Zero Radar
← feed
HighData breachupdated 29 Oct 2026, 20:21 UTC

Fitness firm employee uploaded health records to personal AI chat

An employee copied health records of 726 people into a personal AI chat account the company had not approved. Those people's private health information may now sit outside the company's control.

1 source, unconfirmed
SeverityHighData breach
Being exploited?UnclearNo reports either way yet
What to doCheck exposureRequest that RIZAP confirm what happened to the uploaded records and whether they were deleted from the AI service.
How sure is this?1 source, unconfirmedOnly one publisher so far, details may change

How the attack works simplified

  1. 1Employee exports dataPulled records from health-guidance system
  2. 2Records copiedData of 726 members selected
  3. 3Pasted into AI chatPersonal, unapproved AI account used
  4. 4Stored by AI serviceOutside company control
  5. ResultHealth records leave company control

What happened

RIZAP Inc., a Japanese fitness and health-guidance group, reported that on 20 August 2026 an employee exported records from its health-guidance management system and entered them into an unapproved personal generative AI account.

Why it is dangerous: Health data of 726 members was exposed to a third-party AI service, creating privacy harm and possible regulatory consequences for the people whose records were involved.

Are you affected?

You are affected if you are one of the 726 members whose health-guidance records were uploaded, or if you use RIZAP's health-guidance services provided to insurers.

RIZAP Inc. health-guidance management system records for 726 members

What to do

  1. Ask RIZAP whether the uploaded records were retained or used by the AI provider and request deletion confirmation
  2. Review and restrict employee use of unapproved personal AI accounts for handling personal data
  3. Monitor for notices from RIZAP about affected individuals and data protection authorities

Timeline

  1. 29 Oct 2026, 19:59 UTC
    Publicly disclosed
  2. 29 Oct 2026, 19:59 UTC
    Reported by DataBreaches.net · DataBreaches.net
  3. 29 Oct 2026, 20:21 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Security press established security newsrooms

Technical details

ID
ZR-3cf59c72
Disclosed
29 Oct 2026, 19:59 UTC
On Zero Radar
29 Oct 2026, 20:21 UTC (22 min after disclosure)
Last change
29 Oct 2026, 20:21 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Fitness firm employee uploaded health records to personal AI chat · Zero Radar