IT Vendor Staff with Excessive Access Rights to File Transfer Servers and Encryption/Decryption Keys in PSD's Human Resource and Payroll System

Dr Tan Wu Meng asked the Prime Minister regarding the Auditor-General's finding of the Public Service Division's Human Resource and Payroll system having 12 accounts belonging to IT vendor staff with excessive access rights to File Transfer servers and encryption/decryption keys (a) whether there has been any unauthorised access, modification or exfiltration of data; (b) whether malicious intent or foul play has been ruled out; and (c) whether remedial action has been taken against the vendor.

The IT vendor of the Human Resource and Payroll System created 12 administrative accounts to facilitate troubleshooting and monitoring of system issues. However, the accounts were configured with excessive rights, which created risks.

In response to the Auditor-General's Office's findings, the Public Service Division (PSD) has taken immediate actions to reduce the rights of these accounts in terms of system access. PSD has checked through and ascertained that there was no unauthorised access to the system and no compromise of system data.

There is no basis to suspect foul play. In addition, PSD also extended checks on other system accounts to ensure there were no unauthorised access or activities. We have issued the vendor a stern warning for all the lapses uncovered within this audit.