Panasonic Employee Uploads Sensitive Data of 334,000 People to Unauthorized GenAI
A Panasonic employee violated company policy by uploading personal data belonging to 334,000 current and former employees and their families to an unauthorized external Generative AI service. The incident affected 7.5 million current employees, 17.8 million former employees, and tens of thousands of family members. This incident highlights the growing enterprise security risks associated with unauthorized Generative AI usage and the potential exposure of vast amounts of personally identifiable information. Although the AI provider confirmed the data was not used for model training and has been deleted, it underscores the urgent need for strict corporate data governance. The leaked data included employee identification numbers, home addresses, phone numbers, email addresses, and emergency contact details of family members. Fortunately, the GenAI service provider stated that the data was not incorporated into their training database and was scheduled for complete deletion.
## BACKGROUND
Generative AI services often process user inputs to improve models or maintain chat logs unless explicitly configured otherwise, posing a significant risk when employees input confidential corporate information. Enterprise security policies frequently restrict or regulate the use of external AI tools to prevent accidental data leaks.