Why the IDA SingPass breach is a “long time coming”