Ransomware Attack Disrupts Payroll System Used by Singapore Mosques and Madrasahs
Summary
Ransomware encrypted Avelogic’s SmartHRMS databases and backups, disrupting payroll for MUIS-affiliated mosques and madrasahs. Avelogic reported no evidence of bulk data theft and was working to restore service.
Key points
- Avelogic detected threat actor activity on Aug. 30 and 31; MUIS confirmed an incident involving the vendor-operated HR system.
- The attackers encrypted SmartHRMS databases, including backups, disrupting access and forcing some staff to process salaries manually.
- The system may have held staff names, contact details, salaries and bank account numbers; the number of affected organisations was not disclosed.
- Avelogic’s initial notice said unexplained outbound transfers meant it could not rule out data theft. Its Sept. 14 update said the investigation found no evidence of bulk data theft.
- Avelogic said it recovered the latest data set and aimed to restore systems by Sept. 18.
- Avelogic filed a police report, notified Singapore’s Personal Data Protection Commission and commissioned an independent forensic investigation; police and the commission are investigating.
Article Details
- Victim Organization
- Mosques and madrasahs under the Islamic Religious Council of Singapore (MUIS); affected organizations were not named
- Incident Type
- Ransomware attack that encrypted databases and backup copies
- Data Types Exposed
- Names
- Contact details
- Salary information
- Bank account numbers
- Affected Records
- Unknown; the system was believed to contain staff information for dozens of mosques and madrasahs
- Operational Impact
- Payroll processing was disrupted, and accounting staff had to process salaries manually. MUIS said business continuity arrangements supported essential HR and payroll functions. Avelogic reported that it recovered the last updated data set and aimed to restore service by Sept 18.
- Ransom Or Extortion
- The system was held for ransom. Whether a ransom was paid was not disclosed.
- Claim Status
- confirmed