Bizfile NRIC disclosure controversy

The Bizfile NRIC disclosure controversy refers to the public backlash in December 2024 over the Accounting and Corporate Regulatory Authority's (ACRA) revamped Bizfile portal, whose "People Search" function displayed the full National Registration Identity Card (NRIC) numbers of individuals to anyone, without authentication or payment. The function was disabled on 13 December 2024. A government review panel led by Head of Civil Service Leo Yip found no deliberate wrongdoing but identified multiple shortcomings by ACRA and the Ministry of Digital Development and Information (MDDI); its report was released on 3 March 2025, and Senior Minister Teo Chee Hean delivered a ministerial statement on it in Parliament on 6 March 2025.

Background

Prior to the incident, government agencies had for years treated NRIC numbers as sensitive. Since September 2019, following guidelines issued by the Personal Data Protection Commission (PDPC), private organisations had been restricted from collecting, using or disclosing NRIC numbers except where required by law or for high-fidelity identity verification. Statutory boards such as ACRA are, however, exempt from the Personal Data Protection Act.

In July 2024, MDDI issued an internal Circular Minute directing public agencies to stop using NRIC numbers for authentication and to stop internal uses of masked NRIC numbers within the public sector. The directive was intended to apply to internal government processes. ACRA interpreted it as requiring the display of full, unmasked NRIC numbers on its public-facing Bizfile portal — a misapplication that email exchanges between the two agencies failed to catch.

Under the earlier BizFile+ system, only the last three digits and the suffix letter of an NRIC number were shown, and users had to pay for full details.

The disclosure

On 9 December 2024, ACRA launched the new Bizfile portal. Its People Search function allowed anyone to retrieve individuals' full NRIC numbers by name, for free and without logging in.

On 12 December 2024, former journalist Bertha Henson raised concerns in a Facebook post, describing how easily sensitive information could be accessed and writing that it raised serious questions about privacy and misuse of personal data. Subsequent investigations by news outlets found that the NRIC numbers of many individuals, including Cabinet ministers and other public figures, were accessible through the function.

The Straits Times reported a case in which a woman, Gina Tan, said her mother was nearly deceived by a scammer posing as an Interpol officer who cited her full NRIC number and address, lending credibility to the impersonation.

Public reaction

The disclosure sparked widespread public anxiety, amplified by the fact that many Singaporeans had long treated NRIC numbers as private information, and by the 2019 PDPC guidance warning that indiscriminate handling of NRIC numbers could increase the risk of identity theft or fraud.

Suspension of the search function

ACRA disabled the People Search function on the morning of 13 December 2024, briefly restored it later that day, then disabled it again, ultimately replacing it with a message that the service was temporarily unavailable. The function was later reinstated in the week of 23 December 2024 without displaying NRIC numbers, whether full or partial.

Government response

Initial statements (14 December 2024)

Early on 14 December 2024, MDDI acknowledged that "coordination could have been better so that ACRA's move would not have run ahead of the government's intent", adding that any unmasking of NRIC numbers was meant to follow a public education campaign. ACRA, for its part, stated that it had "moved ahead with unmasking before adequately preparing the ground". Both agencies apologised for the anxiety caused.

MDDI also set out its broader policy position: that an NRIC number is a unique identifier rather than a secret, and that "there should therefore not be any sensitivity in having one's full NRIC number made public, in the same way that we routinely share and reveal our full names to others". It argued that problems arise only when NRIC numbers are misused for authentication, and that masking creates a "false sense of security" because masked numbers can often be reconstructed algorithmically.

PDPC response (14 December 2024)

Following the MDDI and ACRA statements, the Personal Data Protection Commission (PDPC) issued its own statement on the appropriate and inappropriate uses of NRIC numbers. It advised that NRIC numbers, being identifiers rather than secrets, are unsuitable for authentication, and recommended that individuals not use NRIC numbers as passwords and that organisations stop relying on them to authenticate identity or set default passwords. The PDPC pointed organisations towards stronger methods such as complex passwords, multi-factor authentication and biometric verification, and reminded them of their data-protection obligations under the PDPA. The PDPC said it intended to update its advisory guidelines on NRIC and other national identification numbers to align with the new policy position, but that no changes would be finalised until consultations with industry and the public were completed.

Advisory guidelines temporarily removed

On 14 December 2024, the 2018 Advisory Guidelines on the PDPA for NRIC and Other National Identification Numbers were briefly taken down from the PDPC website, which displayed a notice that the document was temporarily unavailable while being updated. The guidelines were subsequently restored, with a note that they would remain in effect until updated guidelines were developed.

