A RIZAP Employee Uploaded 726 People's Health Records to a Personal AI Chat

On 20 August 2026 an employee of RIZAP Inc., the Japanese fitness and health-guidance group, was pulling records out of the health-guidance management system it operates for insurers when the data went into a generative AI service on a personal account the company had never approved. The records covered 726 members of the Local Government Employees' Mutual Aid Association (地方職員共済組合) across fourteen regional branches, and included names, dates of birth, insurance-card symbols and numbers, and the disease categories hypertension, diabetes and dyslipidaemia — sensitive personal data under Japan's Act on the Protection of Personal Information. The association published its notice on 4 September 2026. The case sits among the documented incidents in the Orca AI incident archive, which records each entry with its own sources, severity, confidence grade and disputed flag.

This was not a breach in the usual sense. No attacker, no compromised credential, no vulnerability being exploited. A person doing routine aggregation work chose the wrong tool, and a health insurer's member data — including the category Japanese law treats as needing the strictest handling — left the building through a browser tab that nobody at the company knew existed. The archive grades the record at its top confidence level, rates its severity high, records real harm and does not flag it as disputed, and both of the parties who published notices agree on the mechanism. What follows separates what those notices establish from what rests on the vendor's own assurances.

What RIZAP actually disclosed, and when

RIZAP's apology and notice carries the date 3 September 2026. It places the incident in the company's health-management and insurer business division and says the employee was working on data aggregation for the specific health-guidance management system when the upload happened. The employee was using a generative AI service in private use — the company's own wording — not a corporate account. The notice gives no occurrence date of its own; the 20 August timing, and the fact that the employee reported the upload themselves, come from the two insurers' notices that followed.

The scope RIZAP describes is a subset of records registered in that system between 1 January and 19 August 2026: people enrolled in the specific health-guidance programme, which Japanese insurers offer to members assessed as at risk of lifestyle disease. The notice lists ordinary personal information (insurance-card symbol and number, email address, name, date of birth, sex, and for some people an address and a telephone number) and, separately, two categories of sensitive personal information: the form of health-guidance support the person was receiving, and disease information for anyone recorded as having hypertension, diabetes or dyslipidaemia. It states that credit-card numbers, bank-account details and login credentials were not among the data.

RIZAP says it completed a report to the Personal Information Protection Commission, the regulator that receives notifications of certain personal-data incidents under the Act. Neither RIZAP's notice nor the association's says what the commission did with it, and no finding by the commission appears in either document.

The date the archive files this under is 4 September 2026, and that is the association's own publication date rather than RIZAP's. The two are a day apart because the company notified first and the insurer whose members were in the data went public the following day, when it also had the contractor email the affected people. ITmedia NEWS reported the company's notice on 4 September at 11:33 local time.

Where the number 726 comes from

RIZAP did not publish a count. Its notice describes the data and the response but gives no number of affected people, and ITmedia's report of 4 September states plainly that the company did not disclose one. The 726 figure belongs to the Local Government Employees' Mutual Aid Association, which runs health insurance for local civil servants and was one of the insurers that had contracted RIZAP to deliver the guidance programme.

The association's notice of 4 September gives more detail than the contractor's: 726 people, spread across fourteen branches — Iwate, Akita, Yamagata, Fukushima, Tochigi, Kanagawa, Fukui, Mie, Osaka, Tottori, Yamaguchi, Kagawa, Ehime and Kagoshima. It records the incident as 20 August, states that the contractor's staff member input the data into a service the contractor had not authorised and had it referenced, confirms that the data was deleted from the AI service's screen and that a deletion request went to the service provider, and says RIZAP emailed the affected people at 10:00 on 4 September.

Two small differences between the accounts are worth noting rather than smoothing over. RIZAP calls the identifier an insurance-card symbol and number; the association calls it a member symbol and number. RIZAP lists three categories of health-guidance support; the association's notice lists two, active support and motivational support. Neither difference changes the shape of the incident, but they are a reminder that the two documents were written by different organisations for different audiences, and that the member-level detail comes from the insurer, not from the company that lost control of it.

The incident was wider than the 726

Because RIZAP never gave a total, the size of the exposure can only be assembled from the insurers' own notices, and Japanese security outlets have been doing exactly that. Security Measures Lab (セキュリティ対策Lab), a Japanese security news site, has compiled the notices it could verify and republished the figure that one insurer put on the whole dataset: the National Health Insurance Association for Construction and Civil Engineering (全国土木建築国民健康保険組合) stated that data on 19,996 people was input into and referenced by the unapproved AI service, of which 1,167 were its own members.

