The Pulse
Panasonic Says Staff Uploaded 334,000 People’s Data to Banned AI
Panasonic Operational Excellence says a project member uploaded data on about 334,000 employees, former employees and family members to an external generative AI service barred by company rules. The company says it has found no public discl
AI.info Team · Written with AI · fact-checked ·
334,000 people’s records reached an AI service
Panasonic Operational Excellence says a project member uploaded personal data covering about 334,000 people to an external generative AI service that the company had prohibited for internal use. The company disclosed the incident on October 23, saying the upload happened during a human-resources information system project conducted with its subsidiary, Panasonic Digital. The data came from records in the system as of April 2026.
The affected group includes about 75,000 current employees and 178,000 former employees, along with about 55,000 employee family members and 26,000 family members of former employees. The first two groups’ records included employee numbers, addresses, telephone numbers and email addresses, but not names. Family records included names and contact details registered as emergency contacts; the former-employee family figure covers people whose relatives left Panasonic from 2016 onward.
Panasonic says the upload broke internal rules
The company says the incident did not result from an outside party gaining unauthorized access. Instead, it attributes the upload to a project member’s violation of company rules. Panasonic’s notice does not identify the AI service or explain why the data was uploaded.
本件は外部からの不正な操作によるものではなく、プロジェクトメンバーによるルール違反に伴うデータのアップロードです。
Panasonic Operational Excellence, notice dated October 23, 2026
The company’s statement says the upload was not caused by unauthorized outside activity, but by a project member’s rule violation. Panasonic says it reported the matter to Japan’s Personal Information Protection Commission on September 29, before making the notice public. The announcement serves as an alternative to individual notification under Japan’s personal information protection law, and the company says affected people do not need to take action.
Deleted files remain with the provider through October 25
After the incident came to light, the project member deleted the AI chat history and the relevant data from a work computer, according to Panasonic. The company says the AI provider told it that the setting for using uploaded data to train its model was disabled at the time of the upload. On that basis, Panasonic says the data would not be used in responses to other users.
Deletion from the user’s account did not mean immediate removal from the service provider’s systems. Panasonic says the provider retains deleted data for 30 days for security and legal-compliance purposes, with access restricted except for audit-related requests. The data deleted immediately after the incident is scheduled to leave the provider’s systems after that period, on October 25.
No public release or confirmed misuse found
Panasonic says its investigation and checks with the service provider have found no evidence that the information was made public or that the incident caused specific harm through misuse. The company also says it confirmed the data would not be used again. Those findings reflect the company’s account of its investigation; its notice says it will continue monitoring for new information.
Panasonic Operational Excellence says it plans to review its rules for handling personal information and its controls on generative AI services, while strengthening training for people involved. The incident places a large set of employee and family contact records in an external service despite an internal ban. The provider’s stated retention period ends October 25, while Panasonic’s review of its safeguards is still underway.