This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
A former contractor for the New South Wales Reconstruction Authority uploaded a spreadsheet containing the personal and health information of up to 3,000 applicants of the Resilient Homes Program to ChatGPT between March 12 and 15, 2025. The NSW government has initiated an investigation and is providing support to affected individuals, noting that while there is no evidence of third-party access, the breach of sensitive data is significant. The incident has prompted the authority to strengthen internal controls and issue clear guidance regarding the use of unauthorized AI platforms.
A former contractor of the New South Wales Reconstruction Authority reportedly uploaded a spreadsheet containing personal and health information of Resilient Homes Program applicants to ChatGPT during a three-day period in March 2025. Up to 3,000 people may have reportedly been affected.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
Also classified as
The contractor unsafely used an unauthorized public AI tool to process sensitive government data without understanding the privacy implications.
The incident involved the unauthorized upload of non-public sensitive personal and health information of up to 3,000 individuals to a third-party AI platform, directly compromising their privacy.
Human
Due to a decision or action made by humans
Unintentional
Due to an unexpected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The data breach was caused by a human decision when a contractor uploaded sensitive files to ChatGPT post-deployment, resulting in an unintentional exposure of personal information.
Added categories peak at 2: Minor (Psychological Harm, Indirect)
A former contractor for the New South Wales Reconstruction Authority uploaded sensitive personal and health data of 3,000 flood victims to ChatGPT. While representing a significant domestic privacy breach and highlighting government data governance challenges, the incident has negligible national security implications and is manageable through standard administrative procedures.
The report describes ChatGPT as an online AI tool that 'allows users to ask questions or upload information to help generate written content or ideas', which aligns with the Assistant behavior type.
Limited Risk (Level 3): The system involved is ChatGPT, a chatbot. The report states 'ChatGPT is an online AI tool... It allows users to ask questions or upload information to help generate written content or ideas', which fits the definition of a chatbot requiring transparency.
The system ChatGPT is described as an online AI tool that allows users to ask questions or upload information to help generate written content or ideas, functioning primarily as a chatbot and writing assistant.
The reports are official government statements and reputable news articles detailing the specific dates, the nature of the data, the AI tool used, and the estimated number of affected individuals. There is little ambiguity regarding the sequence of events or the primary risk domain.
None. The incident is clearly a data privacy breach caused by human misuse of an AI tool.
Technology
Unsecured AI Platform Use
Contractor uploaded sensitive data to ChatGPT, an unauthorized online tool.
Lack of Technical Safeguards
No system blocks were initially in place to prevent uploads to AI tools.
Data Inputs
Unencrypted Sensitive Spreadsheet
A Microsoft Excel sheet with 12,000 rows of personal data was uploaded.
Human Factors
Unauthorized Contractor Action
A former contractor manually uploaded sensitive client data to ChatGPT.
Process and Methods
Inadequate System Controls
Internal systems did not prevent the export and external upload of data.
Lack of Clear AI Guidance
Clear guidance on non-sanctioned AI tools was not initially issued.
Management
Insufficient Contractor Oversight
Lack of strict monitoring over contractor data handling and tool usage.
Incomplete Cyber Security Training
Mandatory training on data obligations for AI tools was not fully updated.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
