Bee Cheng Hiang data breach: what customers should do next

If you are a Bee Cheng Hiang member who received its marketing email of 25 April 2026, your email address may have been visible to up to 999 other recipients. On 21 September 2026 the Personal Data Protection Commission (PDPC) published a voluntary undertaking by Bee Cheng Hiang Marketing over that email, which went out in batches of 1,000 with every address in a batch displayed in the "To" field. PDPC's decision says 95,364 members were affected, only email addresses were involved, and there was no evidence of further misuse. The same day, PDPC published a second retail case involving more sensitive data: an online shop whose storefront was altered to send customers to a fake checkout page, where card numbers, expiry dates and CVV codes could be captured.

Neither published decision imposes a financial penalty: in both, PDPC accepted a voluntary undertaking in which the business committed to specific fixes. This guide explains what happened in each, what PDPC's rules require a shop to tell you, and what to do if a shop you bought from leaks your data.

What happened at Bee Cheng Hiang?

According to PDPC's decision, an employee used a generative AI tool to write a Python script to send "mass email using a local list" in batches. The prompt gave no specific instruction to hide other recipients' addresses, and a missing bracket in the generated script grouped every address in a batch into a single "To" field. Each affected member's address was therefore visible to up to 999 other recipients. The employee tested the script by checking activity logs without reviewing the contents of the actual test email, and did not realise the error before the script was used.

PDPC said the incident had likely occurred because the company did not test the script robustly enough before using it, relied solely on one employee with no supervisory review, and had no governance framework or policies to guide staff on using generative AI tools for work. The decision notes it was the company's first attempt to use AI tools in its operations. Bee Cheng Hiang halted the mailings, fixed the script, notified all affected members and introduced checks by at least two staff on every bulk email before it is sent. Under the undertaking it has implemented or will implement a governance framework for AI-assisted coding, with independent technical review of AI-generated code involving personal data; test emails to dummy accounts before real mailings; automated controls that block bulk emails carrying multiple recipient addresses in one email object; a documented breach response procedure; and training for its technical staff. PDPC says it will verify compliance and may issue a direction if the company fails to comply.

Why the online checkout case matters more to shoppers

The Delugs case is smaller, but it shows how a lapse inside a shop can expose what customers type at checkout. PDPC's decision says an attacker gained access on 4 December 2025 using compromised credentials for an overseas-based employee's administrator account, which was shared with four other customer service staff, then injected malicious code into the shop's storefront that redirected customers placing orders to a spoofed checkout page. Personal data entered there could be captured and sent to the attacker. The data involved included names, delivery addresses, email addresses, phone numbers, card numbers, expiry dates and CVV codes, and 178 customers were potentially affected.

PDPC said the incident likely occurred because nothing prevented the administrator login being shared, which made the credentials more likely to be compromised despite multi-factor authentication, and because the account had theme-editing permissions the customer service staff did not need. The business removed the malicious script, deleted and re-created all employee accounts on its e-commerce systems and notified all the potentially affected customers. Under its undertaking it has implemented or will implement measures including an end to shared administrator accounts, access limited by role, written security policies with yearly audits, and annual cybersecurity training for all employees.

What must a shop tell me after a data breach?

PDPC's guidance for organisations reporting a breach sets two tests. PDPC must be told when a breach is likely to cause significant harm to individuals or affects 500 or more people, no later than three calendar days after the organisation decides the breach is notifiable. The affected individuals must be told when the breach is likely to cause them significant harm, such as substantial financial loss, with exceptions, for example where encryption was in place before the breach; PDPC's own example of significant harm is credit card details. PDPC's guidance on notifying affected individuals says that notice should come as soon as practicable, at the same time as or after PDPC is told.

So a card leak like Delugs' is the kind where you should expect to hear from the shop, and Delugs did notify its customers. A breach affecting 500 or more people must also be reported to PDPC; Bee Cheng Hiang notified PDPC on 27 April and, according to the decision, notified all affected members. Neither decision mentions compensation for customers.

What should I do if a shop leaks my data?

Our suggested steps, matched to what was exposed:

1. Read the shop's notice carefully, and find out exactly which data was involved. An exposed email address and a captured card number call for very different responses.
2. If only your email address leaked, expect more phishing. Be wary of messages that mention the shop, its rewards programme or a "problem with your order", and go to the shop's website yourself rather than tapping links.
3. If card details may have been captured, contact your card issuer to block the card and ask for a replacement, then check your statements for transactions you do not recognise.
4. Ask the shop's Data Protection Officer your questions in writing. PDPC's DPO registry page says to approach the organisation first, and that if it does not respond within 10 working days (30 working days for access or correction requests), or you are not satisfied, you can raise a formal report with PDPC.
5. Report it to PDPC if the shop does not resolve your concern. PDPC's page on raising a concern lists failing to protect your data, for example using "CC" instead of "BCC" in mass emails, among the things organisations may not do even with consent, and counts data disclosed through poor security measures among the concerns PDPC handles.

The best protection is collecting less. Our guide to what an online store should ask for covers how much data a shop needs, and our checkout checklist covers what to note before you pay.

For more on what happens after a purchase, see the ownership topic.

Common questions