RIZAP: employee uploaded health guidance data to an outside generative AI service
At RIZAP, which runs specific health guidance for insurers, an employee extracting data was found on 20 August to have fed data with personal information of 19,996 people into an outside generative AI service the company had not approved for work. The employee reported it. Insurance card numbers, names, birth dates, genders, emails and for some addresses and phone numbers were included, plus guidance types and conditions such as high blood pressure, diabetes and dyslipidemia. Client health insurance societies disclosed it from 2 September, and RIZAP on 3 September. The data was deleted and was not used for AI training, they said.
Disclosed
2026-09-02
Organizations involved
3
Leaked or at risk
20K
19,996
Downtime
Unknown
Timeline
- Detected 2026-08-20
- Disclosed 2026-09-02
- 13 days
Attack or cause
- Method
- [Insider]
- Impact
- [Data leak]
- Entry point
- Unknown
Data exposed or at risk
Supply chain
Organizations involved
[Breached][Critical]Tokyo, ShinjukuPersonal services and entertainment19,996 leaked
RIZAP Co., Ltd.[Through a supplier][Critical]Tokyo, KotoMedical care and welfare210 leaked
IHI Group Health Insurance SocietyMembers who used RIZAP's health guidance in fiscal 2024 to 2026.
[Through a supplier][Critical]Tokyo, ChiyodaMedical care and welfare1,167 leaked
National Civil Engineering and Construction Health Insurance Society
Sources
- [1][Official]特定保健指導委託業者における個人情報の不適切な取扱いに関するご報告とお詫びNational Civil Engineering and Construction Health Insurance Society · 2026-09-03
- [2][Official]特定保健指導業務の委託先における生成AI利用に関する事案発生についてIHI Group Health Insurance Society · 2026-09-02
- [3][News]「約2万人流出」を明かしたのは委託元だった…ライザップの"シャドーAI"による情報漏洩で露呈した不透明な対応Toyo Keizai Online