\n<\/p>\n
SINGAPORE: The email addresses of nearly 100,000 Bee Cheng Hiang customers were disclosed without consent in what the Personal Data Protection Commission said on Wednesday (Sep 30) was the first AI-related data breach in Singapore that it has been notified of.<\/p>\n
The breach occurred in April after a Bee Cheng Hiang employee used an AI tool to generate a Python script to distribute a marketing email. The resulting code caused the recipients’ email addresses to be visible to everyone, affecting a total of 95,364 customers<\/span>.<\/p>\n “The incident was caused by a human error in developing the email distribution code with an AI tool,” the PDPC said in response to queries from CNA.<\/p>\n According to a statement posted on its website on Sep 21, PDPC said the incident was “not a malfunction in the AI tool”, but a result of the prompt given to it by the employee.<\/p>\n PDPC said the employee had prompted the AI tool to write a programme to send a “mass email using a local list” in batches, without specifically telling it to hide the email addresses of the other recipients.<\/p>\n “The employee did not realise the error before deploying the script, as testing was done by checking activity logs without reviewing the contents of the actual test email,” said PDPC.\u00a0<\/p>\n It added that the affected data “was not managed, processed, or generated by any AI-powered operation or process”, and that there was “no evidence of further misuse” of the data.<\/p>\n The PDPC noted that Bee Cheng Hiang took prompt remedial actions, including immediately stopping the bulk marketing email distribution process, correcting the erroneous script and informing affected customers.<\/p>\n The company also introduced a requirement for at least two staff members to verify all bulk email communications.<\/p>\n The PDPC noted that this is Bee Cheng Hiang’s first attempt at incorporating AI tools into its business operations.<\/p>\n “Prior to adopting AI tools to enhance the efficiency of their business operations, organisations should carry out appropriate data protection impact assessments; develop policies and processes; and implement testing and review mechanisms, to ensure that their employees use AI tools responsibly and safeguard personal data.”<\/p>\n