RIZAP health guidance data in a personal AI chat: 726 people at one client, 19,996 in the data, notices say

RIZAP's own notice names no count: 726 is one client's figure, and another client says the data covered 19,996

The Mutual Aid Association for Local Government Officials (our translation of 地方職員共済組合) says 726 people may have had their health guidance records exposed when an employee of its contractor RIZAP put a data extract into a personal generative AI service. Its own table adds up: 305, 180, 158 and 83 across four regions give 726 (derived sum) across 14 named branches. RIZAP's notice of 3 September 2026 gives no number at all. A different client, the National Civil Engineering and Construction Health Insurance Association (our translation of 全国土木建築国民健康保険組合), says the data covered 19,996 people, 1,167 of them its own. If the 726 sit inside the 19,996, which no notice states, they are 3.6 percent of it (derived).

Every date below comes from pages read on Thursday 29 October 2026 between 21:10 and 21:20 GMT. The notices themselves were published on 2, 3 and 4 September, so they are 55 to 57 days old at the time of reading (derived). This is not a fresh breach. It is a record worth reading closely because it is a clean case of data leaving through a tool the company did not control, and because the notices disagree on small things that matter. A news post from DataBreaches.net dated 29 October 2026 was the lead for this read. Its page answered this site's fetch with a Cloudflare block (HTTP 403), so it was not read and nothing here depends on it. No later notice from RIZAP on this incident was found: RIZAP's business news list, read the same evening, shows the notice of 3 September and nothing newer on the subject.

What the record does not establish: that anyone other than the employee and the AI service provider ever saw the data, that any person was harmed, or which AI service it was. No notice read names the service. The notices call it a possible leak of personal information, not a confirmed one, and RIZAP itself says it is still checking whether staff of the service provider could see the data.

What RIZAP's notice says, in its own words

RIZAP published the notice on 3 September 2026 on its business site (RIZAP notice). Its title translates as an apology and notice about the mistaken upload of customer information to an external generative AI service. The notice is in Japanese. Below are the key lines in the original beside a plain English translation. The translations are this site's own, not RIZAP's, and short quotations are used for commentary.

Two points deserve a second look. First, the last line is RIZAP's own judgement, reached from the provider's answer that RIZAP relays; the provider's own wording is not published in any page read. Second, the notice says the worker switched off the training setting after the event. That implies the setting could have been on at the time, but the notice never says so. That is this site's inference, not a statement.

Stated and not stated: the record as the notices print it

The table sets what the pages say against what they leave out. RIZAP's notice and four client notices were read: the Mutual Aid Association, the construction health insurer, the IHI group health insurance society and the Hitachi health insurance society. The fields listed are the ones RIZAP and the clients print.

The friendly name carries weight here. A personal AI chat sounds like a private notebook. It is a service run by a third party, under terms the employee accepted, with a retention period RIZAP's notice does not give. The notices use the word chat and the words external generative AI service. Neither says how long the provider keeps an uploaded file, and that is the number a leak assessment turns on.

Three counts that cannot be added up

The 726 in the working title is the Mutual Aid Association's number. Reading all four client notices shows why a single headline count is unsafe.

Adding the three printed counts gives 2,103 (derived), which is 10.5 percent of 19,996 (derived). That sum is not a finding. No notice says the three are separate, nor that they sit inside the 19,996. There is a visible mismatch too. RIZAP says the data was guidance records registered from 1 January to 19 August 2026, a period of 231 days (derived). IHI says its 210 used the service across three fiscal years. The notices do not reconcile the two descriptions.

Where the data went, and what is known about the far side

Zoom

The provider's reply, as RIZAP relays it, has two parts. Files containing personally identifiable information are not used by automated systems to train models, even where the account allows training. And files deleted within 24 hours are not used for training either. RIZAP concludes that, because it deleted within 24 hours, its customers' data was not used for training. That answers one risk, training. It does not answer the others: how long the provider held the file before deletion, whether its staff could see it, and whether it sits in backups or abuse monitoring stores. RIZAP says the staff question is still being checked. The Mutual Aid Association says it is waiting for the answer. Both statements are dated early September, and no later statement was found.

Some Japanese coverage names OpenAI as the provider. No notice read here does, so this briefing does not. One client, the construction insurer, says only that the service was one the company had no corporate contract with. Interest: RIZAP, and the clients who commissioned it, are each the party whose conduct is in question, and each wrote its own notice. The deletion and no training statements are theirs, relayed from a provider that published nothing in the pages read.

The timeline: a regulator report on day one, public notices on days 13 to 15

Zoom

Day counts count from 20 August, the date two client notices give as the day it became known (derived). The PPC report is dated 21 August by the construction insurer (day 1). RIZAP told IHI on 24 August (day 4). IHI published on 2 September (day 13), RIZAP on 3 September (day 14), and RIZAP emailed the 726 members of the Mutual Aid Association from 10:00 on 4 September (day 15). One order stands out: IHI's notice is dated the day before RIZAP's own. The Mutual Aid Association's notice is dated 4 September, yet says it rests on facts known at 12:00 on 2 September, so it was drafted before RIZAP went public.

