{
 "name": "Hurt by Bot — AI incident dataset",
 "url": "https://hurtbybot.com/",
 "ai_generated": true,
 "ai_note": "Text fields were written and translated by AI and checked automatically against the cited sources, without review by a human editor. Source titles and linked articles belong to their publishers and are not covered by this licence.",
 "license": "CC BY 4.0",
 "license_url": "https://creativecommons.org/licenses/by/4.0/",
 "attribution": "Hurt by Bot (hurtbybot.com)",
 "generated_at": "2026-10-19T01:56:00Z",
 "count": 2,
 "incidents": [
  {
   "id": 17,
   "url": "https://hurtbybot.com/en/incidents/17-spanish-data-authority-says-first-breach-notification/",
   "title": "Spanish data authority says first breach notification involves AI agent attack",
   "summary": "According to the Spanish data protection authority (AEPD), it received the first notification of a personal data breach in which the attack was allegedly carried out by an AI agent using a well-known language model.\n\nAccording to the AEPD, the agent searched for vulnerabilities, logged in successfully and then autonomously looked for weaknesses in the application, which allowed it to modify personal data and access invoices. The AEPD said the information comes from the notification filed by the affected organisation and still has to be analysed. It added that using a given model does not mean the model or its provider's infrastructure was compromised, or that the tool was designed for malicious activity. The sources do not state how many people were affected, and the organisation is not named.",
   "translations": {
    "zh": {
     "title": "西班牙数据监管机构称首例数据泄露通报涉及 AI 智能体攻击",
     "summary": "据西班牙数据保护机构AEPD称,其收到首份个人数据泄露通报,攻击据称由知名语言模型驱动的AI智能体实施。AEPD称,该智能体登录后自主寻找漏洞,修改个人数据并访问发票;信息来自受影响机构通报,仍需分析,使用某模型不意味着模型或其提供方基础设施遭入侵,也不意味着工具为恶意而设计。"
    },
    "es": {
     "title": "La autoridad española de protección de datos informa de que la primera notificación de brecha involucra un ataque de un agente de IA",
     "summary": "Según la Agencia Española de Protección de Datos (AEPD), esta recibió la primera notificación de una brecha de datos personales en la que el ataque habría sido ejecutado por un agente de IA que utilizaba un conocido modelo de lenguaje.\n\nSegún la AEPD, el agente buscó vulnerabilidades, inició sesión con éxito y luego buscó de forma autónoma debilidades en la aplicación, lo que le habría permitido modificar datos personales y acceder a facturas. La AEPD dijo que la información procede de la notificación presentada por la organización afectada y que aún debe ser analizada. Añadió que el uso de un determinado modelo no significa que el modelo o la infraestructura de su proveedor hayan sido comprometidos, ni que la herramienta haya sido diseñada para actividades maliciosas. Las fuentes no indican cuántas personas resultaron afectadas, y la organización no es identificada."
    },
    "pt": {
     "title": "Autoridade de dados espanhola diz que primeira notificação de violação envolve ataque de agente de IA",
     "summary": "Segundo a autoridade espanhola de proteção de dados (AEPD), ela recebeu a primeira notificação de violação de dados pessoais em que o ataque teria sido executado por um agente de IA que usava um modelo de linguagem conhecido.\n\nSegundo a AEPD, o agente buscou vulnerabilidades, conseguiu fazer login e, em seguida, procurou fraquezas na aplicação de forma autônoma, o que permitiu modificar dados pessoais e acessar faturas. A AEPD disse que as informações vêm da notificação apresentada pela organização afetada e que ainda precisam ser analisadas. Acrescentou que o uso de determinado modelo não significa que o modelo ou a infraestrutura de seu provedor tenha sido comprometido, nem que a ferramenta tenha sido projetada para atividades maliciosas. As fontes não informam quantas pessoas foram afetadas, e a organização não é identificada."
    },
    "fr": {
     "title": "Selon l'autorité espagnole de protection des données, une première notification de violation implique une attaque menée par un agent d'IA",
     "summary": "Selon l'autorité espagnole de protection des données (AEPD), celle-ci a reçu la première notification de violation de données personnelles dans laquelle l'attaque aurait été menée par un agent d'IA utilisant un modèle de langage très connu.\n\nSelon l'AEPD, l'agent a recherché des vulnérabilités, s'est connecté avec succès, puis a cherché de manière autonome des failles dans l'application, ce qui lui aurait permis de modifier des données personnelles et d'accéder à des factures. L'AEPD indique que les informations proviennent de la notification déposée par l'organisation concernée et doivent encore être analysées. Elle ajoute que l'utilisation d'un modèle donné ne signifie pas que le modèle ou l'infrastructure de son fournisseur ait été compromis, ni que l'outil ait été conçu pour une activité malveillante. Les sources ne précisent pas le nombre de personnes touchées, et l'organisation n'est pas nommée."
