Panasonic Operational Excellence, a Panasonic Holdings group company, announced on October 23, 2026, that a member of one of its projects had uploaded data on about 334,000 people in Japan to an outside generative AI service whose use it prohibits. The company, based in Kadoma in Osaka Prefecture, runs the project with its subsidiary Panasonic Digital to roll out an HR information system. The apology notice, posted on the Panasonic Holdings website, is addressed to current and former Panasonic group employees and their families.
The data included employee numbers, home and email addresses and phone numbers, along with the names of relatives listed as emergency contacts. Panasonic rules out any intrusion from outside and calls the case a violation of internal policy. The company reported it to Japan’s data protection regulator on September 29. According to the provider of the service, which Panasonic does not name, a copy of the deleted data will be kept until October 25.
The notice came out the same day Swedish public radio reported that the Swedish government would block two consumer AI assistants on its employees’ computers to steer staff toward approved tools.
Four groups of people, and names only for relatives
The data comes from a common HR information system used by Panasonic group companies in Japan. The upload covered part of what that system held as of April 2026.
The notice lists four groups, in rounded figures: 75,000 employees; 178,000 former employees who left between 1978 and fiscal 2026, including people transferred to the buyers of divested businesses; 55,000 employees’ family members; and 26,000 family members of former employees who left in 2016 or later. ITmedia NEWS, which covered the notice on the evening of October 23, Japan time, puts the total at about 334,000 people.
For employees and former employees, the data held the employee number, home address, phone number and email address, but not the name. For relatives, it held the name, address, phone number and email address of the family member registered as an emergency contact, where the employee had registered one.
A report to the regulator on September 29
The notice does not say when the upload took place. The Nikkei business daily puts it in “late September.” According to the notice, right after the incident came to light, the project member deleted the chat history in the AI service and the data stored on the computer used for the work.
On September 29, 2026, Panasonic Operational Excellence reported the case to the Personal Information Protection Commission (PPC), Japan’s data protection authority. The public notice followed 24 days later. Panasonic presents it as a substitute for the individual notification required under Japan’s Act on the Protection of Personal Information, and says the people concerned do not need to take any action. A contact form and a toll-free number are available to former employees and their families.
The AI provider’s answer
Panasonic says it asked the operator of the service for an explanation. According to the answer Panasonic quotes, the feature that lets the provider use data to train its AI was turned off when the data was uploaded. The provider concludes that the data will not be used to answer other users, even if they ask about related topics. Most consumer AI assistants offer a setting like this one, with effects that vary by tool and account type, as this tool-by-tool guide to turning off AI training explains.
According to the same answer, the provider keeps data that users delete for 30 days after deletion, for security and legal compliance reasons. It says the data stays under strict access control and is accessed only for audits and similar requests. The copy deleted right after the discovery will no longer be held as of October 25, when that period ends. Counting back puts the deletion around September 25, a date the notice does not give.
Panasonic says that, based on its investigation and the provider’s answers, it has so far found no public disclosure of the data and no concrete damage from misuse. The company also says the data will not be reused and promises to report any new facts promptly. It plans to review its rules for handling personal data and the way it manages the use of generative AI services, and to step up internal training and awareness.
A rule on the books since 2023
On April 14, 2023, Panasonic Holdings rolled out an in-house generative AI assistant, PX-GPT, to about 90,000 employees in Japan through the company intranet. The launch announcement mentioned usage rules and a reminder to all employees not to enter internal information, trade secrets, personal data or similar material into it.
The October 23 notice does not mention that in-house tool and does not explain why an outside service was used in the HR project.
Gaps in the notice
The notice does not name the AI service, date the upload or say how the incident was discovered. It does not say what the project member intended to do with the data or whether any disciplinary action was taken. It refers to “a project member”; ITmedia and Nikkei describe the person as an employee.
The assurances about training and retention come from the provider, and Panasonic passes them on. With the service unnamed, no outsider can check them. The wording also differs from one source to another: Panasonic speaks of an “upload,” while Nikkei’s headline says the data was “sent out” and the body of its article refers to “leaked data.”
What it means
Panasonic describes a case of shadow AI, meaning staff use of an AI tool the employer has not approved, and lays out the details: the number of people, the data fields, the dates of the report and of the retention period, and the provider’s answer. The ban was in place, the group had launched an in-house tool back in 2023, and the data went out anyway, in an HR project that by its nature handled personnel records.
The case also shows how much stays in the provider’s hands once data is sent. A user’s deletion does not erase everything: under its own rules, the provider keeps a copy for 30 days, and keeping the data out of training depends on a feature that, according to the provider, was turned off before the upload. On October 19, Microsoft proposed treating AI agents as insider risks, much like an employee with too many permissions. The Panasonic case is the most familiar form of that risk: a person breaks a company rule, and the data ends up with an AI service.
Still to watch: whether the copy is gone by October 25 as announced, any reaction from the PPC, the name of the service if Panasonic chooses to give it, and the new rules the company has promised.
Sources
- 外部生成AIサービスへの個人情報アップロードに関するお詫びとお知らせ, Panasonic Operational Excellence (Panasonic Holdings website), October 23, 2026
- パナソニックHD子会社、使用禁止の生成AIに従業員約33万人分の個人情報をアップロード, ITmedia NEWS, October 23, 2026
- パナソニックHD、利用禁止の生成AIに従業員らの情報送出 33万人分, Nikkei, October 23, 2026
- AIアシスタントサービス「PX-GPT」をパナソニックグループ全社員へ拡大 国内約9万人が本格利用開始, Panasonic Holdings, April 14, 2023
Header image: MACCUS chart. Data: Panasonic Operational Excellence notice, October 23, 2026
