  "privacy_violation",
  "information_disclosure"
 ],
 "blast_radius": "up to 3,000 Northern Rivers Resilient Homes Program applicants; email addresses, phone numbers, personal and health information",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI02"
  ],
  "mitre_atlas": [],
  "labels": [
   "insider_unintentional",
   "shadow_ai",
   "unauthorised_tool",
   "government_data",
   "health_data"
  ]
 },
 "defense_present": "departmental policy prohibiting unauthorised AI tools",
 "defense_bypassed": true,
 "fix_shipped": "Cyber Security NSW investigation and dark-web monitoring; affected individuals notified",
 "primary_sources": [
  "https://www.news.com.au/technology/online/internet/deeply-sorry-nsw-contractor-uploaded-3000-flood-victims-data-to-chatgpt/news-story/f8d0777ebea5400090be402b8314dede",
  "https://incidentdatabase.ai/cite/1228"
 ],
 "verified_quote": "The breach occurred when a former contractor of the RA uploaded data containing personal information to an unsecured AI tool which was not authorised by the department.",
 "confidence": "high",
 "notes": "Government-sector counterpart to the Samsung case, with a sharper victim class: disaster-recovery applicants whose health data was already sensitive. Primary source is the agency's own breach notice. Exfiltration is unconfirmed but not excluded, which is exactly the position an organisation is left in once data leaves for a third-party model. AI Incident Database incident 1228.",
 "risk_category": "privacy",
 "risk_secondary": [],
 "risk_subcategory": "PII Leakage",
 "risk_sub_secondary": [],
 "ai_entity": "generative",
 "agency": "ai_as_target",
 "agency_debatable": true,
 "agency_reason": "the AI service was the passive recipient in a contractor-caused input disclosure; no model output or autonomous action caused the loss",
 "vector_family": "none_autonomous",
 "vector_detail": "none_autonomous_action",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [
   1228
  ],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI02",
 "agent_framework": "unknown",
 "model_provider": "openai",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "sensitive_data_exposure",
 "eai_domain": "privacy",
 "eai_secondary": [],
 "eai_reason": "subcategory: PII Leakage",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI02 (impact=tool_misuse)",
 "submitted_by": "EAI Internal"
}