Severity moderate: Other parties' data or systems were touched, and a source states how far it reached. More than 95,000 customers’ e-mail addresses were exposed to other recipients, a bounded scope of personal data of others.
Happened 2026-04-25 · Earliest source we hold 2026-09-30, 158 days later
Bee Cheng Hiang, a Singapore food company, used an AI tool for the first time to write code for sending marketing e-mails in batches from a local customer list. The prompt omitted instructions to hide recipients’ addresses, so the code sent e-mails on Apr 25 with all addresses visible to every recipient, exposing more than 95,000 customers’ e-mail addresses. The company discovered and confirmed the error, stopped the mass distribution, rectified the code and notified affected customers; PDPC was notified on Apr 27. PDPC accepted a voluntary undertaking on Sep 2, and the company added double-verification checks and an AI governance framework.
Risk grouping: Misuse by its own users
Who caused it
A person or organisation “The employee asked the AI tool to write a program to send a "mass email using a local list" in batches, but did not instruct it to hide recipients' email addresses from one another.”source
Intended or not
Not intended ““The incident was caused by a human error in developing the e-mail distribution code with an AI tool,” PDPC told ST.”source
Before or after release
After release “The problematic marketing e-mails were sent out on Apr 25, and PDPC was notified of the data breach on Apr 27.”source
The AI's part
Caused it “The resulting code sent emails to batches of about 1,000 customers, with recipients' addresses visible to others in the same batch.”source
The story
1 · What it was doingBee Cheng Hiang, a Singapore food company, used an AI tool to write code for sending marketing e-mails in batches of 1,000 customers from a local list.
2 · What went wrongThe generated code sent marketing e-mails with all recipients’ addresses visible to everyone, exposing customer e-mail addresses instead of hiding them.
3 · What it reached or didMore than 95,000 customers’ e-mail addresses were exposed to other recipients; these addresses were the only personal data affected and there was no evidence of further misuse.
4 · How it was caughtThe company discovered and confirmed the error itself, after the employee did not realise it before deploying the code; PDPC was notified on Apr 27.
5 · What was doneThe company stopped the mass distribution, rectified the code, notified all affected customers, and implemented double-verification checks by at least two staff for bulk e-mails, plus an AI governance framework and other measures.
Safeguards a source says failed
Human approval absent: “It added that the company had relied on a single employee “without a review process for supervisory checks of the employee’s work, and did not have a governance framework or policies in place to guide employees on the use of generative AI tools for work”.”
A model read these from the sources; each quote was checked word for word against its source.
Show every field, with its source and grade
The AI system
Stage of use
in live use
D inferred by us from the described behaviour, reason shown
How it was connected
embedded
D inferred by us from the described behaviour, reason shown
What it was for
to write a program to send a “mass e-mail using a local list” in batches
C one secondary source states it
State of its safeguards
The commission said the AI tool had not malfunctioned.
C one secondary source states it
Meant for live use
yes
D inferred by us from the described behaviour, reason shown
What happened
When it happened
2026-04-25
C one secondary source states it
Earliest source we hold
2026-09-30
A the date the source itself carries
Who caught it
a human reviewer
D inferred by us from the described behaviour, reason shown
Themes
AI generated code, email address exposure, mass email, data protection act
D inferred by us from the described behaviour, reason shown
What was done
Since the incident, the company has implemented “double-verification checks” by at least two staff members for all bulk e-mail communications before sending them.
D inferred by us from the described behaviour, reason shown
What went wrong
leaked private data
D inferred by us from the described behaviour, reason shown
AI agent
no AI agent acted
D inferred by us from the described behaviour, reason shown
What it did
No autonomous agent was involved; the harm came from code the employee generated with an AI tool and deployed without adequate review.
D inferred by us from the described behaviour, reason shown
Impact
Severity
moderate
D inferred by us from the described behaviour, reason shown
Kind of harm
privacy
D inferred by us from the described behaviour, reason shown
Who was affected
More than 95,000 of Bee Cheng Hiang’s customers whose e-mail addresses were exposed
C one secondary source states it
Kinds of data exposed
personal information
D inferred by us from the described behaviour, reason shown
Why this severity
Other parties' data or systems were touched, and a source states how far it reached. More than 95,000 customers’ e-mail addresses were exposed to other recipients, a bounded scope of personal data of others.
D inferred by us from the described behaviour, reason shown
Context
Industry
Food Manufacturing
D inferred by us from the described behaviour, reason shown
Country
Singapore
C one secondary source states it
Rules that apply
PDPA
C one secondary source states it
Notices made
PDPC was notified of the data breach on Apr 27.
C one secondary source states it
Against the provider's safety policy
PDPC accepted a voluntary undertaking by Bee Cheng Hiang on Sep 2 to improve its compliance with the Personal Data Protection Act.
C one secondary source states it
LR-2026-0106 · version 4 · published 2026-10-25 after automatic checks; not yet checked field by field by a person · changes to this case · JSON