Singapore Land Authority: 70,000 people’s personal data exposed in IBM-managed cloud environment security breach

The database was created in 1998 and updated over the years for software development and testing. It was meant to contain only mock or anonymised information. Instead, investigators discovered it also held genuine personal data belonging to an estimated 70,000 people.

SLA said investigations are underway to determine why the information wasn’t properly anonymised.

Live property records weren’t affected

The authority stressed that the affected testing environment is completely separate from its operational systems. It said there is no evidence that STARS, ELS or any other SLA operational systems were compromised.

Property ownership records and land transaction data continue to be secure. IBM has since revoked access to the affected cloud environment to stop any further unauthorised entry.

Affected individuals are being notified

SLA said it has started contacting everyone whose information appeared in the compromised database and expects to complete notifications by the end of next week.

The authority has also lodged a police report and informed the Personal Data Protection Commission. Investigations are being carried out with IBM, the Government Technology Agency of Singapore and the Cyber Security Agency of Singapore.

SLA urged the public to stay alert for phishing emails, text messages, fake websites and phone calls from people pretending to represent government agencies or other organisations. The agency also apologised for the concern caused by the incident.

Old test data can still create new risks

The incident shows how forgotten development databases can become security risks years after they are created. Even when live systems stay protected, older testing environments need the same attention because sensitive information can still find its way into them.

The immediate concern is staying alert for scams that misuse personal details for affected individuals. For organisations, the lesson is equally straightforward: test data should always be anonymised, regularly reviewed and removed when it’s no longer needed.