Nearly 100,000 Bee Cheng Hiang customers' email addresses exposed in first AI-related data breach in Singapore

Singapore's Personal Data Protection Commission (PDPC) announced on September 30 that nearly 100,000 Bee Cheng Hiang customers' email addresses were exposed in what the agency considered the country's first AI-related data breach. The incident occurred in April when a Bee Cheng Hiang employee used an AI tool to generate a Python script for distributing a marketing email.

The flaw in the code exposed the recipients' email addresses, affecting 95,364 customers. The PDPC emphasized that the error was due to a human mistake in developing the email distribution code with the AI tool, not a malfunction in the tool itself. The employee had prompted the AI to write a program to send mass emails from a local list without specifying to hide recipient email addresses.

The PDPC stated that the affected data wasn't managed, processed, or generated by any AI-powered operation, and there was no evidence of further misuse. Bee Cheng Hiang took immediate remedial actions, including halting the bulk marketing email distribution, correcting the script, and informing affected customers. The PDPC also noted that this was Bee Cheng Hiang's first attempt at incorporating AI tools into its business operations, and recommended companies use AI responsibly and safeguard personal data by conducting data protection impact assessments and developing policies.