Why did a vendor testing dataset intended as mock include real NRIC data?

Question

Accepted Answer

Real NRIC Data Included in Vendor Testing Dataset Due to Compromised Mock Data Environment

A dataset created for vendor development and systems integration testing by IBM for the Singapore Land Authority (SLA) was found to contain real personal information, including NRIC numbers, despite being intended for mock and anonymised records. The affected environment, managed by IBM, was used for testing the Singapore Titles Automated Registration System (STARS) and eLodgment System (ELS).
Compromised Testing Environment

The dataset in question was initially created in 1998 and underwent periodic updates. It was designed to hold only fabricated or anonymised data for the purpose of testing and development. However, an investigation revealed that it contained actual personal details such as names, NRIC numbers, and previous property addresses of approximately 70,000 individuals.
Separation from Live Systems

SLA has emphasised that the compromised testing environment is entirely separate from its live operational systems. This distinction means that critical property ownership and lodgment records within the STARS and ELS remain secure and were not accessed. IBM has taken immediate action by revoking access to the system where the breach occurred to prevent any further unauthorised entry.
Investigation and Notification Process

In response to the incident, SLA is actively notifying all individuals whose data may have been compromised and is providing information on available assistance measures. The authority is collaborating with IBM, the Government Technology Agency of Singapore, and the Cyber Security Agency of Singapore to conduct a thorough investigation into how the real data was included and to implement necessary remedial actions. A police report has been filed, and the Personal Data Protection Commission has been informed of the breach.

Reading history

Hide →

This history is cleared when the page is closed.

Why did a vendor testing dataset intended as mock include real NRIC data?

Loading

Was this article helpful?

Helpful

Not helpful

Report an issue

2

0

0

Share with friends