InfoSecBulletin Cybersecurity for mankind
Nearly 100,000 Bee Cheng Hiang customers had their email addresses leaked when an employee used an AI tool to generate code for a large marketing email. The event is said to be Singapore’s first data leak involving AI that was reported to the Personal Data Protection Commission (PDPC).
The incident took place on April 25. Bee Cheng Hiang notified the PDPC two days later. The email was sent to groups of around 1,000 customers, so recipients could see the email addresses of others in their group.
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
Insufficient AI prompt
The employee used an AI tool to help make a program for sending marketing emails from a local mailing list. The AI instructions did not say that people’s email addresses should be kept secret from each other.
The code made it so many customers’ addresses showed up in one email. The PDPC said this happened not because the AI tool failed, but because of a mistake by a person when making the email code.
The only personal data involved were the email addresses, and the PDPC said there is no proof they were misused later. The employee tested the program before it was used, but only looked at activity logs instead of checking the actual test email content.
This meant the problem was not detected before the marketing emails were sent.
Company introduces additional checks
Bee Cheng Hiang, famous for their bak kwa, stopped sending bulk emails when they found the problem. They fixed the code and told the customers who were affected.
The company now needs at least two workers to check all large email messages before sending them, according to the PDPC.
The PDPC saw that this was Bee Cheng Hiang’s first try using AI tools in its business. After the event, the company promised to follow the Personal Data Protection Act better. The PDPC accepted this promise on Sept 2.
Bee Cheng Hiang will create rules for how employees can use AI for coding. This means they must have independent checks on AI-made code that includes personal data.
The company will also strengthen its software testing procedures, including testing emails using dummy accounts before deployment. The case shows that AI can help with coding and other tasks, but companies must check how AI outputs deal with personal data before using them.
