Out of the 71 successful unauthorised changes, the culprits went on to take over 16 Singpass accounts by performing a password reset and requesting the new password to be mailed to the new address.
Ms Sun said the Singapore Police Force is coordinating with government agencies and private entities to stop or reverse any fraudulent activity originating from these 16 compromised Singpass accounts.
“If there have been monetary losses arising from the compromised Singpass accounts, police will work with agencies and financial institutions to remediate the losses wherever possible,” she said.
ICA’s online service resumed partially since Jan 14 after an additional security measure of face verification was introduced for those seeking to change their own residential addresses.
The two other options to change addresses via the “others” and the “myself and my family” modules will remain suspended until additional safeguards can be put in place, said Ms Sun.
Thirteen suspects have been arrested thus far in relation to the case, with four men charged in court for offences under the Computer Misuse Act 1993.
For these offences, the punishment for a first-time offender is a jail term of up to three years, a fine of up to S$10,000 (US$7,300), or both.
The police will make known other details in due course as its investigations progress further, said Ms Sun.
Responding to a question from Member of Parliament Joan Pereira (PAP-Tanjong Pagar) on whether ICA could have acted sooner in suspending its online service, Ms Sun said that a review is under way.
She noted that ICA started its investigations in September 2024 after receiving several reports of unauthorised change of address.
“Initially, the cases appeared unconnected. Time was needed to investigate and triangulate information from various reports made,” she said.
By December, ICA’s investigations established how the unauthorisied changes were done and what they were used for.
At the same time, ICA was reviewing the technical aspects of improving the security of its online service. Following an internal assessment, it decided to suspend the online service on Jan 11.
“In hindsight, ICA could have taken steps to cease the service earlier in December 2024 when the modus operandi was established, but these are judgment calls that public officers have to make every day,” said Ms Sun.
“The Ministry of Home Affairs is reviewing with ICA what lessons we can draw from this incident.”
In a written parliamentary answer to MPs’ questions about the government’s actions after the ICA incident, Minister for Digital Development and Information Josephine Teo said that government agencies have been conducting checks on the possible impact to their e-services.
“So far, there have been no transactional services identified that can be completed in the same manner as unauthorised (electronic change of address) transactions using only the NRIC number and date of issue of the NRIC,” she said.
