Marketing uploaded customer spreadsheet to unsanctioned AI tool — CASB high-risk alert

Jen Kim (Marketing) signed up for ai-summarizer.io on the free tier with her corp email and uploaded customer-list-q1.xlsx (~14k rows of PII) and campaign-results-q1.xlsx (no direct PII). The vendor's ToS clause 4.2 lets them train on uploads on the free tier, the domain is 6 months old, no SOC 2, no DPA, and four other Marketing endpoints have visited the domain in the last 14 days. This is a privacy / shadow-IT incident with regulator-relevant scope, not a phishing case.

• Treat as a P1 privacy / data-leak incident because customer PII left the boundary — shadow-IT framing must not water down the priority.
• Sequence through Privacy / Legal / DPO before any user-facing or vendor-facing message.
• Loop in Marketing leadership so the response is unified, not user-shaming.

• Block ai-summarizer.io at CASB / proxy and add it to the unsanctioned-AI category at the egress tier.
• Open a vendor takedown / right-to-erasure request against the uploaded files, citing GDPR / CCPA as relevant; close the free-tier account.
• Tighten DLP so PII-classified spreadsheets (customer email + phone + LTV columns) cannot be uploaded to unsanctioned hosts on managed endpoints.

• Define scope precisely: which files (`customer-list-q1.xlsx` PII, `campaign-results-q1.xlsx` no direct PII), how many rows, which fields.
• Identify the other 4 endpoints that hit the domain in 14 days and check whether any of them also uploaded — repeat-offender check.
• Pull CASB session logs, browser history on JKIM-LT22, and DLP classifier output to confirm content type and timing.
• Read the vendor's ToS / privacy policy / retention statement carefully so the legal exposure assessment is grounded in their actual terms, not a guess.

• Stand up an approved-AI vendor allowlist (with SOC 2, DPA, no-train default) and route Marketing's real summarization need into a sanctioned tool.
• Run targeted Marketing awareness on shadow-IT / AI-tool risk, focused on `if it can read the file, the vendor can train on it`.
• Tune CASB risk scoring so 6-month-old privacy-protected domains with no DPA are blocked by category, not relying on per-incident review.

• Preserve CASB session log, the upload metadata, DLP classifier hits, and the browser history for JKIM-LT22 with hashes / timestamps.
• Save a screenshot / archive of the vendor's ToS clause 4.2 (training on free-tier uploads) at incident time, in case they edit it later.
• Capture vendor correspondence (deletion request, vendor reply) as part of the case file.

• Brief Privacy / Legal / DPO first; let them decide the customer-notification threshold under GDPR / CCPA.
• Explain the issue to Jen factually — `the vendor's ToS allows training on uploads` — without making the conversation punitive.
• Communicate the new approved-AI allowlist to Marketing so the legitimate need is met instead of pushing it underground.