SINGAPORE - While serving an internship at OCBC, a polytechnic student accessed 55 customers’ information without authorisation, including sensitive details such as their account balance.

The customers included “prominent local and foreign personalities, including political and public figures”, according to court documents, which did not reveal their identities.

Among the 55 customers was also one of the student’s friends, whose complaint to the bank led to the discovery of the offence.

Leon Leong Hong Jun, 25, who was a Nanyang Polytechnic (NYP) student at the time of the offence, pleaded guilty on Friday to one charge of unauthorised access to computer material under the Computer Misuse Act.

He was jailed for six weeks.

Court documents said Leong committed the offences in April 2022. At the time, he was on a school internship in the business compliance department of OCBC.

Tasked to help in data gathering and the procuring of review documents for the bank, he was given access to OCBC’s banking system, which contains customers’ details.

Between April 1 and 29, 2022, Leong entered the banking system to conduct searches on people whom he knew or knew about.

In total, he retrieved the profile information of 55 OCBC customers, including their names, identification numbers, addresses, as well as education and employment history.

Said Deputy Public Prosecutor Yee Jia Rong: “At all times, the accused knew that he was unauthorised to access these 55 customers’ profile information, as he was not doing so for business purposes.”

One of these customers was Leong’s friend. One day, in the course of an argument between them, Leong told the friend that he knew his personal banking information, including his bank balance.

On April 28, 2022, the friend complained to OCBC about Leong’s unauthorised access and disclosure of his information.

Questioned by the bank, Leong “admitted to his actions and claimed to have done so out of boredom and curiosity”, said DPP Yee.

The prosecutor said that Leong did not disclose any profile information of the 55 customers to any third party.

However, the fact that Leong had readily disclosed a friend’s personal information in an argument “clearly indicates his lack of restraint in dealing with such illegally obtained information”, said DPP Yee.

A representative from OCBC lodged a police report on June 13, 2022.

Calling for two to three months’ imprisonment for Leong, DPP Yee said there was significant potential harm to the affected customers. Not only had Leong accessed highly sensitive and confidential information of ordinary individuals, but he had also retrieved that of political and public figures.

For such high-profile people, the risk of onward dissemination and distribution of their information is significantly higher, said the prosecutor.

DPP Yee said deterrence should be the dominant sentencing consideration, noting that a major financial institution’s computer systems were breached.

NYP was informed about the offence after OCBC filed the police report.

Leong is currently a Year 3 student at NYP, said a spokesman for the polytechnic in response to The Straits Times’ queries.

While court proceedings were ongoing, the polytechnic had also convened a disciplinary inquiry. ST understands that Leong has not been suspended or expelled.

His six-month internship was terminated after the offence came to light.

The NYP spokesman said: “The polytechnic expects our students to obey the law at all times, and takes a strong stance against such acts of misuse.”