In the best-known cases of confidential data leaking through ChatGPT and similar chatbots, the data got out in one of three ways: someone pasted it in, a copy was stored somewhere the user had forgotten about, or a sharing feature made it public. A software bug on the provider's side is the rarer fourth. Each way has its own habit that prevents it, and the cases below show which one.
People pasted confidential material
Samsung, 2023. In March 2023, engineers in Samsung's semiconductor division entered company data into ChatGPT on three occasions, according to Economist Korea, as reported by CIO Dive. One pasted faulty source code from a measurement database program and asked for a fix. Another pasted code for identifying defective equipment and asked for it to be optimized. A third turned a recording of a meeting into text and asked ChatGPT for the minutes. Samsung then limited each prompt to 1,024 bytes, the report said.
On 2 May 2023, Samsung confirmed to CNBC that it was temporarily restricting generative AI on company computers. Bloomberg had reported the internal memo that announced the policy.
Nobody broke into anything. The employees sent the data to a service outside the company, and that was enough for it to leave.
The acting head of CISA, 2025. On 27 January 2026, Politico reported, citing four Department of Homeland Security officials, that Madhu Gottumukkala, acting director of the US Cybersecurity and Infrastructure Security Agency, uploaded contracting documents marked "for official use only" into the public version of ChatGPT in summer 2025. According to the report, none of the files were classified. The uploads set off automated security alerts. He had been given an exception to use ChatGPT while the app was blocked for other DHS staff.
The lesson is the same as at Samsung. A label on a document does not stop anyone pasting it. What stops it is a rule about which tool may receive which data, and a habit of checking before pasting.
A bug showed one user's data to another
On 20 March 2023, OpenAI took ChatGPT offline. In its post-mortem, the company said a bug in redis-py, an open-source library, had let some users see the titles of other active users' chats. The first message of a new conversation might also have shown up in someone else's history.
The same bug may have exposed payment details of 1.2% of ChatGPT Plus subscribers who were active during a nine-hour window: name, email address, payment address, card type, the last four digits of the card number and the expiry date. OpenAI said full card numbers were never exposed.
Ten days later, Italy's data protection authority, the Garante, ordered a temporary limitation on OpenAI's processing of Italian users' data. It cited the breach, the lack of information given to users, the lack of a legal basis for training on personal data, and the absence of age checks. In December 2024 the Garante fined OpenAI €15 million, finding among other things that OpenAI had not notified it of the March 2023 breach. The Court of Rome upheld OpenAI's appeal against that decision in a judgment published on 18 March 2026, according to a note the Garante added to the same page.
This is the only case on the list where the user did nothing wrong. A bug like this cannot be prevented from your side. You can only decide what is in your chats when one happens.
Shared chats turned up in Google
ChatGPT lets you create a link to a conversation and send it to someone. For a while, the sharing dialog also had a checkbox, "Make this chat discoverable", which allowed search engines to index the chat. On 30 July 2025, Fast Company reported that thousands of shared ChatGPT conversations were appearing in Google results, some of them with personal details.
The next day, OpenAI's chief information security officer Dane Stuckey wrote on X that OpenAI had removed the option, calling it a short-lived experiment that "introduced too many opportunities for folks to accidentally share things they didn't intend to". He said OpenAI was also working to remove indexed content from search engines. The feature had been opt-in, as TechCrunch noted: a chat became public only after the user created a link and ticked the box.
Every affected user had ticked the box. A share link is a public copy of the chat, though, and people did not think of it that way when they made one.
Stored chats became evidence
The New York Times v. OpenAI, 2025. On 13 May 2025, in the copyright case brought by The New York Times and other news organizations, US Magistrate Judge Ona Wang ordered OpenAI to preserve output log data that would otherwise be deleted. As OpenAI explained, this covered deleted ChatGPT chats of Free, Plus, Pro and Team users and API data, which normally leave its systems within 30 days. ChatGPT Enterprise, ChatGPT Edu and API customers with Zero Data Retention were not affected.
The obligation ended on 26 September 2025 under a stipulation the court approved on 9 October. Logs already preserved stayed preserved, except those from the European Economic Area. OpenAI says it still stores limited April to September 2025 data at the plaintiffs' demand. Separately, the court ordered OpenAI to give the plaintiffs a sample of 20 million de-identified consumer ChatGPT logs; Judge Sidney Stein affirmed that order on 5 January 2026.
