MOF’s and ACRA’s Joint Response to the Report of the Review into the Public Disclosure of Full NRIC numbers on Bizfile People Search

1.      We accept the findings of the Review Panel and acknowledge the shortcomings identified that led to the disclosure of full NRIC numbers in the People Search function of ACRA's new Bizfile portal from 9 to 13 December 2024

2.      We apologise again for our oversight, which had caused public anxiety and concerns. In this incident, the Public Service did not perform to the level we set for ourselves.

3.      We are taking immediate steps to address the shortcomings identified by the Panel:

      a.       One, ACRA will improve communications internally and with other agencies to ensure that critical information is sufficiently shared within the organisation, so that the relevant decision makers can make informed decisions. ACRA will strengthen staff training and its internal processes to facilitate information exchange.

      b.     Two, ACRA will conduct more regular system reviews to evaluate data security and protection risks, and implement appropriate security measures based on identified vulnerabilities. ACRA will increase the frequency of such reviews, especially before, during and after major IT system changes, to ensure updated security measures are in place.

      c.     Three, ACRA will strengthen its oversight of vendors to ensure that systems are implemented effectively and in line with requirements. ACRA will refine its vendor management framework to put in place additional safeguards, such as increasing the scope and regularity of performance assessments and stepping up user testing prior to launch of new systems.

4.      The HR and Finance Committee of the ACRA Board¹ has thoroughly reviewed the actions and responsibilities of the officers involved in this incident. While there was no malicious intent or wilful wrongdoing, there were shortcomings in the implementation and oversight of the People Search function of Bizfile. The appropriate actions are being taken with the officers and leaders involved. This includes reviewing performance assessments, which will carry financial consequences, as well as counselling and additional training.

5.      As the parent Ministry of ACRA, MOF is supporting ACRA in its follow-up actions to learn from this incident, and to share the learning points with other MOF agencies. We are taking the necessary steps to ensure such incidents do not recur.

MDDI's Response to Review into the Public Disclosure of Full NRIC Numbers on Bizfile People Search

MOF's and ACRA's Joint Response to the Report of the Review into the Public Disclosure of Full NRIC numbers on Bizfile People Search

PMO's Press Release: The Government Completes Review into the Public Disclosure of Full NRIC Numbers on Bizfile People Search

¹ The HR and Finance Committee is chaired by ACRA Chairman and comprises Board members.