That number needs the caveat the site itself attaches: it counts people whose data was entered into the service, not people whose information is confirmed to have reached anyone. The other published figures sit inside it and must not be added to it. The IHI Group health insurance society named 210 people in a notice dated 2 September. Hitachi's health insurance society published no count but suspended new referrals to RIZAP's health-guidance programme until it could verify that the prevention measures actually work. Nippon Shokubai, Kansai Television Broadcasting, Gunma's municipal employees' mutual aid association, the petroleum-products health insurance society, Unitika and Works Human Intelligence also published notices, most without numbers.

Established, attributed, and still unconfirmed

Established by two independent primary documents. The upload happened on 20 August 2026 during data-aggregation work; the service was one the contractor had not authorised; the data included names, dates of birth, insurer identifiers and health information including disease categories; the affected members of the local government scheme number 726 across fourteen branches; RIZAP reported the incident to the Personal Information Protection Commission; affected members were emailed on 4 September.

Attributed to RIZAP, resting on its AI vendor's answers. That no third party outside the AI provider could have seen the data, and that the data was not used to train a model. RIZAP's notice explains the basis: the provider told the company that files containing identifiable information are never used for training even where an account permits it, and that files deleted within 24 hours are not used for training either; RIZAP says it deleted the data inside that window. The claim is a relayed assurance, not an audited fact, and no independent party has examined it.

Unconfirmed at publication, by the company's own admission. Whether the AI provider's own staff could have viewed the uploaded data. RIZAP's 3 September notice says this was still being checked; the association's 4 September notice says the contractor is waiting on the provider's answer. As of the documents, that question is open — which is why a reader should treat "the data is deleted" and "nobody saw it" as different claims.

Named by one insurer, not by the contractor. The IHI Group health insurance society's notice identifies the AI provider as OpenAI. RIZAP has not named the service, and nothing in either of the two main notices confirms or contradicts the IHI disclosure.

Not alleged anywhere. No attacker, no extortion, no downstream misuse, no evidence that any member's data has been used against them. Both notices warn members about phishing and both state that RIZAP will never ask for money, card details, account numbers or passwords — a precaution, not a report of an attack.

What changed afterwards

RIZAP lists three tiers of response. On people: a company-wide re-notification that generative AI services the company has not approved may not be used for work, plus continued training on personal-data protection and appropriate AI use. On systems: a review of access permissions and working environments to stop data being taken out or unapproved services being used. On governance: consideration of an AI management system alongside its existing information-security management system.

The association's commitments run in the other direction, at the contractor. It says it will strengthen its supervision of RIZAP and will check that the prevention measures are actually implemented, and it says it asked the contractor for a fuller investigation of the facts and the extent of the impact. Hitachi's health insurance society went further than either, stopping new referrals until it is satisfied the measures hold.

What has not changed is the regulatory picture. A notification to the Personal Information Protection Commission is a filing obligation, not an adjudication, and neither notice records any instruction, guidance or penalty from it.

Why the archive treats this as a landmark

Most AI incidents in the public record involve a system doing something wrong. This one involves a person doing something ordinary with a system that was working exactly as designed — which is the harder problem, because the failure is invisible to the organisation until after the data has left. The category the incident falls into is the one Japanese practitioners call shadow AI: staff using a consumer AI service for work because it is faster than the approved route, usually with no malice and often with the intention of doing the job well.

The cited source for this record, a Japanese security explainer site, groups the incident with two other AI events from the same week — a voice-cloning payment fraud and an AI-agent intrusion — and makes the point that all three attacked weaknesses that already existed rather than creating new ones. That framing is the site's analysis rather than a finding, but the comparison is apt: none of the three required a novel capability, only a faster route to an old one.

What makes this record worth reading on its own is the specificity of the harm. Seven hundred and twenty-six people had their insurer identifiers, contact details and three named disease categories placed in a consumer AI account that their insurer's contractor had never approved, and the only reason anyone found out is that the employee who did it said so. The archive records real harm here. What the two notices establish is exposure and loss of control over sensitive data — not that anyone has used it.

What corroborates the record, and what does not

The record's confidence grade rests on more than the aggregator that the archive cites. Three independent parties published within two weeks of the incident: RIZAP itself on 3 September, the Local Government Employees' Mutual Aid Association on 4 September, and ITmedia NEWS, which reported the company's notice on 4 September and added the detail that no count had been disclosed. The IHI Group health insurance society, Hitachi's health insurance society and at least six other insurers published their own notices, and Security Measures Lab compiled them. A Japanese incident-archive blog, b-son.net, reproduces the association's release in full alongside its own summary.

What none of that establishes is the total. RIZAP has not published one, the insurers' figures overlap, and the 19,996 figure is one insurer's statement about the dataset rather than a count of confirmed exposures. Anyone quoting a single number for this incident should say which document it came from — which is the discipline the archive itself applies to every entry it holds.