48 Mosques in Singapore Attacked, Refuse to Pay Hacker Ransom
A cyberattack has struck dozens of places of worship and Islamic educational institutions in Singapore, Indonesia’s closest neighbour. A total of 48 mosques and four madrasahs were affected by a security incident targeting payroll and personnel systems.
Singaporean religious authorities have emphasised that no ransom was paid, though the incident serves as a stark warning for similar institutions in Indonesia, according to a report by CNA on Friday (18/09/2026).
The incident originated from software provided by a third-party service provider named Avelogic, which manages personnel and payroll data. The system used by the Majlis Ugama Islam Singapura (MUIS) was infiltrated by cybercriminals, threatening to disrupt data access and salary payment processes.
The details of the institutions affected by the attack include:
48 mosques across Singapore
4 madrasahs or Islamic educational institutions
Islamic Learning Centres
The Headquarters for the Management of Mosques, Madrasahs, and Waqf
The targeted systems involve employee data management and payroll lists. Consequently, thousands of teachers, mosque administrators, and administrative staff faced the risk of not receiving their income on time.
MUIS stated that no ransom was paid to the attackers. Immediate security measures were implemented to ensure religious activities remained uninterrupted:
Alternative payroll systems were prepared so that salaries could still be paid on time.
Worship activities, public services, and educational activities were not disrupted.
Data stored in the system is protected by additional passwords, and so far, no evidence has been found that employees’ personal data was stolen.
A report has been filed with the Singapore Police Force, and an investigation is ongoing.
The software provider, Avelogic, has restored the affected systems and called in independent security experts to trace how the hack occurred. The official system will only be reactivated once all security vulnerabilities have been fully patched.
This incident in Singapore serves as an important warning for Indonesia. Thousands of mosques, pesantren (Islamic boarding schools), and other religious institutions are increasingly transitioning to digital systems for financial recording, waqf management, and staff payroll. However, not all institutions possess adequate security protections.
Systems managed by third parties often become unnoticed vulnerabilities. Furthermore, the personal data of administrators, teachers, or aid recipients could be leaked if not protected by strong encryption and passwords.
Moreover, cybercriminals frequently target institutions perceived to have weak security, as these organisations often rely on regular donations and social funds.