In the wild
Realized harm
NSW Reconstruction Authority contractor uploaded flood-victim personal and health data for ~3,000 people to ChatGPT
AIR-2025-0091 AIR record · 2025-03-nsw-reconstruction-authority-chatgpt-upload
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
The breach occurred when a former contractor of the RA uploaded data containing personal information to an unsecured AI tool which was not authorised by the department.news.com.au
The record
Disclosed
2025-08-11
Occurred
2025-03
Vendor
OpenAI / NSW Reconstruction Authority (deployer)
Product
ChatGPT
Risk domain
Privacy › Sensitive data exposure
System type
Generative model
Who acted
AI was the target (contested) — the AI service was the passive recipient in a contractor-caused input disclosure; no model output or autonomous action caused the loss
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
None autonomous action
Impact type
Privacy violation, Information disclosure
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI06 – Memory & Context Poisoning
- MITRE ATLAS
- AML.T0057 – LLM Data Leakage
- NIST AI RMF
- MEASURE 2.10
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Use data anonymization; Implement log sanitization to scrub PII.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
up to 3,000 Northern Rivers Resilient Homes Program applicants; email addresses, phone numbers, personal and health information
Capability abused
Defense & remediation
Recorded defense
departmental policy prohibiting unauthorised AI tools
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
Cyber Security NSW investigation and dark-web monitoring; affected individuals notified
Taxonomy & references
Curator notes
Government-sector counterpart to the Samsung case, with a sharper victim class: disaster-recovery applicants whose health data was already sensitive. Primary source is the agency's own breach notice. Exfiltration is unconfirmed but not excluded, which is exactly the position an organisation is left in once data leaves for a third-party model. AI Incident Database incident 1228.
Supporting sources
Cite as
Enkrypt AI. "NSW Reconstruction Authority contractor uploaded flood-victim personal and health data for ~3,000 people to ChatGPT". AIR, AIR-2025-0091. https://agentincident.vercel.app/i/AIR-2025-0091/ (accessed 2026-10-19).