    },
    "de": {
     "title": "Spanische Datenschutzbehörde meldet erste Datenpannen-Meldung mit KI-Agent-Angriff",
     "summary": "Laut der spanischen Datenschutzbehörde (AEPD) ist dort die erste Meldung einer Verletzung personenbezogener Daten eingegangen, bei der der Angriff mutmaßlich von einem KI-Agenten ausgeführt wurde, der ein bekanntes Sprachmodell nutzte.\n\nLaut der AEPD suchte der Agent nach Schwachstellen, meldete sich erfolgreich an und suchte anschließend selbstständig nach Schwachstellen in der Anwendung, wodurch er personenbezogene Daten ändern und auf Rechnungen zugreifen konnte. Die AEPD erklärte, die Informationen stammten aus der Meldung der betroffenen Organisation und müssten noch analysiert werden. Sie fügte hinzu, dass die Nutzung eines bestimmten Modells nicht bedeute, dass das Modell oder die Infrastruktur seines Anbieters kompromittiert worden sei oder dass das Werkzeug für schädliche Aktivitäten konzipiert gewesen sei. Den Quellen zufolge geht aus den Angaben nicht hervor, wie viele Personen betroffen waren, und die Organisation wird nicht genannt."
    },
    "ja": {
     "title": "スペインのデータ保護当局、AIエージェントによる攻撃を含む初の違反通知を受理と発表",
     "summary": "スペインのデータ保護当局(AEPD)によると、同当局は、よく知られた言語モデルを利用したAIエージェントが攻撃を実行したとされる個人データ侵害について、初の通知を受け取った。\n\nAEPDによると、このエージェントは脆弱性を探索してログインに成功し、その後自律的にアプリケーション内の弱点を探した。その結果、個人データの改変と請求書へのアクセスが可能になったという。AEPDは、情報は影響を受けた組織が提出した通知に基づくものであり、なお分析が必要だと述べた。また、特定のモデルを使用したことは、そのモデルまたは提供事業者のインフラが侵害されたことや、当該ツールが悪意のある活動のために設計されたことを意味しないと付け加えた。情報源は影響を受けた人数を明らかにしておらず、組織名も明らかにされていない。"
    },
    "ko": {
     "title": "스페인 데이터 당국, 첫 개인정보 유출 신고에 AI 에이전트 공격 포함 발표",
     "summary": "스페인 개인정보보호청(AEPD)에 따르면, 이 기관은 한 유명 언어 모델을 사용한 AI 에이전트가 공격을 수행한 것으로 알려진 첫 개인정보 유출 신고를 접수했다.\n\nAEPD에 따르면, 에이전트는 취약점을 검색해 로그인에 성공한 뒤 애플리케이션의 약점을 자율적으로 찾았고, 이를 통해 개인정보를 수정하고 청구서에 접근할 수 있었다. AEPD는 이 정보가 영향을 받은 기관이 제출한 신고에서 나온 것이며 아직 분석이 필요하다고 밝혔다. 또한 특정 모델을 사용했다고 해서 해당 모델이나 제공업체의 인프라가 침해된 것을 의미하지는 않으며, 해당 도구가 악의적 활동을 위해 설계된 것을 뜻하지도 않는다고 덧붙였다. 출처들은 영향을 받은 사람의 수를 밝히지 않았으며, 해당 기관의 이름도 공개되지 않았다."
    }
   },
   "reported_date": "2026-09-14",
   "occurred_date": null,
   "occurred_precision": "unknown",
   "countries": [],
   "harm_types": [
    "security",
    "privacy"
   ],
   "system_types": [
    "ai-agent"
   ],
   "sectors": [
    "other"
   ],
   "victim_types": [
    "individual"
   ],
   "severity": 1,
   "confirmation": "reported",
   "followup": "open",
   "companies": [],
   "timeline": [
    {
     "date": "2026-09-14",
     "type": "first_report",
     "text": "According to the AEPD, it received the first breach notification in which an attack was allegedly executed by an AI agent."
