Skip to main content
Incident intelligence/SS-IR-032CASE FILE OPEN
Symbolic editorial illustration for SS-IR-032SERVANTSTACK // INCIDENT INTELLIGENCEFORENSIC IMAGE // VERIFIED FRAME
SS-IR-032 // INCIDENT REPORTOfficial finding

OpenAI

ChatGPT Bug Leaked Payment Data and Triggered Italy National Ban

EXECUTIVE BRIEF

On March 20, 2023, a bug in the open-source redis-py client let some ChatGPT users see other active users' data.

CHATBOTS & LLMsDATA & CYBER SECURITY
FAILURE CHAINTRACE COMPLETE
  1. 01TRIGGEROn March 20, 2023, a bug in the open-source redis-py client let some ChatGPT users see other active users' data.
  2. 02MACHINE ACTIONAdvisory output
  3. 03MISSING GATETrust boundaries, least privilege, and output approval
  4. 04IMPACTData security
01 // INCIDENT SUMMARY

The short version

On March 20, 2023, a bug in the open-source redis-py client let some ChatGPT users see other active users' data.

02 // KEY FACTS

Case telemetry

INCIDENT
SS-IR-032
DATE
March 31, 2023
SYSTEM
OpenAI
LOCATION / SCOPE
Italy (OpenAI, San Francisco)
EVIDENCE
Official finding
AI ROLE
Advisory output
HARM
Data security
SOURCES
3 cited records
03ENTRY POINT // WHAT HAPPENED

The event

On March 20, 2023, a bug in the open-source redis-py client let some ChatGPT users see other active users' data. During a roughly nine-hour window, the flaw exposed conversation titles from other users' chat histories and, for about 1.2 percent of ChatGPT Plus subscribers active at the time, partial payment information: first and last name, email address, payment address, credit card type, the last four digits of the card number, and the expiration date. Full card numbers were never exposed. Eleven days later, on March 31, 2023, Italy's data protection authority (the Garante) ordered a temporary block on ChatGPT for Italian users, making Italy the first Western country to ban the service. The regulator cited the data breach, the absence of a lawful basis for the mass collection of personal data used to train the model, and the lack of any age verification to keep users under 13 out. OpenAI geoblocked Italy and faced potential penalties of up to 20 million euros or 4 percent of global annual turnover. Access was restored in late April 2023 after OpenAI added disclosures, an age gate, and opt-out controls.

04CAUSAL TRACE // AI'S ACTUAL ROLE

What the machine did

The model itself did not malfunction; the failure was in the operational stack and the change-management process around it. OpenAI pushed a server change that spiked Redis request cancellations, and the caching layer began returning another user's cached data on certain connections. No human review gate caught the data-isolation risk of that change before it reached production, and no privacy or legal-basis review had cleared the underlying training-data collection or the missing age controls before the product was shipped at global scale. The system processed personal data of millions with zero pre-deployment human sign-off on either the code change or the legal posture, so a cache bug became a cross-user data leak and a regulatory ban.

Advisory outputAutomation was a causal participant—not a decorative label for the system around it.
05BLAST RADIUS // CONSEQUENCES

Where the failure landed

ChatGPT was taken offline globally on March 20 to patch the bug. On March 31 it was banned outright for all Italian users, removing access for an estimated tens of millions of people in Italy for roughly four weeks. OpenAI disclosed the breach to affected users and to regulators, faced exposure to fines of up to 20 million euros or 4 percent of worldwide turnover, and had to retrofit age verification, privacy disclosures, and data opt-out mechanisms. The Garante action set the template for EU-wide scrutiny; in December 2024 OpenAI was fined 15 million euros by the same regulator over the same underlying privacy failures.

06 // EVIDENCE STATUS

Official finding

Supported by a court, regulator, inquiry, or other official record cited below.

SOURCE RECORD UPDATED 2026-07-09

07 // SOURCE LEDGER

3 cited records

  1. 01
  2. 02
  3. 03
08CONTROL FAILURE // MISSING GOVERNANCE

Trust boundaries, least privilege, and output approval

The failure pattern in this case: Untrusted input crossed a privileged boundary.

09INTERVENTION POINT // HUMAN IN THE MIDDLE

The moment the path could change

A security owner approves credential scope and externally visible actions before the agent can cross a trust boundary.

AI PROPOSES→HUMAN OWNS THE DECISION→SYSTEM EXECUTES
10CONTROL DEPLOYMENT // AUTHORITYGATE

Trust boundary policy · output approval

AuthorityGate's Operational Resilience framework requires a human SME change-validation gate before any modification to shared-state infrastructure (caching, session, or identity layers) can reach production. A change that alters Redis client behavior or request-cancellation handling is flagged as touching a cross-tenant data-isolation boundary, which forces a named reliability SME to review and approve the data-isolation impact and confirm a regression test proving one user's cached payload can never be served to another user. The same framework requires a privacy and legal-basis sign-off gate before a product processing personal data at scale ships: a human reviewer must validate the lawful basis for training-data collection and confirm age-verification controls exist. Either gate would have stopped this -- the change gate catches the cache leak before deployment, and the privacy gate blocks launch until the legal-basis and age-verification gaps the Garante cited are closed.

RELEVANT GOVERNANCE FRAMEWORKAgentic AI GovernanceThe governance model for autonomous systems, Zero Trust verification, SME approval, and accountable execution.
12 // THE ALTERNATIVE

Autonomy is a design choice.

See the operating model that keeps AI useful while preserving human authority at consequential moments.

Compare AgenticAI and AugmentedAI →