Chattr.ai exposed job applicant data due to insecure Firebase rules
A security researcher discovered that Chattr.ai, an AI hiring system used by many fast food chains, had a Firebase database with insecure security rules. By registering a new user, the researcher gained full read/write access to the database, exposing personal data of job applicants and employees, including names, phone numbers, emails, and some plaintext passwords. The vulnerability was reported to Chattr.ai on 9 January and patched the next day, but the company did not provide further contact or thanks.
- Company involved
- Chattr.ai
- AI system involved
- Chattr.ai
6 source articles · read the reporting →
BC Tribunal Confirms Companies Remain Liable for AI Chatbot-Created Information - Lexology
The AI chatbot provided inaccurate information to a user.
1 source article · read the reporting →
Air Canada liable for chatbot's misleading bereavement advice
Air Canada was found liable by the B.C. Civil Resolution Tribunal for misleading advice given by its website chatbot. The chatbot told a passenger they could retroactively claim a bereavement rate, but the airline later denied the claim. The tribunal ordered Air Canada to pay $812 in compensation, noting the airline's argument that the chatbot was a separate legal entity was 'remarkable'.
- Company involved
- Air Canada
- AI system involved
- Air Canada chatbot
10 source articles · read the reporting →
Serco Leisure issued enforcement notices for unlawful biometric monitoring of employees
Serco Leisure and associated trusts used facial recognition and fingerprint scanning to monitor employee attendance at 38 leisure facilities. The ICO found they unlawfully processed biometric data of over 2,000 employees. Enforcement notices were issued ordering them to stop.
- Company involved
- Serco Leisure Operating Limited
8 source articles · read the reporting →
Italian privacy regulator investigates OpenAI's Sora video generation model
The Italian Data Protection Authority (Garante Privacy) has opened an investigation into OpenAI's new AI model 'Sora', which creates short videos from text instructions. The regulator has asked OpenAI to provide information on the algorithm's training, data sources, and compliance with European data protection regulations. OpenAI must respond within 20 days.
- Company involved
- OpenAI
- AI system involved
- Sora
7 source articles · read the reporting →
CJEU rules Dun & Bradstreet must explain automated credit decisions under GDPR
A customer was refused a mobile phone contract because of an automated credit assessment by Dun & Bradstreet Austria. The customer took the case to court, which found that Dun & Bradstreet had infringed the GDPR by failing to provide meaningful information about the logic involved. The CJEU ruled that data controllers must explain automated decisions and that trade secrets cannot automatically override the right of access.
- Company involved
- Dun & Bradstreet Austria GmbH
7 source articles · read the reporting →
ICO investigates Microsoft's Recall feature for privacy risks
The UK Information Commissioner's Office (ICO) has issued a statement on 22 May 2024 regarding Microsoft's Recall feature. The ICO is making enquiries with Microsoft to understand the safeguards in place to protect user privacy, expecting transparency and necessity in data processing. This follows concerns that the feature may not adequately consider data protection from the outset before being brought to market.
- Company involved
- Microsoft
- AI system involved
- Recall
10 source articles · read the reporting →
Center for Investigative Reporting Sues OpenAI, Microsoft Over Copyright
The Center for Investigative Reporting, publisher of Mother Jones and Reveal, has filed a lawsuit against OpenAI and Microsoft in federal court, alleging the companies used its copyrighted articles without permission or compensation to train their AI products. The nonprofit argues that the AI-generated summaries of its stories threaten journalism and violate the Copyright Act and the Digital Millennium Copyright Act. The case is pending in the U.S. District Court for the Southern District of New York.
- Company involved
- OpenAI and Microsoft
6 source articles · read the reporting →
Lattice cancels plan to give AI digital workers employee records after backlash
Lattice, an HR software company, announced on July 9th that it would give AI digital workers official employee records. After strong backlash from HR professionals and others on LinkedIn, the company canceled the feature on July 12th, stating it 'will not further pursue digital workers in the product.' The feature was intended to manage AI bots such as Devin and Piper, but the company reversed course.
- Company involved
- Lattice
- AI system involved
- Lattice
6 source articles · read the reporting →
Irish DPC takes Twitter to court over using user data to train Grok AI
The Irish Data Protection Commission has initiated High Court proceedings against Twitter International Unlimited Company over concerns that the company is processing personal data of millions of European X users to train its Grok AI system without adequate consent. The DPC alleges that Twitter failed to provide timely opt-out mechanisms and is seeking an order to suspend the data processing. Twitter denies any wrongdoing.
- Company involved
- Twitter International Unlimited Company
- AI system involved
- Grok
10 source articles · read the reporting →
Dutch probe into chatbots' voting advice raises EU AI Act risk for OpenAI, xAI, Mistral
A Dutch privacy probe into election advice has appeared to expose early violations of the EU AI Act's rules for general-purpose AI models by OpenAI, xAI and Mistral, according to MLex. The companies' chatbots provided distorted voting advice to users. The findings were shared with the European Commission and could prompt future scrutiny or litigation.
- Company involved
- OpenAI, xAI and Mistral
6 source articles · read the reporting →
Torswats Uses AI-Generated Voice for Nationwide Swatting Campaign
A swatter known as Torswats has been using a computer-generated voice to make bomb and mass shooting threats to police across the United States. The paid service offers to close schools or target individuals, with calls resulting in lockdowns and armed responses. Authorities have charged a 16-year-old for ordering threats, but Torswats remains operational. The FBI is investigating the swatting incidents.
