A recent incident involving Singapore’s Accounting and Corporate Regulatory Authority (ACRA) has sparked significant concern regarding the privacy of National Registration Identity Card (NRIC) numbers. When a new feature was launched on the Bizfile platform, it inadvertently allowed over 500,000 searches for individuals’ full NRIC numbers and names, raising alarm among citizens.
Surge in Searches
According to Second Minister for Finance Indranee Rajah, the surge in activity occurred between 9 and 13 December 2023, with the majority of searches happening on the 13th, just after news of this feature became public. Typically, the site sees about 2,000 to 3,000 queries daily, making this spike exceptional.
Public Outcry
- The searches originated from around 28,000 IP addresses, mainly in Singapore.
- Concerns led to the immediate disabling of the search function on 13 December.
- Investigations revealed the system was unable to track individual queries accurately.
ACRA later resumed its services on 28 December, with measures to ensure such sensitive data would not be displayed again. Indranee reiterated that the portal’s database only includes NRIC numbers of those associated with registered entities, not the general public.
Lapse in Coordination
The unforeseen disclosure stemmed from a misunderstanding related to a government directive issued in July 2024, which instructed agencies to discontinue the use of NRIC numbers for authentication purposes. The agency misinterpreted this directive, leading ACRA to display NRIC numbers rather than masking them as intended.
Review and Accountability
In response to this issue, a review panel led by the Head of Civil Service, Leo Yip, has been established to investigate the situation. The panel’s goals include:
- Evaluating the decision-making process behind the unmasking of NRIC numbers.
- Analyzing the coordination among public sector agencies.
- Recommending improvements to prevent similar incidents in the future.
The findings of this investigation are expected to be made public in February 2024. Indranee acknowledged the importance of responding promptly to public concerns and reiterated apologies for the distress caused.
Future Safeguards
Looking ahead, ACRA plans to enhance the search function by implementing additional parameters, such as the unique entity number (UEN), to mitigate the risk of exposing sensitive information. Indranee affirmed that further actions may be considered based on the ongoing review’s recommendations.