Bee Cheng Hiang customers' e-mail addresses exposed in Singapore's first case of AI ...

There is no evidence of further misuse, says the Personal Data Protection Commission

This was the first time that Bee Cheng Hiang, a -grown traditional food products company known for its bak kwa, used an AI tool for its business operations. PHOTO: ST

[SINGAPORE] More than 95,000 of Bee Cheng Hiang’s customers had their e-mail addresses exposed in April after an employee used a bad prompt in an artificial intelligence tool, in Singapore’s first reported case of an AI-related data breach.

The bad prompt generated code that sent out marketing e-mails with all the recipients’ addresses visible to everyone.

It was the first AI-related data breach reported to the Personal Data Protection Commission (PDPC), the commission told The Straits Times on Wednesday (Sep 30).

It was also the first time the -grown traditional food products company known for its bak kwa was using an AI tool for its business operations.

Bee Cheng Hiang’s marketing e-mails were sent in batches of 1,000 customers, according to details published on Sep 21 on PDPC’s website.

These customer e-mail addresses were the only personal data affected, and they were not managed, processed or generated by any AI-powered operation or process, the commission said.

Get insights into businesses across South-east Asia

There was also no evidence that the e-mail addresses were further misused.

PDPC clarified that the incident was not due to a malfunction in the AI tool used by the Bee Cheng Hiang employee.

Rather, the issue was with the prompt the employee gave the tool to write a program to send a “mass e-mail using a local list” in batches, but without specific instructions to hide the e-mail address of each recipient from other customers.

OpenAI scraps debut of AI model as it sets new guardrails

OpenAI apologises for Australian government website hack, pledges to rebuild trust

Singapore proposes a UN framework convention on AI safety

“The incident was caused by a human error in developing the e-mail distribution code with an AI tool,” PDPC told ST.

If the prompt had been adjusted, the correct code produced should have sent e-mails addressed to each individual customer, instead of 1,000 customers in each batch.

Visually, the difference between the correct code and the bad one was the placement of a couple of brackets, which changed the code’s behaviour.

The problematic marketing e-mails were sent out on Apr 25, and PDPC was notified of the data breach on Apr 27.

The commission said that the incident likely happened as Bee Cheng Hiang did not conduct sufficiently robust tests to check the e-mail distribution code before it was deployed.

It added that the company had relied on a single employee “without a review process for supervisory checks of the employee’s work, and did not have a governance framework or policies in place to guide employees on the use of generative AI tools for work”.

The employee did not realise the error before deploying the code, as testing was done by checking activity logs without reviewing the content of the actual test e-mail.

After the company discovered and confirmed the error, it stopped the mass distribution of the e-mails, rectified the bad code and notified all affected customers, PDPC said.

Since the incident, the company has implemented “double-verification checks” by at least two staff members for all bulk e-mail communications before sending them.

PDPC said that organisations should carry out appropriate data protection impact assessments before using AI tools to improve the efficiency of their business operations.

It added that organisations should also develop policies and processes, as well as implement testing and review mechanisms, to ensure that their employees use AI tools responsibly and safeguard personal data.

Considering the circumstances of the case, the commission accepted a voluntary undertaking by Bee Cheng Hiang on Sep 2 to improve its compliance with the Personal Data Protection Act .

Organisations that flout the Act can be fined up to S$1 million or 10 per cent of the organisation’s annual turnover in Singapore, whichever is higher.

Bee Cheng Hiang will implement a framework to govern how its employees use AI for coding, including an independent technical review of AI-generated code involving personal data.

The company’s other follow-up actions include:

Baking in security during each stage of software development and improving the process of reviewing the security of its software before deploying it, such as by testing e-mails sent to dummy accounts first;

Formalising the actions it took for this incident into a data breach procedure for the organisation;

Implementing automated technical measures that can block the mass distribution of e-mails containing multiple e-mail addresses in a single e-mail field, and

Design and deliver data protection training programmes for staff who develop, review and deploy systems handling personal data.

ST has contacted Bee Cheng Hiang for . THE STRAITS TIMES

with us your feedback on BT's products and services

Grab CEO’s wife Chloe Tong on life with Anthony Tan and finding her purpose

Hwa Seng Builder, two China companies win S$1.2 billion Tuas Road Viaduct phase two contracts

Deal between tycoon friends sparks scrutiny of Philippine power sector

Canada is upping oil flows to Asia, but South-east Asia’s refineries aren’t ready to handle them yet