Names, NRIC numbers and past property addresses were exposed after unauthorised access to a data set created for vendor development and testing.