    },
    {
     "date": null,
     "type": "update",
     "text": "The AEPD said the information comes from the affected organisation's notification and will be subject to analysis."
    }
   ],
   "cases": [],
   "sources": [
    {
     "url": "https://www.aepd.es/prensa-y-comunicacion/blog/primera-notiviacion-brecha-datos-personales-causada-por-ataque-ejecutado-mediante-agente-ia",
     "title": "Primera notificación de una brecha de datos personales causada por un ataque ejecutado mediante un agente de IA | AEPD",
     "publisher": "Agencia Española de Protección de Datos",
     "published_at": "2026-09-14",
     "retrieved_at": "2026-10-18T15:57:54Z"
    }
   ],
   "created_at": "2026-10-18T15:59:19Z",
   "updated_at": "2026-10-18T15:59:19Z"
  },
  {
   "id": 16,
   "url": "https://hurtbybot.com/en/incidents/16-gov-za-reports-apparent-ai-hallucinations-in-white-paper/",
   "title": "gov.za reports apparent AI hallucinations in white paper references",
   "summary": "gov.za reported that the Department of Home Affairs detected apparent AI hallucinations in references appended to the Revised White Paper on Citizenship, Immigration and Refugee Protection. The Department of Home Affairs said that an initial internal review suggests the references were generated and attached after the fact. The Department of Home Affairs announced two precautionary suspensions of senior officials, one already carried out and the other to take effect later. The Department of Home Affairs said that it withdrew the reference list and appointed two independent law firms to manage discipline and review policy documents.\nThe Department of Home Affairs said that the body of the white paper is not materially affected. The Department of Home Affairs apologized for an unacceptable oversight. The Department of Home Affairs said that it will add AI checks and declarations to its internal approval processes. The investigation is ongoing.",
   "translations": {
    "zh": {
     "title": "gov.za报道白皮书参考文献中出现疑似AI幻觉",
     "summary": "gov.za报道称，Department of Home Affairs在修订版白皮书所附参考文献中发现疑似AI幻觉。Department of Home Affairs称相关文献可能是事后附加的，宣布对两名高级官员预防性停职，一人已执行，另一人稍后生效，并为此致歉，表示正文未受实质影响。调查仍在进行中。"
    },
    "es": {
     "title": "gov.za informa de posibles alucinaciones de la IA en las referencias de un libro blanco",
     "summary": "gov.za informó de que el Department of Home Affairs detectó posibles alucinaciones de la IA en las referencias adjuntas al Libro Blanco Revisado sobre Ciudadanía, Inmigración y Protección de Refugiados. Según el Department of Home Affairs, una revisión interna inicial sugiere que las referencias fueron generadas y añadidas posteriormente. El Department of Home Affairs anunció dos suspensiones preventivas de altos funcionarios, una ya ejecutada y la otra que entrará en vigor más adelante. El Department of Home Affairs dijo que retiró la lista de referencias y designó a dos bufetes de abogados independientes para gestionar la disciplina y revisar los documentos de política.\nEl Department of Home Affairs afirmó que el cuerpo del libro blanco no se ve afectado de forma sustancial. El Department of Home Affairs se disculpó por un descuido inaceptable. El Department of Home Affairs dijo que incorporará controles y declaraciones sobre IA en sus procesos internos de aprobación. La investigación sigue en curso."
    },
    "pt": {
     "title": "gov.za relata possíveis alucinações da IA em referências de livro branco",
     "summary": "A gov.za relatou que o Department of Home Affairs detectou aparentes alucinações da IA nas referências anexadas ao Livro Branco Revisado sobre Cidadania, Imigração e Proteção a Refugiados. Segundo o Department of Home Affairs, uma revisão interna inicial sugere que as referências foram geradas e anexadas posteriormente. O Department of Home Affairs anunciou duas suspensões preventivas de altos funcionários, uma já realizada e a outra com efeito posterior. O Department of Home Affairs disse que retirou a lista de referências e nomeou duas bancas de advocacia independentes para gerir a disciplina e revisar os documentos de políticas.\nO Department of Home Affairs disse que o corpo do livro branco não é materialmente afetado. O Department of Home Affairs pediu desculpas por uma falha inaceitável. O Department of Home Affairs afirmou que acrescentará verificações e declarações sobre IA aos seus processos internos de aprovação. A investigação está em andamento."
