OpenAI Fined by PIPC for Accidental Exposure of 687 Users' Personal Data Due to ChatGPT Bug

OpenAI, the entity behind the advanced AI chatbot, ChatGPT, has been fined by South Korea's Personal Information Protection Commission (PIPC) for inadvertently exposing the personal data of 687 users due to a bug. Meta Platforms also face substantial fines for similar breaches.

The PIPC imposed a $2,829 or KRW3.6 million fine on OpenAI, announced on Thursday, July 27. Yonhap News Agency reported that a bug in ChatGPT's open-source library caused an accidental exposure of ChatGPT Plus subscribers' payment details.

The bug was detected in March, and it was discovered that the data were illegally put on display during a nine-hour window. The users' first and last names, email addresses, credit card expiration dates, and last four digits of their credit card numbers were laid bare online.

The commission confirmed 687 Korean users were affected by the issue. The PIPC explained that the fine for OpenAI violated its duty to report the leakage to authorities. The law states that companies must make a report for such incidents within 24 hours of discovery.

The PIPC also suggested to OpenAI that it take some measures to avoid a similar incident in the future. This will also allow the ChatGPT operator to adhere to the personal information protection regulation in South Korea. Moreover, in doing so, the company will also show its active cooperation with the commission's inspections.

Meanwhile, according to The Korea Times, the PIPC also fined another tech company - Meta Platforms - for the same personal data breach. The organization further discovered that the social media giant secretly gathered the personal information of Facebook users through its "Facebook Login" prompt. For this offense, the commission penalized Mark Zuckerberg's company with an additional KRW7.4 billion fine on top of its previous KRW30.8 billion fine that was handed down in September 2022.

Photo by: Jonathan Kemper/Unsplash