InfoSecBulletin Cybersecurity for mankind
Nearly 100,000 Bee Cheng Hiang customers had their email addresses leaked when an employee used an AI tool to generate code for a large marketing email. The event is said to be Singapore’s first data leak involving AI that was reported to the Personal Data Protection Commission (PDPC).
The incident took place on April 25. Bee Cheng Hiang notified the PDPC two days later. The email was sent to groups of around 1,000 customers, so recipients could see the email addresses of others in their group.
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Insufficient AI prompt
The employee used an AI tool to help make a program for sending marketing emails from a local mailing list. The AI instructions did not say that people’s email addresses should be kept secret from each other.
The code made it so many customers’ addresses showed up in one email. The PDPC said this happened not because the AI tool failed, but because of a mistake by a person when making the email code.
The only personal data involved were the email addresses, and the PDPC said there is no proof they were misused later. The employee tested the program before it was used, but only looked at activity logs instead of checking the actual test email content.
This meant the problem was not detected before the marketing emails were sent.
Company introduces additional checks
Bee Cheng Hiang, famous for their bak kwa, stopped sending bulk emails when they found the problem. They fixed the code and told the customers who were affected.
The company now needs at least two workers to check all large email messages before sending them, according to the PDPC.
The PDPC saw that this was Bee Cheng Hiang’s first try using AI tools in its business. After the event, the company promised to follow the Personal Data Protection Act better. The PDPC accepted this promise on Sept 2.
Bee Cheng Hiang will create rules for how employees can use AI for coding. This means they must have independent checks on AI-made code that includes personal data.
The company will also strengthen its software testing procedures, including testing emails using dummy accounts before deployment. The case shows that AI can help with coding and other tasks, but companies must check how AI outputs deal with personal data before using them.