The PPC publishes its own breach reporting page (PPC leak response page, read 29 October). It says to report promptly once a case is found. Its graphic text sets a first report within 3 to 5 days of discovery and a final report within 30 days (60 days where an improper purpose is suspected). On those figures, a report on day 1 is inside the first window, if the 21 August date is right. The page lists, among the cases that must be reported, personal data that includes special care required information, and counts health check results and health guidance among them. It also lists a case of more than 1,000 people. The 726 alone would be under that line, but health information triggers the duty regardless of the count (our reading of the PPC list). The notices describe a possible leak, and the PPC page does not decide whether a given upload is one.

What the PPC told businesses about generative AI in 2023

The PPC issued a general alert on generative AI services on 2 June 2023 (PPC alert page, alert PDF, both read 29 October 2026). It is not about RIZAP and it names no company in the part quoted. Two lines matter for this case. They are in the original below, with our plain translation after.

Our reading: the alert's test is wider than training. It asks whether the data is handled for any purpose other than producing the answer, and the words and similar points leave room for retention and staff access. RIZAP's notice answers the training half. Whether a stored file, held for up to 24 hours, counts as handling for another purpose is a legal question for the PPC and not something these notices settle. No PPC finding on this incident was found.

Technical details

None of the pages read prints a configuration, a log line, a query, a detection rule or an indicator. The incident is a data handling failure, not an intrusion, so there is no malware, no address and no hash to defang. What the primaries do print is the field list and the provider's answers. They are copied below exactly as printed, so a defender can see which data classes were in scope and which claims rest on a relay.

【対象データ】
2026年1月1日～2026年8月19日の期間に特定保健指導管理システムに登録された特定保健指導対象者データの一部
■個人情報
保険証記号番号、メールアドレス、氏名、生年月日、性別、住所（一部の方のみ）、電話番号（一部の方のみ）
■要配慮個人情報
特定保健指導の支援形態（積極的支援、動機付け支援、重症化予防のいずれか）、疾患情報（高血圧症、糖尿病、脂質異常症のいずれか又は複数に該当する方のみ）

Plain reading of the block above, our translation: personal information is the insurance card symbol and number, email, name, date of birth, sex, and for some people an address and a phone number. Special care required information is the type of guidance support (active support, motivational support or severe illness prevention) and, only for those who have one, a disease of high blood pressure, diabetes or dyslipidaemia. This is the class the PPC singles out for mandatory reporting.

1．個人を特定できる情報が含まれるファイルについては、アカウント側で会話データの学習利用が許可されている場合であっても、自動システムによりモデルのトレーニングに使用されることはない。

2．アップロード後24時間以内にファイルが削除された場合も、モデルのトレーニングには使用されない。

These are the two answers RIZAP says it received. They are RIZAP's account of the provider's reply, not the provider's published terms. A defender should not treat them as a contract term for any other account.

まずは、速報（新規）発覚日から、3〜5日以内
次に、確報（続報）発覚日から、30日以内

What to hunt, derived by this site and not printed by any primary: uploads of files with names or contents matching health, insurance or customer exports to the domains of consumer AI services; browser file upload events from managed laptops to such domains; personal account sign ins to AI services on corporate devices; large exports from the guidance system run by one user outside a ticket; and clipboard or upload events that carry insurance card numbers or the three condition terms. Each is a rule your own tooling must express. The primaries here give nothing to copy.

Frameworks that fit, and the friendly name check

Japan's personal information protection law, as the PPC page states it, supplies the reporting duty and the special care class. For a worldwide reader the controls that fit are two in the 2022 edition of ISO/IEC 27001 Annex A: A.8.12, data leakage prevention, and A.5.34, privacy and protection of personally identifiable information. The standard is paywalled and was not reproduced or read in full for this briefing; the control numbers and titles are those the standard publishes. RIZAP itself says it will consider an AI management system next to its existing information security system. That is its stated plan, with no date.

Test the label on your own estate. An approved AI tool is not one an employee chose. It is one with a contract that names retention, training, staff access and deletion, and with a managed account you can revoke. A ban notice is a policy; a block on the upload is a control. RIZAP's fix, as stated, is a fresh ban, education and a review of access. Those are the first two. The third, a technical control, is promised as a review.

What to do, in order

The question the notices leave open

RIZAP says the provider's answer rules out training, yet it has not said how long the provider held the file, who could read it, or which service it was. If your own staff pasted a member file into a personal AI account tomorrow, which of those three answers could you give your regulator by the end of the next day?

Key facts