Payroll system of mosques, madrasahs hit by ransomware; staff details potentially compromised
SINGAPORE – The payroll system of mosques and madrasahs overseen by the Islamic Religious Council of Singapore (MUIS) has been hacked and held for ransom, The Straits Times has learnt.
The SmartHRMS human resources (HR) system is supplied by Singapore-based software vendor Avelogic.
The latest cybersecurity incident notice on Avelogic’s website, which was last updated on Sept 14, stated that threat actor activity was first detected on Aug 30 and 31. Avelogic did not name the customers affected.
When contacted by ST, MUIS confirmed the incident involving an HR management system operated by Avelogic.
“We are working closely with the affected organisations, Avelogic and the relevant authorities on the necessary follow-up actions,” said MUIS.
“This incident does not affect the delivery of public-facing or government services. Business continuity arrangements have been implemented to support essential HR and payroll functions, and affected employees are being provided with the necessary guidance and support,” it said.
MUIS declined to reveal how many mosques and madrasahs were affected, and what sensitive information – including the assets it manages and staff details – was compromised. It also declined to reveal if it has paid the ransom and whether data has been recovered, citing ongoing investigations.
The compromised system is believed to have contained sensitive information of staff at dozens of mosques and madrasahs, including their names, contact details, salaries and bank account numbers.
An affected individual who spoke to ST on condition of anonymity said accounting staff could not log in to the system after the attack, forcing them to scramble to process salaries manually.
The SmartHRMS system was supplied to mosques and madrasahs by the Mosque-Madrasah-Wakaf Shared Services, a committee under MUIS.
There are 72 mosques in Singapore.
The committee handles the accounts for 69 of the mosques and three madrasahs, providing payroll systems to generate payslips, according to its website.
In a ransomware attack, hackers either steal the data and threaten to release it publicly or lock the compromised data by encrypting it, disrupting operations.
Victims are asked to pay a ransom either to prevent their sensitive data from being leaked publicly, or to have their databases unlocked so they can continue operating.
A Sept 7 notice on Avelogic’s website about the incident said the hackers had encrypted its databases, including backup copies, leaving no recovery point. This initial notice also said it could not rule out data theft as there were unexplained outbound transfers.
An updated notice on Sept 14, however, said that its investigation found no evidence that data was stolen in bulk. The firm added that it was able to recover the last updated data set. It was aiming to have its systems running again by Sept 18.
Avelogic has filed a police report and notified the Personal Data Protection Commission (PDPC), and commissioned an independent forensic investigation by a cybersecurity firm.
The police confirmed that a report had been lodged and investigations are ongoing.
A PDPC spokesperson said it was aware and investigating the data breach notification filed by Avelogic.