Over 500,000 searches for NRIC numbers on ACRA website from Dec 9 to 13, but no known threat actors: Indranee

SINGAPORE: More than 500,000 searches were made on a government business filing website over five days in December after news emerged that people’s names and full National Registration Identity Card (NRIC) numbers could be found.

This was much higher than the usual 2,000 to 3,000 daily queries made on the Accounting and Corporate Regulatory Authority’s (ACRA) Bizfile website, said Second Minister for Finance Indranee Rajah in parliament on Wednesday (Jan 8).

The website’s updated search function was launched on Dec 9 and most of the queries were made on Dec 13, the day after news of the NRIC numbers broke. The search function was disabled on the night of Dec 13.

The searches came from an estimated 28,000 Internet Protocol (IP) addresses, most of which were from Singapore. 

However, the authorities are unable to identify the exact number of NRIC numbers disclosed as the Bizfile portal is not configured to track individual queries, Ms Indranee said in a ministerial statement delivered in response to a spate of parliamentary questions over the recent saga.

The minister also noted that a security feature designed to distinguish between human users and computer bots in the portal’s search function “was not working as intended”, following a security review by ACRA and GovTech.

“This has since been fixed,” Ms Indranee told the House. 

“Thus far, we have not uncovered any known threat actors based on the IP addresses that were used to make the people search queries between Dec 9 and 13.”

Addressing questions about the scale of the disclosure, the minister said that ACRA’s database does not contain the information of all Singapore citizens.

Instead, it only has information of those who are reflected in filings or lodgements made with ACRA. These are individuals who are or have been involved in ACRA-registered entities, such as companies and partnerships.

“If you or your authorised representative have not made any filing with ACRA before, your NRIC number would not have been collected or shared by ACRA,” said Ms Indranee.

After a public outcry over privacy concerns, the government said on Dec 14 it had intended to change its practice of masking NRIC numbers only after explaining to citizens, but the new portal was launched before it could do so.

It apologised in a press conference on Dec 19 for the “lapse of coordination”.