    },
    "fr": {
     "title": "gov.za signale de présumées hallucinations de l'IA dans les références du livre blanc",
     "summary": "gov.za a indiqué que Department of Home Affairs a détecté de présumées hallucinations de l'IA dans les références annexées au Livre blanc révisé sur la citoyenneté, l'immigration et la protection des réfugiés. Selon Department of Home Affairs, un premier examen interne laisse penser que ces références ont été générées puis ajoutées après coup. Department of Home Affairs a annoncé deux suspensions préventives de hauts responsables, l'une déjà appliquée et l'autre devant prendre effet ultérieurement. Department of Home Affairs a indiqué qu'elle avait retiré la liste de références et désigné deux cabinets d'avocats indépendants pour gérer les suites disciplinaires et réexaminer les documents de politique.\nSelon Department of Home Affairs, le corps du livre blanc n'est pas sensiblement touché. Department of Home Affairs s'est excusé pour une négligence inacceptable. Department of Home Affairs a indiqué qu'il ajoutera des contrôles et des déclarations relatives à l'IA à ses processus internes d'approbation. L'enquête se poursuit."
    },
    "ja": {
     "title": "gov.za、白書の参考文献にAIハルシネーションとみられる誤りを報道",
     "summary": "gov.zaは、Department of Home Affairsが改訂版の市民権・移民・難民保護白書の参考文献にAIハルシネーションとみられる誤りを検出したと報じた。Department of Home Affairsによると、当初の内部調査では参考文献は事後に生成され添付された可能性が示唆されている。Department of Home Affairsは上級職員二名の予防的職務停止(一名は実施済み、もう一名は後日発効)を発表し、参考文献一覧を撤回、懲戒対応と政策文書の見直しのため独立系法律事務所二社を任命した。白書本文に重大な影響はないとし、許容できない見落としだったと謝罪、内部承認手続きにAIの確認と宣言を加える方針だ。調査は継続中。"
    },
    "ko": {
     "title": "gov.za, 백서 참고문헌에서 AI 환각 의심 사례 보도",
     "summary": "gov.za 보도에 따르면 Department of Home Affairs는 개정 시민권·이민·난민 보호 백서의 참고문헌에서 AI 환각으로 보이는 오류를 발견했다. 초기 내부 검토에서는 참고문헌이 사후에 생성되어 첨부된 것으로 보인다고 밝혔다.\nDepartment of Home Affairs는 고위 공무원 두 명에 대해 예방 차원의 직무 정지를 발표했다. 한 명은 이미 시행됐고 다른 한 명은 추후 시행될 예정이다. 참고문헌 목록은 철회했으며 독립 법률사무소 두 곳을 선임해 징계와 정책 문서 검토를 맡겼다. 백서 본문은 중대한 영향을 받지 않았다고 밝혔다. 내부 승인 절차에 AI 점검과 확인서를 추가할 방침이다. 용납하기 어려운 관리 소홀에 대해 사과했다. 조사는 진행 중이다."
    }
   },
   "reported_date": "2026-04-30",
   "occurred_date": "2026-04",
   "occurred_precision": "month",
   "countries": [
    "ZA"
   ],
   "harm_types": [
    "legal-professional"
   ],
   "system_types": [
    "llm-tooling"
   ],
   "sectors": [
    "government"
   ],
   "victim_types": [
    "public"
   ],
   "severity": 1,
   "confirmation": "party_confirmed",
   "followup": "investigation",
   "companies": [
    {
     "name": "Department of Home Affairs",
     "role": "deployer"
    }
   ],
   "timeline": [
    {
     "date": "2026-04-30",
     "type": "first_report",
     "text": "gov.za reported that the Department of Home Affairs found apparent AI hallucinations in the reference list of the Revised White Paper."
    },
    {
     "date": "2026-04-30",
     "type": "response",
     "text": "The Department of Home Affairs announced two precautionary suspensions, one carried out and one to follow, plus withdrawal of the reference list and two independent law firms."
    }
   ],
   "cases": [],
   "sources": [
    {
     "url": "https://www.gov.za/news/media-statements/home-affairs-suspends-two-officials-over-ai-use-linked-revised-white-paper",
     "title": "Home Affairs suspends two officials over AI use linked to revised White Paper on Citizenship and Immigration",
     "publisher": "gov.za",
     "published_at": "2026-04-30",
     "retrieved_at": "2026-10-18T15:57:50Z"
    }
   ],
   "created_at": "2026-10-18T19:50:25Z",
   "updated_at": "2026-10-18T19:50:25Z"
  }
 ]
}