Bad AI prompt exposes Bee Cheng Hiang customers’ e-mail addresses in first case of AI-related data breach

In a rare case of AI-related data breach, over 95,000 customers' email addresses of Bee Cheng Hiang were exposed in April after an employee used a bad prompt in an AI tool. This marked Singapore's first reported incident of data breach due to AI. The poorly formed prompt resulted in code that sent out marketing emails displaying all recipients' addresses.

Bee Cheng Hiang, known for its traditional food products, was the first to utilize an AI tool for business operations. The company's marketing emails were dispatched in batches of 1,000 customers. The customers' email addresses were the only personal data affected and were not managed or generated by any AI-powered operation. There was no evidence of misuse of the email addresses.

The Personal Data Protection Commission (PDPC) clarified that the cause was not a malfunction in the AI tool, but rather a human error in the prompt given to the generative AI tool. The PDPC reported that the incident was due to a lack of robust testing of the email distribution code, reliance on a single employee without a review process, and the absence of policies and governance frameworks for AI tool use.

The company rectified the error, stopped mass distribution, and notified all affected customers. Since then, Bee Cheng Hiang has introduced double-verification checks for all bulk email communications and incorporated a framework for responsible AI tool usage. The PDPC accepted a voluntary undertaking from Bee Cheng Hiang to enhance its compliance with the Personal Data Protection Act, which carries penalties up to $1 million or 10% of the organization's annual turnover.