Description: A former contractor of the New South Wales Reconstruction Authority reportedly uploaded a spreadsheet containing personal and health information of Resilient Homes Program applicants to ChatGPT during a three-day period in March 2025. Up to 3,000 people may have reportedly been affected.
Editor Notes: Reconstructing the reported timeline of events: (1) Between 03/12/2025 and 03/15/2025, a former contractor of the NSW Reconstruction Authority (RA) reportedly uploaded a Microsoft Excel spreadsheet containing personal and health information of Resilient Homes Program applicants to the ChatGPT. (2) The RA later identified the upload and initiated a forensic investigation in coordination with Cyber Security NSW to determine scope and exposure. (3) By 10/2025, the Authority completed preliminary analysis, confirming that up to 3,000 people may have been affected and that no evidence of external access had been found. (4) On 10/06/2025, the NSW Reconstruction Authority publicly disclosed the incident, notified the NSW Privacy Commissioner, and issued new internal guidance restricting the use of unauthorized AI platforms. (5) An independent review into the cause and handling of the breach is ongoing.
Entities
View all entitiesAlleged: OpenAI and ChatGPT developed and deployed an AI system, which harmed General public , General public of Australia , General public of New South Wales , Resilient Homes Program , Resilient Homes Program applicants and Government of New South Wales.
Alleged implicated AI system: ChatGPT
Incident Stats
Incident ID
1228
Report Count
1
Incident Date
2025-03-12
Editors
Daniel Atherton
Incident Reports
Reports Timeline
Loading...
The NSW Reconstruction Authority (RA) is aware of a data breach involving personal information belonging to some people who applied for the Northern Rivers Resilient Homes Program (RHP).
The breach occurred when a former contractor of the R…
Variants
A "variant" is an AI incident similar to a known case—it has the same causes, harms, and AI system. Instead of listing it separately, we group it under the first reported incident. Unlike other incidents, variants do not need to have been reported outside the AIID. Learn more from the research paper.
Seen something similar?
Similar Incidents
Did our AI mess up? Flag the unrelated incidents
Similar Incidents
Did our AI mess up? Flag the unrelated incidents