Press conference (19 December 2024)

On 19 December 2024, Minister for Digital Development and Information Josephine Teo and ACRA Chief Executive Chia-Tern Huey Min addressed the matter at a press conference, expressing regret. Teo said: "We are very sorry to have caused them much anxiety." Second Minister for Finance Indranee Rajah attributed the incident to miscommunication, saying the phased sequence with public communications had been overtaken when the numbers "inadvertently got put out, and then everything got accelerated".

Review panel

The government appointed a review panel chaired by Head of Civil Service Leo Yip to review the policy on responsible use of NRIC numbers as it pertained to Bizfile, determine the causes of the incident, and identify lessons to prevent recurrence. The panel submitted its report to Senior Minister Teo Chee Hean on 25 February 2025; Prime Minister Lawrence Wong approved it for public release, and it was published on 3 March 2025.

The panel found no factual evidence of deliberate wrongdoing or wilful inaction, but identified several shortcomings: MDDI's July 2024 Circular Minute was not clear enough; ACRA had internal shortcomings in sharing and acting on the policy information; ACRA did not properly assess the balance between disclosing full NRIC numbers and keeping them from being too readily accessible, contravening the Government's internal data management rules (IM8); and certain security features, including CAPTCHA, were not adequately implemented.

A GovTech review found that inadequate security controls made automated data extraction easier. Investigations recorded over 500,000 searches on the People Search function between 9 and 13 December 2024 — far above the usual 2,000 to 3,000 daily queries — with the peak on 13 December from around 28,000 IP addresses, mostly Singaporean. Because Bizfile did not log individual queries, ACRA could not determine how many NRIC numbers had actually been accessed.

Ministerial statement (6 March 2025)

On 6 March 2025, Senior Minister Teo Chee Hean, who is Minister-in-charge of Public Sector Data Governance, delivered a ministerial statement in Parliament on the report. He stated that while the review found no malicious or wilful wrongdoing, there were "inadequacies in [the officers'] judgment and actions", and that officers and senior management responsible would face measures including counselling, retraining, and reductions in their performance grade and performance-based payments. He clarified that the review was not itself a disciplinary process, and that any disciplinary action would be handled by the respective agencies.

On accountability at senior levels, Teo said that Digital Development Minister Josephine Teo and Minister in the Prime Minister's Office and Second Minister for Finance Indranee Rajah had publicly accepted responsibility and apologised. He noted that ACRA's Chief Executive Chia-Tern Huey Min had been in charge of the design and implementation of the new Bizfile portal. The panel also found that ACRA's disclosure of full NRIC numbers had breached the Government's internal data management code, known as IM8, which is aligned with the Personal Data Protection Act but adapted for the public sector; existing law imposes no financial penalties on public agencies that breach IM8.

Agency responses

Following the report's release on 3 March 2025, the Ministry of Finance (MOF) and ACRA issued a joint statement accepting the panel's findings and apologising. ACRA committed to improving internal and inter-agency communication and staff training, conducting more regular system security reviews (especially around major IT changes), and strengthening oversight of vendors. The HR and Finance Committee of the ACRA Board reviewed the actions of the officers involved; while it found no wilful wrongdoing, performance assessments were adjusted with financial consequences for those responsible.

MDDI issued its own response the same day, accepting the panel's findings. It said it was developing further guidance to agencies on applying the NRIC policy, having identified almost 800 existing use cases of partial NRIC numbers in public-facing systems; would strengthen its internal processes and staff training when issuing policy directives; and had reminded agencies of existing data management standards. MDDI added that it would consult industry and the public before any changes to NRIC guidelines in the private sector, and would step up public education on incorrect uses of NRIC numbers.

Timeline of events

Date	Event
July 2024	MDDI issues internal Circular Minute on phasing out masked NRIC numbers in public-sector processes
9 December 2024	ACRA launches revamped Bizfile portal; People Search displays full NRIC numbers
12 December 2024	Bertha Henson raises concerns in a Facebook post
13 December 2024	People Search disabled, briefly restored, then disabled again; over 500,000 searches recorded 9–13 December
14 December 2024	MDDI and ACRA issue statements acknowledging lapses and apologising
14 December 2024	PDPC issues statement on the appropriate use of NRIC numbers; 2018 Advisory Guidelines briefly removed, then restored pending update
19 December 2024	Josephine Teo and Chia-Tern Huey Min address the matter at a press conference
Week of 23 December 2024	People Search reinstated without NRIC numbers
25 February 2025	Review panel submits report to SM Teo Chee Hean
3 March 2025	Report publicly released; MOF/ACRA and MDDI issue responses
6 March 2025	SM Teo Chee Hean delivers ministerial statement in Parliament

See also

• Accounting and Corporate Regulatory Authority
• National Registration Identity Card
• Personal Data Protection Act 2012
• Ministry of Digital Development and Information