Singapore Land Authority test-environment breach exposes 70,000 people

On 3 July 2026, the Singapore Land Authority (SLA) disclosed that personal data of about 70,000 people had been compromised after unauthorized access to a testing environment managed by IBM. The environment supports development and systems integration testing for the Singapore Titles Automated Registration System (STARS) and the eLodgment System (ELS), which are used to submit property transfer and caveat documents.

IBM discovered the incident and reported it to the SLA. Access to the affected testing environment was revoked, and the SLA said it was working with IBM, the Government Technology Agency (GovTech) and the Cyber Security Agency of Singapore to investigate.

What was exposed

The dataset, first created in 1998 and updated periodically, was meant to contain only mock and anonymized records but in fact held real names, NRIC (national identity card) numbers and past property addresses. The SLA stressed that there was no connection to or compromise of the live STARS, ELS or other SLA systems, and that property ownership and lodgment records remained secure. The authority identified the affected individuals and began notifying them.

Why it matters

Local media described it as one of Singapore's most significant public-sector data incidents since the 2018 SingHealth breach. The root cause is a classic one: real personal data copied into a non-production environment, managed by a vendor and protected less strictly than live systems, then forgotten for decades.