Singapore's first AI-related data breach exposes 95,364 Bee Cheng Hiang customer emails
Singapore's data-protection watchdog says a bad AI prompt exposed nearly 100,000 Bee Cheng Hiang customer email addresses — the first AI-related data breach it has been notified of.
Singapore’s Personal Data Protection Commission (PDPC) said on Wednesday that the email addresses of nearly 100,000 Bee Cheng Hiang customers were disclosed without consent — the first AI-related data breach it has been notified of.
The breach occurred in April after an employee used an AI tool to generate a Python script to distribute a marketing email, sent in batches of 1,000 customers. The resulting code made the recipients’ email addresses visible to everyone, affecting 95,364 customers in total.
“The incident was caused by a human error in developing the email distribution code with an AI tool,” the PDPC said. In a statement posted on its website on 21 September, it stressed the incident was “not a malfunction in the AI tool” — the employee had asked the AI to send a “mass email using a local list” without telling it to hide the other recipients’ addresses.
The error went unnoticed because testing checked only activity logs, not the test email’s contents. The PDPC said the data “was not managed, processed, or generated by any AI-powered operation or process” and that there was “no evidence of further misuse”.
Bee Cheng Hiang immediately stopped the bulk email process, corrected the script and informed customers. It now requires at least two staff members to verify all bulk email communications. The PDPC accepted a voluntary undertaking from the company to improve its Personal Data Protection Act compliance.
Sources
More on this topic: all Technology stories
