Bee Cheng Hiang email list leaked after AI prompt mistake, Singapore’s first AI breach
Over 95,000 Bee Cheng Hiang customers had their email addresses exposed when an employee’s faulty AI prompt generated code that sent bulk marketing messages with visible recipient lists.
In April, Bee Cheng Hiang employed a generative AI system to draft code for a marketing campaign, but the employee’s prompt failed to conceal recipient addresses. The flawed code dispatched emails in groups of 1,000, exposing more than 95,000 customers’ email addresses. The Personal Data Protection Commission, Singapore’s data regulator, investigated and found no evidence of subsequent misuse.
It attributed the incident to a human error in prompt design rather than a defect in the AI tool itself. Following the discovery, the company halted the faulty distribution, corrected the code, and notified affected customers. Bee Cheng Hiang has since introduced double-verification checks and a governance framework for AI use, while the regulator urged organizations to conduct data-protection impact assessments before deploying AI.
