Cybersecurity incident affected 48 mosques, four madrasahs; no ransom paid: MUIS
The incident, which was first reported earlier in the week, involved a human resources and payroll system.
by Darcel Al Anthony · CNA · JoinRead a summary of this article on FAST.
Get bite-sized news via a new
cards interface. Give it a try.
Click here to return to FAST Tap here to return to FAST
FAST
SINGAPORE: No ransom was paid following a cybersecurity incident involving software vendor Avelogic, the Islamic Religious Council of Singapore (MUIS) said on Thursday (Sep 17).
The incident, first reported on Tuesday, affected Avelogic's human resources and payroll system and clients across different sectors. In the community sector, this included 48 mosques, four madrasahs, the Islamic Learning Hub and Management Office and Mosque-Madrasah-Wakaf Shared Services, MUIS said.
A police report was made, and Avelogic is continuing to investigate the incident and its wider impact, MUIS said.
The council added that it was “concerned” about the impact on the affected organisations and their employees and that it was working with those affected to ensure salaries would continue to be paid on time.
"Alternative payroll arrangements are already in place, and there has been no disruption to religious or public-facing services," said MUIS.
Avelogic has since recovered the affected data and engaged independent cybersecurity experts to investigate the incident.
Based on investigations so far, there is no evidence that a large amount of data was taken from the system, MUIS said. Data stored in the affected system is also encrypted as an additional layer of protection.
Investigations and security checks are ongoing, and the system will only resume operations after the relevant safeguards and checks have been completed.
"MUIS will continue to support the affected community sector organisations to ensure essential HR and payroll functions continue without disruption," the council said.
CNA Games
Guess Word
Crack the word, one row at a time
Buzzword
Create words using the given letters
Mini Sudoku
Tiny puzzle, mighty brain teaser
Mini Crossword
Small grid, big challenge
Word Search
Spot as many words as you can
Show More
Show Less
MUIS told CNA on Tuesday that the incident did not affect the delivery of public-facing or government services. It did not reveal the number of people affected or what information may have been compromised.
Separately, Avelogic published a cybersecurity incident notice concerning its SmartHRMS system, which it described as a payroll and human resources management system for enterprises.
In an update on Monday, the company said an independent forensic investigation found no evidence of bulk data exfiltration, based on available Amazon Web Services network telemetry covering confirmed threat actor activity from Aug 30 to Aug 31.
Avelogic did not identify affected customers. It said sensitive data fields within SmartHRMS remained protected by application-layer encryption.
The company filed a police report on Aug 31 and notified the Personal Data Protection Commission (PDPC). A PDPC spokesperson told CNA on Wednesday that it was investigating the data breach notification filed.
Avelogic appointed cybersecurity firm Black Panda on Sep 3 to conduct a forensic investigation. It added that it had recovered the latest data set and aimed to have its new system running by Friday.
Sign up for our newsletters
Get our pick of top stories and thought-provoking articles in your inbox
Get the CNA app
Stay updated with notifications for breaking news and our best stories
Get WhatsApp alerts
Join our channel for the top reads for the day on your preferred chat app