Panasonic says project member uploaded data on 334,000 people to AI service it prohibits

The addresses, telephone numbers and email addresses of about 334,000 current and former Panasonic employees in Japan and their relatives were uploaded to an outside generative-AI service that the company prohibits, a Panasonic group company said on Friday.

Panasonic said it had found no evidence so far that the data had been made public or misused, and that the people affected did not need to take any action. Relatives registered as emergency contacts are among those affected, and their names were included in the data.

The statement was issued on 23 October by Panasonic Operational Excellence, a Panasonic Holdings group company, and published on the Panasonic Holdings website. It said a member of a project to introduce a human-resources information system, which the company is running with its subsidiary Panasonic Digital, uploaded the data in breach of company rules. The incident "was not caused by unauthorised operation from outside", the statement said [translated].

The data was part of what was registered in the HR information system as of April 2026, the statement said. It covered about 75,000 current employees and about 178,000 former employees who left between 1978 and the 2026 financial year, at Panasonic group companies in Japan that use the group's common HR system. Former employees who transferred to buyers of businesses Panasonic has sold are included.

For employees and former employees, the data comprised "employee number, address, telephone number, email address" [translated], and the statement said names were not included.

The data on relatives was different. About 55,000 relatives of current employees and about 26,000 relatives of former employees who left in 2016 or later were affected, in each case only where the employee had registered them in the HR system. For them, the data covered the "name, address, telephone number and email address of family members registered as emergency contacts in place of the employee" [translated]. That means relatives' names were included even though employees' own names were not. The four groups add up to about 334,000 people.

Panasonic said it reported the matter to Japan's Personal Information Protection Commission (PPC), the national privacy regulator, on 29 September. The company said its public notice serves as a substitute for notifying each affected person individually under Japan's Act on the Protection of Personal Information. The statement did not say whether the commission plans to take any action.

Immediately after the problem came to light, the project member deleted the generative-AI chat history and the data on the PC used for the work, Panasonic said. The statement did not give the date of the upload or say how it was discovered. The Nikkei business daily reported that the upload took place in late September, and the Sankei Shimbun reported that an internal company system detected the violation. Neither detail appears in Panasonic's statement.

According to the statement, the AI provider told Panasonic that the function allowing uploaded data to be used for AI training was switched off when the upload took place, so the data would not be used in answers to other users' questions. The provider keeps data for 30 days from the date a user deletes it, for security and legal-compliance reasons, under strict access controls, and the data is not accessed except when required for purposes such as audits. The data deleted immediately after the problem came to light will no longer be held by the provider from 25 October onward, once that 30-day period has passed, Panasonic said.

Panasonic did not name the generative-AI service or its operator. It also did not say whether the project member was a direct employee or worked for an outside contractor, or whether anyone has been disciplined. ITmedia NEWS and the Nikkei described the person as an employee.

"Based on our investigation and our enquiries with the AI service provider, it has not been confirmed at this time that the personal information of the employees, former employees and family members concerned has been made public, nor has any concrete damage from misuse been confirmed," the statement said [translated]. Panasonic said it had also confirmed that the data would not be put to any further use, and that it would announce any new findings promptly.

The company said it takes the incident seriously and is reviewing its rules on handling personal information and its management of generative-AI services, while strengthening training for those involved. It apologised to those affected for "the great concern and inconvenience" [translated].

Other large companies have restricted staff use of outside generative-AI tools over data security concerns. In May 2023, Samsung Electronics confirmed to CNBC that it was temporarily restricting the use of generative AI on company computers, after Bloomberg News reported that staff had uploaded sensitive internal code to ChatGPT.

Panasonic has set up an online enquiry form for former employees and their families, and a dedicated toll-free line in Japan, 0120-877-872, for those unable to use the form. The line is staffed from 9am to 7pm, Monday to Friday, excluding public holidays and company holidays.