No evidence a large amount of data compromised from HR system hit by ransomware, says MUIS

SINGAPORE – Investigations into the hacking of a payroll system used by mosques and madrasahs here currently show no evidence that hackers had extracted a large amount of data, the Islamic Religious Council of Singapore (MUIS) said on Sept 17.

In a media statement, MUIS said that Singapore-based software vendor Avelogic, which supplies the SmartHRMS HR system, “has since recovered the affected data and engaged independent cybersecurity experts to investigate the incident”.

“Based on the investigation to date, there is no evidence that a large amount of data was taken from the system. Data stored in the affected system is also encrypted as an additional layer of protection,” it added.

The Straits Times previously reported that the compromised system is believed to have contained sensitive information of staff working at mosques and madrasahs, including their names, contact details, salaries and bank account numbers.

A cybersecurity incident notice on Avelogic’s website - last updated on Sept 14 - stated that threat actor activity was first detected on Aug 30 and 31. The company did not name the customers affected.

MUIS said on Sept 17 that those affected in the community sector include 48 mosques, four madrasahs, Islamic Learning Hub and Management Office (ILHAM) and Mosque-Madrasah-Wakaf Shared Services (MMWSS).

“A police report was made and no ransom was paid,” MUIS added.

It said the system will resume operations only after the relevant safeguards and checks have been completed.

MUIS is also working with the affected institutions to ensure that employees will continue to receive their salaries on time.

“Alternative payroll arrangements are already in place, and there has been no disruption to religious or public-facing services,” it said. “MUIS will continue to support the affected community sector organisations to ensure essential HR and payroll functions continue without disruption.”

The Cyber Security Agency of Singapore said on Sept 17 that it is aware of the incident and has reached out to MUIS to offer assistance.