Data breach and security warnings over DeepSeek AI prompt international bans
DeepSeek, a Chinese AI company, released R1 in January 2025 and rapidly gained users, but faced reports of data breach attempts, cyberattacks, and security concerns about data storage in China, prompting bans by multiple governments and institutions worldwide.
What happened
In autumn 2024, Microsoft security personnel identified unauthorized external access to OpenAI's API, with potential mass data theft from the service that might have been related to DeepSeek's later development.
On 27 January 2025, DeepSeek reported its service suffered a major malicious attack and was forced to temporarily restrict new user registrations, coinciding with the time its AI assistant app surpassed ChatGPT on Apple's App Store.
As of March 2025, OpenAI remained investigating whether DeepSeek had plagiarized company data, citing the model's use of distillation techniques that involve accessing other companies' larger models.
Reported impact
Multiple governments and institutions worldwide banned DeepSeek due to privacy and security concerns, including Australia, India, Italy, the United States, South Korea, and Taiwan, citing risks of data leakage and ideological bias in training content.
Taiwan's Ministry of Digital Affairs determined DeepSeek posed very high cybersecurity risks, with all user data stored in China, potentially vulnerable to theft or misuse.
Index analysis
The incident reflects tensions between AI development accessibility and data governance, with DeepSeek's open-source model and low-cost approach contrasting with concerns about centralized data storage in China.
The timing of the cyberattack coinciding with DeepSeek's explosive growth suggests the service became a high-value target after achieving mainstream adoption.
Governance controls
Taiwan's Digital Ministry and multiple national governments implemented bans or restrictions on institutional use of DeepSeek based on security assessments.
OpenAI initiated an investigation into potential unauthorized use of its models and data, though no findings had been announced as of March 2025.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.