Case johns-hopkins-unauthorized-ai-exposureModel & data leakUnited States
Johns Hopkins Bayview employee uploads patient spreadsheet to unauthorized AI tool, exposing data of 3,100+ patients
Johns Hopkins Bayview Medical Center is notifying patients that an employee uploaded a spreadsheet containing patient information to an unauthorized AI tool. CBS Baltimore reports more than 3,100 people may be affected. The exposed data reportedly includes providers, admission dates, treatment, medications, account numbers and medical record numbers. The hospital describes it as an unauthorized disclosure, not a cyberattack.
MediumAttack on AIStatus: patients being notifiedVerified case file
Open in the interactive mapCite this case
- Reported
- Oct 26, 2026
- Location
- United States
- Target
- Johns Hopkins Bayview Medical Center patient data (3,100+ patients)
- Severity
- Medium
- Verification
- Reported by credible press or researchers
- Triggered by
- Hospital workforce member (insider, apparently accidental)
- Actor type
- Accidental / misconfiguration
- Sector
- Unknown
- Reported loss
- None reported
- CVE
- None
What happened
Johns Hopkins Bayview Medical Center is notifying patients that an employee uploaded a spreadsheet containing patient information to an unauthorized AI tool. CBS Baltimore reports more than 3,100 people may be affected. The exposed data reportedly includes providers, admission dates, treatment, medications, account numbers and medical record numbers. The hospital describes it as an unauthorized disclosure, not a cyberattack.
Impact: Johns Hopkins data was exposed. Number of people affected and data types are Unknown.
Who triggered it
Actor: Hospital workforce member (insider, apparently accidental)
Attribution: Not an external attack; the Baltimore Banner attributes the exposure to an employee's use of an unauthorized AI tool.
Motive: Unknown
How it happened
Attack vector: Employee use of an unauthorized AI tool
Root cause: Use of an unapproved AI tool by an employee led to data exposure. Details are not given in the headline.
Timeline
- Reported by The Baltimore Banner
Response
The hospital opened an investigation and had the employee delete the initial AI upload; patients are being notified.
Current status: patients being notified
Research warnings this case matches
- Seen in real incidents Accidents with AI are hard to avoid · CAIS
- Seen in real incidents Privacy and security · MIT AI Risk Repository
Compared with published AI risk research from several institutes on the Research vs reality page.
Sources (open in a new tab)
- The Baltimore Banner news.google.com
- CBS News Baltimore cbsnews.com
- WYPR wypr.org
Cite this case
Johns Hopkins Bayview employee uploads patient spreadsheet to unauthorized AI tool, exposing data of 3,100+ patients. AI Threat Watch, case johns-hopkins-unauthorized-ai-exposure, Oct 26, 2026. https://aithreat.io/cases/johns-hopkins-unauthorized-ai-exposure/
Permanent link: https://aithreat.io/cases/johns-hopkins-unauthorized-ai-exposure/
Related cases
The same type of incident, most recent first.