These chats were not published. Still, a chat the user had deleted was kept for months because of a lawsuit the user had no part in. "Delete" describes the provider's normal policy, and a court can suspend that policy.
United States v. Heppner, 2026. This case involved Claude, not ChatGPT, but the reasoning applies to any consumer chatbot. A defendant in a federal criminal case had used the consumer version of Claude to prepare reports on his defense and later shared them with his lawyers. On 17 February 2026, Judge Jed Rakoff of the Southern District of New York explained in writing why those documents were protected by neither attorney-client privilege nor the work product doctrine. Claude is not a lawyer. The chats were not confidential, because Anthropic's privacy policy allowed it to disclose data to third parties, including government authorities. And his lawyers had not directed him to use the tool.
The court described this as a question of first impression. It is one district court decision in one country, and other courts may reason differently. If you advise clients or work under privilege, ask a lawyer in your jurisdiction what it means for your practice.
All six cases in one table
| Incident | What leaked | Mechanism | Lesson |
|---|---|---|---|
| Samsung, March 2023 | Source code, a meeting transcript | People sent it | Pasting is sending |
| CISA acting director, summer 2025 | Documents marked "for official use only" | People sent it | A label does not stop a paste; a tool rule does |
| ChatGPT outage, March 2023 | Other users' chat titles, some Plus payment details | Provider bug | What you sent is what a bug can expose |
| Discoverable shared chats, July 2025 | Conversations users had shared | Sharing feature | A share link is a public copy |
| NYT v. OpenAI, May to September 2025 | Deleted chats kept, a de-identified sample handed over | Storage | Deleted is a policy, and a court can pause it |
| US v. Heppner, February 2026 | A defendant's chats, open to prosecutors | Storage | Consumer AI chats may not be privileged |
The pattern, and a habit for each part
Only one case on the list was a bug. The rest came down to what people sent, where copies were kept, and what they shared.
Storage: know your settings and your plan. Check whether your chats are used for training, how long history is kept and what deleting does. Note that in the NYT order, business plans and zero-retention API use were treated differently from consumer accounts. Our guide to data settings in ChatGPT, Claude and Gemini covers where each setting is, as of October 2026.
Sharing: treat a share link as publishing. Before you create one, read the chat as if a stranger will. Delete links you no longer need.
Sending: do not paste identifying data. This is the habit that covers the other three ways too. A chat with no client names, addresses or account numbers in it reveals far less if it is stored, shared, ordered into court or exposed by a bug. Replace identifying details with placeholders before you paste, and put them back in the answer on your own computer. The full routine is in how to use ChatGPT, Claude or Gemini with client documents.
Do the replacing on your own machine. An online anonymizer is one more service that receives the original. See local vs online redaction tools for how to tell the two apart.
ClientSafe does this on your PC. It finds names, companies, addresses, phone numbers, email addresses, account and ID numbers and dates of birth, and replaces them with placeholders such as Person_1 and Company_1. You review the list, untick what is not personal data and mark what it missed, then copy the safe copy into the chat.
Frequently asked questions
Has ChatGPT itself been hacked and chats stolen?
None of the cases above was a break-in. The closest is the March 2023 bug, which showed some users other users' chat titles and some payment details. The other cases involved data people sent, shared or kept.
If I delete a chat, is it gone?
As of October 2026, OpenAI's help center says a deleted chat is scheduled for permanent deletion within 30 days, unless OpenAI must keep it longer for security or legal reasons. The NYT order showed that the legal exception can apply to millions of users at once.
Does a business plan solve the problem?
It changes the terms: OpenAI says it does not train on business data by default, and on Enterprise plans admins control retention. It does not change what you send. Data you paste is still with the provider, and a court can still order it kept.
Can my chats with an AI be used in a lawsuit?
They can. In NYT v. OpenAI, stored chats were preserved and sampled as evidence. In Heppner, a defendant's AI chats were found not to be privileged. Whether the same applies to you depends on your country and your case.
ClientSafe replaces client names, addresses, account numbers and other identifying details with placeholders on your PC, and puts the real names back into the AI's answer. Detection is not perfect, so review the list before you copy.