MUIS says human resource management system hit by cybersecurity incident

The Islamic Religious Council of Singapore (MUIS) reported a cybersecurity incident involving a human resource management system operated by Singapore-based software vendor Avelogic. MUIS emphasized that the incident does not impact the delivery of public-facing or government services. They are working with Avelogic and relevant authorities to determine the next steps.

Business continuity arrangements have been put in place to manage essential HR and payroll functions, with affected employees receiving guidance and support. MUIS did not disclose the number of individuals affected or the nature of any potential data compromise. The Singapore Police Force confirmed that a report was filed and ongoing investigations are underway.

Avelogic published a cybersecurity incident notice on its website, noting that an independent forensic investigation found no evidence of bulk data exfiltration. The company's SmartHRMS system, a CPF-compliant payroll and HR management platform for SMEs, remains secure with sensitive data protected by application-layer encryption.

Avelogic reported the incident to the relevant authorities and commissioned cybersecurity firm Black Panda for an independent forensic investigation. The firm stated that they successfully recovered the last updated data set and are aiming to restore the system by the following Friday.