Personal data of 70,000 people in world's second-richest country exposed in IBM vendor data breach

About 70,000 people had their personal information compromised in a data breach involving an IBM-managed testing environment used by the Singapore Land Authority (SLA).

A hooded person writes code on a smartphone and laptop

SLA said Friday the breach involved unauthorized access to a data set created for vendor development and testing in Singapore, ranked the world's second-richest country by GDP per capita in 2025 by The Economist.

The incident affected an IBM-managed development and systems integration testing environment for the Singapore Titles Automated Registration System (STARS) and eLodgment System (ELS), according to Channel News Asia. The web-based platforms allow lawyers, government agencies and authorized individuals to submit documents related to property transfers and caveats.

SLA told The Straits Times that IBM notified the agency of a security incident on June 12 and possible unauthorized access to personal information on June 15.

Preliminary investigations found that attackers accessed a data set created for vendor development and testing. The data set, first created in 1998 and updated periodically, was intended to contain only mock and anonymized data based on property ownership and lodgment records.

However, SLA found that it also contained the names, National Registration Identity Card (NRIC) numbers and property addresses of about 70,000 individuals.

The agency said the information should have been anonymized but was not, adding that investigations are underway to determine how the data was included.

It also said most of the addresses in the compromised data set are no longer the current residential addresses of the affected individuals because the data set was created in 1998.

It said the breach was limited to a separate testing environment and did not affect its live operational systems. Property ownership and lodgment records in STARS and ELS remain secure and unaffected.

IBM has revoked access to the affected system to prevent further unauthorized access.

SLA has begun notifying affected individuals and expects to complete the process by the end of next week. It has also filed a police report and notified Singapore's Personal Data Protection Commission.

The authority urged the public to remain vigilant against phishing emails, fake websites, text messages and phone calls from people claiming to represent government agencies or other organizations. It also apologized for the concern and inconvenience caused.