Universa Versicherungen: AI incident

In July 2026, a web crawler operated by OpenAI accessed customer data from the insurance company uniVersa. Following a system migration on July 7, 2026, an unprotected directory on a single web server was briefly accessible without any access restrictions. During this period, the crawler scanned the exposed data.

Names, addresses, contract numbers, and plan details were visible. For some customers, bank account information—including IBAN and BIC—was also exposed. According to uniVersa, health data, passwords, and credit card numbers were not affected. The central administrative systems and the customer portal were isolated from the misconfiguration.

Internal security audits detected the unauthorized access. uniVersa immediately shut down the system, commissioned external forensic experts, and notified the affected customers in writing. The company formally requested that OpenAI delete the dataset and refrain from using it to train AI models. It is not yet known how OpenAI handled the data.

The Bavarian State Office for Data Protection Supervision received the required notification. President Michael Will did not specify the number of affected individuals due to the ongoing investigation. He advised them to check their bank statements, change their passwords, and be cautious of unexpected emails or phone calls.