Now Hacked
EN-GB
Data breach

Procurement agency exposes facial photos of 189 evaluators to external AI

First reported · Last reported · 15 related reports

A Public Procurement Service employee sent facial photographs used to verify the identities of 189 online evaluators to ChatGPT, an external generative AI service, while developing and testing a work-related AI system from July to October 2026. The agency confirmed the exposure on 6 November, reported it to the Personal Information Protection Commission (PIPC), and proceeded with individual notifications to those affected and a request to the service operator to delete the photographs. No exposure of personal data other than the photographs or secondary harm was confirmed.

Key facts

Affected organisation
Public Procurement Service
Incident type
Data breach
Occurred / detected
2026-07
Scale of damage
Facial photographs used to verify the identities of 189 online evaluators
Cause / method
An employee uploaded facial photographs to an external generative AI service while developing and testing an AI system
Location
South Korea

If your data was exposed

View Public Procurement Service notice ↗
  1. Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.
  2. If you’ve suffered harm, report it. Call 118 (no area code) for privacy violations, contact the police for financial losses, and apply for dispute mediation to seek compensation.Personal Information Infringement Report Centre ↗Korean National Police Agency cybercrime report ↗Personal Information Dispute Mediation Committee ↗

Lookup and notice links are official pages found by AI. Make sure the address is on the organisation’s official domain before using it.

Timeline

  1. The Public Procurement Service confirmed the exposure of facial photographs of 189 evaluators and reported it to the Personal Information Protection Commission (PIPC).
  2. The Public Procurement Service said it was notifying those affected and requesting deletion of the photographs, and that no exposure of other personal data or secondary harm had been confirmed.
  3. The Public Procurement Service said disciplinary action against the employee responsible for the exposure would be decided after the investigation concluded.

15 related reports

The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.