SINGAPORE: The Ministry of Education (MOE) has taken legal action against "relevant contractors" following a Mobile Guardian cyberattack that affected 13,000 users from 26 secondary schools.

About one in six of the affected users lost some data due to the cybersecurity breach suffered by the device management app, Minister of Education Chan Chun Sing said in parliament on Tuesday (Sep 10).

Less than 5 per cent were unable to recover all their data as their devices had not been backed up before the Aug 4 breach, he added.

Mr Chan responding to questions raised by Members of Parliament (MPs) about what MOE has done to prevent similar incidents from recurring and about the support given to students.

Mobile Guardian was removed from all iPads and Chromebooks the day after the cyberattack.

MOE said it requires its IT service providers to keep its systems and data safe.

The ministry's forensic investigations with GovTech and the Cyber Security Agency of Singapore (CSA) into the incident found that there was a new vulnerability in Mobile Guardian's system that could allow an individual to carry out an attack.

"This is a timely reminder that cyber threats can evolve quickly," he said.

"While no security test can be entirely exhaustive, MOE expects its contractors to regularly assess and strengthen their systems' security posture."

The ministry has decided to stop using Mobile Guardian in all personal learning devices, and is currently studying options for an alternative device management app. 

It said it would work towards rolling out the new app by January next year.

On Monday, CNA reported that MOE has terminated its contract with Mobile Guardian and was considering other options. 

Prior to the Aug 4 incident, Mobile Guardian suffered a data breach in April due to poor password management practice. A glitch was also reported in July due to human error.

IMPACT ON STUDENTS

The 13,000 personal learning devices that were remotely wiped out represented about 8 per cent of devices used by the secondary school population.

MOE deployed 300 additional IT engineers and staff to help students, and instruction sheets to those who wanted to troubleshoot on their own.

All devices were restored for use last month. Schools provided hardcopy resources and supported students who were emotionally affected, said Mr Chan.

Deadlines were extended and weighted assessments were postponed where needed, he added.

"Through this episode, it was most heartening to see many of our students step forward and proactively share their personal notes with classmates and organise study sessions to do revision for their tests and exams together," he said.

Despite the "highly unfortunate" incidents, MOE must embrace technology in teaching and learning so that students will be digitally savvy and able to navigate digital environments.

"All of us can learn from this incident. It is an important reminder for all of us to practice good digital hygiene, including the regular backing up of information," the minister added.