How could mock data in the SLA system contain real NRIC numbers?

Question

Accepted Answer

Mock Data in SLA System Was Found to Contain Real NRIC Numbers

Personal data belonging to approximately 70,000 individuals was compromised due to unauthorized access to a dataset managed by IBM for the Singapore Land Authority (SLA). This dataset, initially created in 1998 and updated periodically, was intended solely for vendor development and systems integration testing. However, it was discovered to contain real information, including names, National Registration Identity Card (NRIC) numbers, and past property addresses, despite its intended purpose of holding only mock and anonymized records.
Origin of the Compromised Dataset

The dataset in question was established in 1998 to facilitate testing and development processes for systems such as the Singapore Titles Automated Registration System (STARS) and the eLodgment System (ELS). IBM was responsible for managing the testing environment where this dataset resided. This environment was designed to simulate real-world scenarios for integration testing without exposing sensitive live data.
Discrepancy Between Intended and Actual Content

While the dataset was created with the intention of using mock and anonymized records, it was later found to include actual personal information. This included NRIC numbers, which are highly sensitive identifiers. The discovery of these real details within a testing dataset raises questions about the data management and anonymization processes employed over the years.
Security Measures and Investigation

The Singapore Land Authority has emphasized that the compromised testing environment is separate from its live operational systems, ensuring that property ownership and lodgment records within STARS and ELS remain secure. IBM has taken immediate action by revoking access to the affected system to prevent further unauthorized entry. The SLA is collaborating with IBM, the Government Technology Agency of Singapore, and the Cyber Security Agency of Singapore to conduct a thorough investigation into the incident and implement necessary remedial measures. A police report has been filed, and the Personal Data Protection Commission has been duly notified.

Reading history

Hide →

This history is cleared when the page is closed.

How could mock data in the SLA system contain real NRIC numbers?

Loading

Was this article helpful?

Helpful

Not helpful

Report an issue

1

0

0

Share with friends