MUIS Says Salaries Unaffected After Cyberattack Hits HR System Used by 48 Mosques

Employees at 48 mosques and several Islamic institutions in Singapore will continue to receive their salaries on time after a cyberattack affected a human resources system operated by software vendor Avelogic.

The Islamic Religious Council of Singapore (MUIS) said on Sept 17 that alternative payroll arrangements had already been put in place to prevent disruption to salary payments.

The affected system, SmartHRMS, is used by MUIS and a number of Muslim community institutions for human resources and payroll functions.

Besides 48 mosques, the affected organisations include four madrasahs, the Islamic Learning Hub and Management Office, and Mosque-Madrasah-Wakaf Shared Services.

MUIS said investigations so far had found no evidence that a large amount of data had been taken from the affected system. Data stored in the system was also encrypted, providing an additional layer of protection.

The system will not immediately return to normal operations. MUIS said it would only resume after the necessary safeguards and security checks have been completed.

Avelogic has recovered the affected data and engaged independent cybersecurity experts to investigate the incident and determine its wider impact.

The company detected suspicious activity on Aug 30 and 31 and subsequently filed a police report on Aug 31. MUIS said no ransom was paid.

Avelogic also notified Singapore’s Personal Data Protection Commission, which has begun its own investigation into the data breach notification.

The incident raised concerns because the affected human resources system contained staff information. Earlier reports said the system may have included details such as names, contact information, salaries and bank account numbers.

However, MUIS said there was currently no evidence of large-scale data extraction.

The council also stressed that there had been no disruption to religious or public-facing services as a result of the incident.

MUIS said it would continue working with the affected organisations to ensure essential human resources and payroll functions remain operational while the investigation and security checks continue.

The Cyber Security Agency of Singapore has also reached out to MUIS to offer assistance following the incident.