Bee Cheng Hiang’s marketing e-mails were sent in batches of 1,000 customers, according to details published on Sept 21 on the commission’s website.
A bad AI prompt caused Bee Cheng Hiang to accidentally expose over 95,000 customers' e-mail addresses in Singapore's first AI-related data breach.
The breach resulted from human error in coding without proper testing or supervisory review, not from an AI tool malfunction.
Bee Cheng Hiang has since improved its AI use policies, added double-verification for bulk e-mails and committed to stronger data protection measures.
SINGAPORE – More than 95,000 of Bee Cheng Hiang customers had their e-mail addresses accidentally exposed in April after an employee used a bad prompt in an AI tool , in Singapore’s first reported case of AI-related data breach.
The bad prompt generated code that sent out marketing e-mails with all the recipients’ addresses visible to everyone.
It was the first AI-related data breach reported to the Personal Data Protection Commission (PDPC) , the commission told The Straits Times on Sept 30.
It was also the first time the -grown traditional food products company known for its bak kwa was using an AI tool for its business operations.
Bee Cheng Hiang’s marketing e-mails were sent in batches of 1,000 customers, according to details published on Sept 21 on the commission’s website.
These customer e-mail addresses were the only personal data affected, and they were not managed, processed or generated by any AI-powered operation or process, said the PDPC.
There was also no evidence that the e-mail addresses were further misused.
The PDPC clarified that the incident was not due to a malfunction in the artificial intelligence tool used by the Bee Cheng Hiang employee.
Rather, the issue was with the prompt the employee gave the generative AI tool to write a program to send a “mass e-mail using a local list” in batches, but without specific instructions to hide the e-mail address of each recipient from other customers.
“The incident was caused by a human error in developing the e-mail distribution code with an AI tool,” the commission told ST.
If the prompt had been adjusted, the correct code produced should have sent e-mails addressed to each individual customer, instead of 1,000 customers in each batch.
Visually, the difference between the correct code and the bad one was the placement of a couple of brackets, which changed the code’s behaviour.
The problematic marketing e-mails were sent out on April 25, and the PDPC was notified of the data breach on April 27.
The commission said that the incident likely happened as Bee Cheng Hiang did not conduct sufficiently robust tests to check the e-mail distribution code before it was deployed.
It added that the company had relied on a single employee “without a review process for supervisory checks of the employee’s work, and did not have a governance framework or policies in place to guide employees on the use of generative AI tools for work”.
The employee did not realise the error before deploying the code, as testing was done by checking activity logs without reviewing the content of the actual test e-mail.
After the company discovered and confirmed the error, it stopped the mass distribution of the e-mails, rectified the bad code and notified all affected customers, the PDPC said.
Since the incident, the company has implemented “double-verification checks” by at least two employees for all bulk e-mail communications before sending them out.
The PDPC said that organisations should carry out appropriate data protection impact assessments before using AI tools to improve the efficiency of their business operations.
They should also develop policies and processes, as well as implement testing and review mechanisms, to ensure that their employees use AI tools responsibly and safeguard personal data, the PDPC added.
Considering the circumstances of the case, the commission accepted a voluntary undertaking by Bee Cheng Hiang on Sept 2 to improve its compliance with the Personal Data Protection Act.
Organisations that flout the Act can be fined up to $1 million or 10% of the organisation’s annual turnover in Singapore, whichever is higher.
Bee Cheng Hiang will implement a framework to govern how its employees use AI for coding, including an independent technical review of AI-generated code involving personal data.
The company’s other follow-up actions include:
Baking in security during each stage of software development and improving the process of reviewing the security of its software before deploying it, such as by testing e-mails sent to dummy accounts first;
Baking in security during each stage of software development and improving the process of reviewing the security of its software before deploying it, such as by testing e-mails sent to dummy accounts first;
Formalising the actions it took for this incident into a data breach procedure for the organisation; and
Formalising the actions it took for this incident into a data breach procedure for the organisation; and
Implementing automated technical measures that can block the mass distribution of e-mails containing multiple e-mail addresses in a single e-mail field, as well as designing and delivering data protection training programmes for staff who develop, review and deploy systems that handle personal data.
Implementing automated technical measures that can block the mass distribution of e-mails containing multiple e-mail addresses in a single e-mail field, as well as designing and delivering data protection training programmes for staff who develop, review and deploy systems that handle personal data.
The Straits Times has contacted Bee Cheng Hiang for .
AI/artificial intelligence
Personal Data Protection Act
Artificial Intelligence
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
