InfoSecBulletin Cybersecurity for mankind
Nearly 100,000 Bee Cheng Hiang customers had their email addresses leaked when an employee used an AI tool to generate code for a large marketing email. The event is said to be Singapore’s first data leak involving AI that was reported to the Personal Data Protection Commission (PDPC).
The incident took place on April 25. Bee Cheng Hiang notified the PDPC two days later. The email was sent to groups of around 1,000 customers, so recipients could see the email addresses of others in their group.
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
Insufficient AI prompt
The employee used an AI tool to help make a program for sending marketing emails from a local mailing list. The AI instructions did not say that people’s email addresses should be kept secret from each other.
The code made it so many customers’ addresses showed up in one email. The PDPC said this happened not because the AI tool failed, but because of a mistake by a person when making the email code.
The only personal data involved were the email addresses, and the PDPC said there is no proof they were misused later. The employee tested the program before it was used, but only looked at activity logs instead of checking the actual test email content.
This meant the problem was not detected before the marketing emails were sent.
Company introduces additional checks
Bee Cheng Hiang, famous for their bak kwa, stopped sending bulk emails when they found the problem. They fixed the code and told the customers who were affected.
The company now needs at least two workers to check all large email messages before sending them, according to the PDPC.
The PDPC saw that this was Bee Cheng Hiang’s first try using AI tools in its business. After the event, the company promised to follow the Personal Data Protection Act better. The PDPC accepted this promise on Sept 2.
Bee Cheng Hiang will create rules for how employees can use AI for coding. This means they must have independent checks on AI-made code that includes personal data.
The company will also strengthen its software testing procedures, including testing emails using dummy accounts before deployment. The case shows that AI can help with coding and other tasks, but companies must check how AI outputs deal with personal data before using them.
