Open cardosec

Case 85B875 · AI security · L1 Foundations

Customer Export Pasted into a Chatbot

Practise as: Incident drill · InterviewLevel: L1 Foundations

Live alertA support engineer pasted a CSV of 2,000 customer records (names, emails, phone numbers and order history) into a free public AI chatbot to "clean up the formatting". A colleague reported it an hour later.

Interview questionSomeone pasted customer personal data into a public AI chatbot. What do you do?

  1. 01 What happened?
  2. 02 What is the impact?
  3. 03 What do you do?
Practise this card As Interview
What a strong answer covers

Try it out loud first. Then check yourself:

  1. Treat it as a data incident: record what data, how many people, which service and account, and when.
  2. Check the account and the tool's terms: was chat history or training on inputs on? Delete the chat and request deletion.
  3. Involve privacy and legal early: they decide whether this is a reportable personal data breach and on what clock.
  4. Fix the cause, not the person: an approved AI tool for this kind of work, clear guidance on what may be pasted, and DLP.

If the interviewer pushes back

  • The engineer used their personal account on a personal phone. What changes in how you respond?

Go deeper

More AI security cards

All AI security cards →

cardosec draws a security topic and gives you a clock: explain it out loud with no notes, then see what you covered and what you missed. Free during early access.

Reviewed 2026-10-09