Data Breach Exposes Emails of Nearly 100,000 Customers at Bee Cheng Hiang
Bee Cheng Hiang faced Singapore's first AI-related data breach, exposing customer emails after a code mishap during a marketing email campaign.
In a significant event, Bee Cheng Hiang, a well-known brand for its delicious bak kwa, recently experienced a data breach that impacted nearly 100,000 customers. This incident marks a notable moment in Singapore, as it is recognized as the country's first data breach linked to artificial intelligence (AI).
Details of the Incident
The breach unfolded on April 25 when an employee utilized a generative AI tool to create code intended for a mass marketing email. Regrettably, the guidance provided to the AI lacked a crucial directive: to keep recipients' email addresses concealed from each other.
As a result, when the marketing emails were sent in batches of approximately 1,000 customers, recipients found themselves able to see other email addresses present in the same batch—a clear violation of privacy.
Response to the Breach
Bee Cheng Hiang promptly notified the Personal Data Protection Commission (PDPC) of the incident two days later, and the PDPC accepted a voluntary undertaking from the company in September. This commitment aims to enhance compliance with the Personal Data Protection Act 2012.
According to the PDPC, the incident stemmed not from a technical failure of the AI tool, but rather from human error related to the coding process. Although the email addresses were the only affected personal data, the PDPC confirmed there was no indication that these addresses were misused after the breach.
Measures for Future Prevention
In light of this incident, Bee Cheng Hiang has instituted new protocols to ensure such oversights do not recur. The company has mandated that at least two employees must review all bulk email communications before dispatching them.
In addition, Bee Cheng Hiang is implementing a framework governing the responsible use of AI by its employees. Measures include independent technical assessments of any AI-generated code that deals with personal data and enhanced software testing procedures. The company plans to utilize dummy accounts for testing emails before their actual deployment to avoid similar mishaps in the future.
Importance of Data Protection Assessments
The PDPC has emphasized the necessity for businesses to perform thorough data protection impact assessments prior to implementing AI tools. Establishing clear policies and procedures, as well as robust testing mechanisms, can help promote responsible AI usage while safeguarding personal data.
This incident serves as a critical reminder that even while AI plays a valuable role in streamlining business operations, companies hold ultimate responsibility for ensuring that AI-generated outputs are properly vetted, particularly regarding personal data security.