{"schema_version":"0.10.0","id":"LR-2026-0367","record_version":1,"title":"Eindhoven officials expose resident data on public AI websites","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":51.1,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":6.0,"completeness":4.48,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"2a88949ada5aa817b2b221bd331bb38a962abc57839b14e001509807d7fd8a51"},"system":{"model_name":"ChatGPT","model_version":null,"developer":"OpenAI","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2025-12-19","incident_class":"privacy_leakage","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Staff at the municipality of Eindhoven uploaded personal data of residents and employees, including sensitive files from care and support departments, to public AI websites including ChatGPT. The city ran a 30-day sample from 23 September to 23 October 2025 and found several types of personal data, including Jeugdwet documents, internal reports and CVs. Because uploaded data is stored only 30 days, the full extent cannot be determined and not every affected individual can be notified. The breach was reported to the Dutch Data Protection Authority on 23 October 2025. Afterwards the municipality blocked staff access to public AI websites, restricted employees to an internal AI tool in a secure environment, asked OpenAI to delete uploaded files, and intensified monitoring of external data traffic. The city also hired Hooghiemstra and Partners to investigate the breach.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":"deployer","adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK04","secondary_risks":["RK15"]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Unbounded scope stated: the full scope of the breach is unknown and the municipality cannot notify all individuals whose information may have been exposed","harm_class":["privacy"],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://nltimes.nl/2025/12/19/eindhoven-officials-expose-resident-data-public-ai-websites","publisher":"NL Times","date":"2025-12-19","type":"press","title":"Eindhoven officials expose resident data on public AI websites - NL Times","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.model_name":"C","system.developer":"C","event.incident_class":"C","event.responsible_party":"C","impact.harm_class":"C","context.country":"C","context.industry":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.model_name":[{"source_index":0,"quote":"Officials at the municipality of Eindhoven uploaded personal data of residents and employees to public AI websites, including ChatGPT, city authorities confirmed."}],"system.developer":[{"source_index":0,"quote":"Eindhoven also requested OpenAI delete any files uploaded from the city and intensified monitoring of external data traffic."}],"event.incident_class":[{"source_index":0,"quote":"Officials at the municipality of Eindhoven uploaded personal data of residents and employees to public AI websites, including ChatGPT, city authorities confirmed."}],"event.responsible_party":[{"source_index":0,"quote":"Officials at the municipality of Eindhoven uploaded personal data of residents and employees to public AI websites, including ChatGPT, city authorities confirmed."}],"impact.harm_class":[{"source_index":0,"quote":"We are shocked that sensitive personal data were sent to AI websites."}],"context.country":[{"source_index":0,"quote":"The data breach, reported to the Dutch Data Protection Authority on October 23, 2025, involved sensitive files from departments handling care and support for residents."}],"context.industry":[{"source_index":0,"quote":"Officials at the municipality of Eindhoven uploaded personal data of residents and employees to public AI websites, including ChatGPT, city authorities confirmed."}],"impact.severity":[{"source_index":0,"quote":"The full scope of the breach is unknown because uploaded data is stored temporarily for only 30 days."}],"impact.severity_because":[{"source_index":0,"quote":"The full scope of the breach is unknown because uploaded data is stored temporarily for only 30 days."}],"event.summary":[{"source_index":0,"quote":"Officials at the municipality of Eindhoven uploaded personal data of residents and employees to public AI websites, including ChatGPT, city authorities confirmed."},{"source_index":0,"quote":"The city conducted a 30-day sample from September 23 to October 23 and found multiple types of personal data, including Jeugdwet documents, internal reports, and CVs."},{"source_index":0,"quote":"The full scope of the breach is unknown because uploaded data is stored temporarily for only 30 days."},{"source_index":0,"quote":"The data breach, reported to the Dutch Data Protection Authority on October 23, 2025, involved sensitive files from departments handling care and support for residents."},{"source_index":0,"quote":"After discovering the breach, the municipality blocked staff access to public AI websites."},{"source_index":0,"quote":"The city hired legal advisory firm Hooghiemstra & Partners to investigate the nature, scope, and impact of the breach."}]},"notes_on_gaps":"Only one source. The sources do not state the date the uploads occurred, the number of files or affected individuals, a third-party count, the root cause, or any trigger. The uploads were made by staff to public AI websites; no autonomous agent is described, so agent_involved is false and no failure_class is given. The developer OpenAI is inferred from the request to OpenAI to delete files, and ChatGPT is the named service. Deployment context, lifecycle stage and autonomy were not stated and are left out. Detection is recorded as human_review based on the city's own 30-day sample, a judgement. Severity major rests on the stated unknown, unbounded scope. The E2 mapping for monitoring of external data traffic is a judgement. The article date 2025-12-19 is not used as a disclosure date because the source does not state when the city first made the breach public. The control links record only A6 as missing, based on the post-discovery block; no control was stated to have held. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":"public administration","org_size_band":null,"country":"NL","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Municipal staff uploaded personal data of residents and employees to public AI websites, including ChatGPT.","quote":"Officials at the municipality of Eindhoven uploaded personal data of residents and employees to public AI websites, including ChatGPT, city authorities confirmed.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"Sensitive files from care and support departments were included in the uploads.","quote":"The data breach, reported to the Dutch Data Protection Authority on October 23, 2025, involved sensitive files from departments handling care and support for residents.","source_index":0,"grade":"C"},{"step":"reached","text":"The breach primarily affects vulnerable residents, according to the city.","quote":"The breach primarily affects vulnerable residents, though the city said the risk to individuals is limited compared with stolen data.","source_index":0,"grade":"C"},{"step":"caught","text":"The city ran a 30-day sample that found several types of personal data in the uploads.","quote":"The city conducted a 30-day sample from September 23 to October 23 and found multiple types of personal data, including Jeugdwet documents, internal reports, and CVs.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://nltimes.nl/2025/12/19/eindhoven-officials-expose-resident-data-public-ai-websites"]}}