SLA data leak leaves 70,000 individuals exposed

SINGAPORE: The Singapore Land Authority (SLA) has revealed that a data security incident involving an IBM-managed cloud environment has affected the personal data of around 70,000 individuals.

SLA said that the incident involved a development and testing dataset that was accessed without authorisation. The dataset was intended to contain only mock and anonymised information for testing purposes. However, it was later discovered to include real personal information, including individuals’ names, NRIC numbers and property addresses.

IBM had been appointed to provide support and maintenance for SLA’s Singapore Titles Automated Registration System (STARS) and eLodgment System (ELS), and was responsible for managing the development and testing environment for both systems.

SLA stressed that the affected environment is separate from its operational systems and said there was no breach of its live platforms.

The authority said that the operational systems supporting STARS, ELS and its other digital services were not compromised by the incident. It also assured the public that property ownership records and lodgment records stored within STARS and ELS remain secure and have not been affected.

Following the discovery of the incident, IBM revoked access associated with the affected development and testing environment to prevent any further unauthorised access.

SLA said it has started informing individuals whose data may have been affected. It is also working closely with IBM, the Government Technology Agency (GovTech) and the Cyber Security Agency of Singapore (CSA) as investigations into the incident continue.

In addition, the authority has lodged a police report and notified the Personal Data Protection Commission (PDPC) about the breach.

SLA also disclosed that the testing dataset involved in the incident was originally created in 1998 and had been updated periodically over the years for use in vendor development and testing activities.