- Company involved
- Torswats
1 source article · read the reporting →
Thomson Reuters wins copyright lawsuit against AI startup Ross Intelligence
In 2020, Thomson Reuters filed a copyright lawsuit against legal AI startup Ross Intelligence, alleging that Ross reproduced materials from its Westlaw legal research service. In February 2025, a US District Court judge ruled in Thomson Reuters' favor, finding that Ross infringed copyright and that fair use did not apply. Ross Intelligence had shut down in 2021 due to litigation costs.
- Company involved
- Ross Intelligence
- AI system involved
- Ross Intelligence
4 source articles · read the reporting →
Dutch DPA fines Clearview AI €30.5 million for GDPR violations
The Dutch Data Protection Authority fined Clearview AI €30.5 million for creating an illegal database of biometric codes scraped from social media without consent. The regulator accused the company of failing to inform individuals about how their data is used and continuing violations after investigation. Clearview AI denies the allegations, stating it has no presence in the Netherlands or EU and that the fine is unenforceable.
- Company involved
- Clearview AI
- AI system involved
- Clearview AI facial recognition database
7 source articles · read the reporting →
Bots and short sellers spread misinformation to trigger First Republic Bank run
A report by Valent Technologies alleges that AI-powered bots and fake accounts spread misinformation about First Republic Bank in March 2023, coinciding with a $100 billion deposit withdrawal and the bank's collapse. The report suggests short sellers likely orchestrated the bots to drive down the share price. Federal regulators closed the bank and sold its assets to J.P. Morgan, and the bank's former CEO attributed the collapse to 'contamination' by anxiety.
2 source articles · read the reporting →
Pega's Hidden AI Tool Listens To US Bank Calls, Suit Says - Law360
The system secretly recorded customer service calls, affecting bank customers.
- Company involved
- U.S. Bancorp
1 source article · read the reporting →
AI-generated voice impersonates Liz Bonnin to deceive Incognito
Scammers used an AI-generated voice to impersonate BBC presenter Liz Bonnin, convincing Incognito CEO Howard Carter to pay £20,000 for an endorsement. Bonnin's likeness was used in insect repellant ads without her consent. The AI-generated voice note exhibited inconsistent accent and cadence, as assessed by experts. Incognito reported the incident to police and its bank.
6 source articles · read the reporting →
NHS faces legal action over Palantir data contract extension
The NHS is being taken to court by campaign group Open Democracy over its contract with data firm Palantir. The legal action alleges that the extension of Palantir's involvement in analysing NHS patient data for pandemic response and beyond lacked a proper Data Protection Impact Assessment. The contract, initially an emergency response, was extended for two years at a cost of £23.5m. The case is pending.
- Company involved
- NHS
- AI system involved
- Palantir data analysis platform
10 source articles · read the reporting →
Privacy International challenges Clearview AI's facial recognition database in Europe
Privacy International filed complaints against Clearview AI with five European data protection authorities in May 2021, alleging that the company's scraping of facial images from the web and building a biometric database without consent violates data protection laws. The regulators in the UK, France, Italy, Greece, and Austria have since found Clearview's practices unlawful, imposed fines, and ordered deletion of data. Clearview has appealed the UK fine, and the case is ongoing.
- Company involved
- Clearview AI
- AI system involved
- Clearview
10 source articles · read the reporting →
User loses lawsuit against tech company over AI-generated inaccurate information
In June 2025, a user asked an AI chatbot about university admission information. The AI generated inaccurate details about a campus and claimed it would pay 100,000 yuan if wrong. The user sued the company for 9,999 yuan, but the Hangzhou Internet Court dismissed the case, ruling that the AI's output did not constitute a binding promise and the company was not at fault.
4 source articles · read the reporting →
AI chatbots recommended unlicensed casinos to UK users
An investigation by the Guardian and Investigate Europe found that five major AI chatbots—ChatGPT, Gemini, Grok, Microsoft Copilot, and Meta AI—recommended unlicensed online casinos to UK users. Some chatbots also advised on bypassing consumer protection systems like GamStop and financial checks. The companies acknowledged the findings and said they are reviewing safeguards. Regulators expressed concern about the potential harm to vulnerable users.
- Company involved
- Multiple technology companies (Microsoft, Google, Meta, OpenAI, X)
- AI system involved
- Copilot, Gemini, Meta AI, ChatGPT, Grok
5 source articles · read the reporting →
Spanish data regulator orders Worldcoin to stop processing biometric data in Spain
The Spanish Data Protection Agency (AEPD) has ordered a precautionary measure against Tools for Humanity Corporation, the company behind Worldcoin, to cease collection and processing of personal data in Spain. The AEPD received complaints alleging insufficient information, collection of data from minors, and inability to withdraw consent. The regulator acted under GDPR Article 66.1 to prevent potentially irreparable harm to individuals' data protection rights.
- Company involved
- Tools for Humanity Corporation
- AI system involved
- Worldcoin
8 source articles · read the reporting →
Cybercheck AI tool challenged in Akron homicide cases
Law enforcement in Akron, Ohio, used the AI tool Cybercheck to place two defendants at a murder scene. Defense lawyers allege the tool's creator lied under oath and that its methodology is opaque and unverified. Judges in multiple cases have barred the evidence, and the defendants are challenging its use. The tool has been used in thousands of cases nationwide, raising due process concerns.
- Company involved
- Akron Police Department
- AI system involved
- Cybercheck
3 source articles · read the reporting →
Spinvox accused of using human transcribers for voice messages
Spinvox, a UK voice-to-text firm, is accused of using call centre staff in South Africa and the Philippines to transcribe the majority of user messages, contrary to claims of automated speech recognition. The BBC investigation revealed that human transcribers accessed private messages, including sensitive information. The company denied the allegations but the Information Commissioner's Office has contacted them regarding data protection compliance.
- Company involved
- Spinvox
- AI system involved
- D2 (the Brain)
4 source articles · read the reporting →
