RIZAP employee exposed 726 health records through personal AI chat

On 20 August 2026, a staff member at RIZAP Inc., the Japanese fitness and health-guidance group, extracted records from a health-insurance management system and sent them to a personal generative AI chat service that the company had not approved. The Local Government Employees’ Mutual Aid Association disclosed that 726 of its members’ records across fourteen regional branches were involved.

The data included names, dates of birth, insurance-card symbols and numbers, and disease categories such as hypertension, diabetes and dyslipidaemia, which Japan treats as sensitive personal information under the Act on the Protection of Personal Information. The disclosure is noted in Orca AI’s incident archive, which records sources, severity, confidence grade and dispute flags.

The incident is described as not a traditional breach: there was no attacker, no credential compromise and no exploited vulnerability. A routine data-aggregation task used an unexpected tool—a personal browser tab—and data left the company through that channel without the organisation’s awareness. The archive assigns the record the highest confidence level, marks its severity as high, and notes real harm with no disputed flag; both notifying parties align on the mechanism. The article distinguishes what the notices establish from the vendor’s assurances and references further reading at OrcaRouter.