Xinmin Secondary students' NRIC numbers leaked online

The NRIC numbers of hundreds of students at Xinmin Secondary School were leaked in the second known data breach by a Ministry of Education (MOE) school since March 2015.

The information was posted this month on file-sharing website pastebin.com, but The Sunday Times understands that it has since been taken off the site and a police report has been made.

Xinmin Secondary's vice-principal Tan Kuo Cheang said the school was alerted to the data breach on Sept 28. It immediately contacted the website, asking for the information to be removed, and also filed a police report.

It then contacted its students to alert them of the leak and to share cyber security measures that they could take, such as avoiding using NRIC numbers as passwords.

When contacted, a spokesman for MOE said: "In line with government IT security policies, MOE has stepped up efforts to work with schools and ensure that their security measures continue to be effective.

"As investigations are ongoing, we are unable to share more."

In March 2015, the personal data of more than 1,900 pupils of Henry Park Primary School were exposed.

An Excel spreadsheet containing the children's particulars was mistakenly sent out to about 1,200 parents as part of an update about a school event. The file contained the names and birth certificate numbers of all 1,900 pupils in the school, and the names, phone numbers and e-mail addresses of their parents.

MOE schools such as Xinmin Secondary and Henry Park are exempted from the Personal Data Protection Act, fully enforced from July 2014.

The Act requires organisations to take "reasonable measures" to protect personal data in their possession.

Instead, MOE schools are governed by public sector rules which have not been made public.

Technology lawyer Bryan Tan of Pinsent Masons MPillay said: "The Government said that its standards are more stringent than those that govern the private sector. But when a public incident like this happens, we can assess whether the first statement is true."

Lawyer Koh Chia Ling from law firm OC Queen Street said that the students have no recourse. "Even if they do, it might be difficult for them to show any loss suffered from negligence or breach of contract," he said.

A version of this article appeared in the print edition of The Sunday Times on November 19, 2017, with the headline 'Xinmin Secondary students' NRIC numbers leaked online'. Print Edition | Subscribe