Massive NRIC Leak with Over 500,000 NRIC Searches in 5 Days

More than 500,000 searches were made on the Accounting and Corporate Regulatory Authority’s (Acra) Bizfile portal between December 9 and 13, exploiting a flaw that revealed full NRIC numbers. This incident sparked widespread concern, prompting a ministerial response in Parliament on January 8.

Incident Overview

The new Bizfile portal was launched on December 9, and its free People Search function allowed users to access full NRIC numbers. Concerns surfaced on December 12, and the search function was disabled the following evening.

The surge in searches, far exceeding the typical daily average of 2,000–3,000, came predominantly on December 13 from approximately 28,000 IP addresses, most of which were from Singapore.

Second Minister for Finance Indranee Rajah explained that while the portal’s function to prevent automated bot searches failed, there is no evidence that malicious actors accessed the data.

Security Oversight and Response

Ms. Indranee acknowledged that the Bizfile portal did not track individual queries, making it impossible to determine the exact number of NRIC numbers disclosed. Acra and GovTech have since conducted a review, addressing the malfunctioning security feature.

The People Search function resumed on December 28, with NRIC numbers no longer displayed in search results.

Acra is also exploring additional parameters, such as using Unique Entity Numbers (UENs) in searches, to enhance data protection.

Scope of Data and Mitigation Advice

Ms. Indranee clarified that Acra’s database contains information only on individuals involved in Acra-registered entities, such as companies, partnerships, and non-profits.

She provided steps for individuals concerned about potential misuse of their NRIC numbers:

Avoid using NRIC numbers as passwords for digital accounts and change any such passwords immediately.
Refrain from using NRIC numbers for authentication purposes.
Verify the identity and intent of individuals requesting NRIC details, even if they appear to know the number.

Lessons and Safeguards

The incident highlights vulnerabilities in systems managing sensitive personal data. While Acra has taken corrective measures, Ms. Indranee emphasized the importance of vigilance and better design in future systems to prevent similar breaches.

Comments

British Citizen Sentenced to Short Detention and Community Service Following Altercation with Elderly PHV Driver

A 22-year-old British citizen and Singapore permanent resident named Oruche Morgan Fidelis appeared in court on September 7 clad in a black suit and face mask for his sentencing following an incident with a 66-year-old private-hire vehicle driver. The court handed down a sentence consisting of a five-day short detention order and 100 hours of community service to be completed within 12 months. A short detention order requires an offender to be detained in prison for a period not exceeding 14 days, offering a short period of incarceration to act as a deterrent by allowing the individual to experience prison life. Because it falls under the framework of a community-based sentence, successful completion of the terms means the conviction will be removed from the individual's criminal record. However, if the terms are not met or completed, the individual will be brought back to court to face standard legal sentencing. The incident occurred on June 12, 2024, beginning earlier in the ev...

Elderly Coffee Shop Patron Suffers Severe Back Pain Following Altercation

Update: Police have identified a forty-year-old man involved in an incident on August 15 2026 at Roxy Square food court along East Coast Road. Investigations were launched after a seventy-three-year-old man, identified as wonton noodle stall owner Yeo Song Khoon, was shoved to the ground. Mr Yeo, who has difficulty walking, had patted a young girl on the head because he found her adorable. The child's father became upset and confronted him, resulting in the fall. CCTV footage shared online by Bei-Ing Wanton Noodle showed the shove and sparked public appeals. Although the father later apologized and bought Mr Yeo a drink, Mr Yeo began experiencing back pain hours later and is currently managing it with medication. Police confirmed a report was made and urged the public to avoid speculation as investigations continue. Mr Yeo expressed that he does not wish to cause further trouble. _______________________________________________________ A viral social media post has sparked concern...

MP Gan Siow Huang Clarifies and Apologises for Handshake Incident

Minister of State for Foreign Affairs and Trade and Industry Gan Siow Huang, who also serves as the Member of Parliament for Marymount Single Member Constituency, has publicly apologised after a video showing a delayed handshake during a public event circulated widely online and drew criticism from netizens. The video, which surfaced on social media on June 7 and has since garnered over 185,000 views on TikTok alone, captured Ms Gan exiting a car and being greeted by a group of eight men at an event. Among them was a man in a red shirt, who helped her close the car door and extended his hand for a handshake. However, in the footage, Ms Gan is seen initially shaking hands with another man she was introduced to, while momentarily overlooking the man in red. The handshake with the man in red took place shortly after, once Ms Gan had greeted the others. Speaking to the media on June 8, Ms Gan clarified that the incident took place on May 17 during her visit to the inaugural Peck San ...

LAKOPINEWS.COM

Search This Blog