Why was real data used in a test environment for so long?

Question

Accepted Answer

Real Data Compromised in IBM-Managed Test Environment for Singapore Land Authority

Personal data of approximately 70,000 individuals was exposed due to unauthorized access to a dataset within an IBM-managed testing environment used by the Singapore Land Authority (SLA). This dataset, intended for vendor development and systems integration testing for systems like the Singapore Titles Automated Registration System (STARS) and eLodgment System (ELS), was found to contain real names, NRIC numbers, and past property addresses. While the specific reasons for the inclusion of real data and the duration of its presence are not fully detailed, the compromised environment is confirmed to be separate from SLA's live operational systems, with property ownership records remaining secure.
Unauthorized Access to Testing Dataset

The incident originated from unauthorized access to a specific dataset managed within a cloud environment overseen by IBM. This environment is utilized for testing purposes related to systems such as STARS and ELS, which are critical for property-related document submissions. The breach occurred through this avenue, leading to the exposure of sensitive personal information.
Compromised Dataset's Nature and Contents

The dataset in question was initially created in 1998 and underwent periodic updates. It was designed with the intention of containing only mock and anonymised records to facilitate testing without risking the exposure of actual user data. However, investigations revealed that it had been populated with real personal information, including names, NRIC numbers, and historical property addresses of around 70,000 individuals.
Separation from Live Systems

SLA has emphasized that the compromised testing environment is distinct and isolated from its live operational systems. This separation ensures that critical data pertaining to property ownership and lodgment records within the STARS and ELS remain unaffected and secure. IBM has taken immediate action to revoke access to the compromised system to prevent any further unauthorized entry.
Investigation and Notification Process

In response to the incident, SLA has initiated the process of notifying all affected individuals, providing them with information on available assistance measures. The authority is collaborating with IBM, the Government Technology Agency of Singapore, and the Cyber Security Agency of Singapore to thoroughly investigate the breach and implement necessary remedial actions. A police report has been filed, and the Personal Data Protection Commission has been formally notified of the event.

Reading history

Hide →

This history is cleared when the page is closed.

Why was real data used in a test environment for so long?

Loading

Was this article helpful?

Helpful

Not helpful

Report an issue

2

0

0

Share with friends