Review finds no ‘deliberate wrongdoing’ found in NRIC leak, ACRA & MDDI officers involved in leak to face penalties

No ‘deliberate wrongdoing’ in NRIC leak but officers face financial penalties for lapses

An independent review panel has concluded that there was no evidence of “deliberate wrongdoing” in the Dec 2024 NRIC number leak on BizFile, a national business register in Singapore.

However, officers involved will face financial penalties for lapses that led to the costly data breach scandal, reports The Straits Times (ST).

NRIC numbers exposed due to procedural failures

On 9 Dec last year, a search feature was introduced on BizFile, allowing the public to view full NRIC numbers of registered users.

Following public outrage, the feature was taken down four days later for review.

According to ST, the independent panel found multiple security lapses, including:

• Violations of government data management rules at Accounting and Corporate Regulatory Authority (ACRA)
• Miscommunication between ACRA and the Ministry of Digital Development and Information (MDDI)
• Lack of oversight on complex applications by MDDI

“We acknowledge that coordination could have been better so that ACRA’s move would not have run ahead of the government’s intent,” MDDI said in a statement in Dec 2024.

Although no malicious intent was found, the panel determined that existing safeguards were inadequate, directly contributing to the incident.

Officers to face financial penalties & penalties for NRIC leak

While the review cleared the officers of wilful misconduct, those responsible will still face financial penalties as part of their performance reviews, reports Channel News Asia (CNA).

Other disciplinary actions include:

• Counselling sessions for involved personnel
• Mandatory additional training on data protection and compliance

Stronger data protection measures to follow

Both ACRA and the Ministry of Finance (MOF) have accepted the panel’s findings and pledged to strengthen data protection policies to prevent future incidents.

“We apologise again for our oversight, which had caused public anxiety and concerns,” read their joint statement.

“In this incident, the public service did not perform to the level we set for ourselves.”

Also read: MS Polls: ‘It bothers me’: 80% of people polled not comfortable with unmasking NRIC number

Have news you must share? Get in touch with us via email at news@mustsharenews.com.

Featured image from a screengrab from official Bizhub website on 4 Mar 2025.