Ministry of Education to remove Mobile Guardian app from all student devices after global cybersecurity breach

SINGAPORE – The Mobile Guardian app will be removed from all student education devices after a global cybersecurity breach affected 13,000 students from 26 secondary schools in Singapore.

The Ministry of Education (MOE) said in a statement on August 5 that the app would be removed from all iPads and Chromebooks as a precaution and that work was underway to safely return the devices to normal use.

Mobile Guardian is a device management app that helps parents control their children’s device usage by limiting screen time and access to specific websites and apps.

The Ministry of Education said that late on the evening of August 4, some schools reported that some students using iPads or Chromebooks were unable to access apps and information stored on their devices.

Investigations conducted by Mobile Guardian have revealed that a cybersecurity incident involving unauthorised access to the platform has occurred, affecting customers worldwide, including those in Singapore, the MOE said.

Due to the data breach, the affected students’ devices were remotely wiped, MOE said, and there is no evidence anyone accessed the students’ files.

“We understand that students are naturally concerned and anxious about the incident. MOE is working with schools to support affected students, including sending additional IT teams to schools and providing additional educational resources,” the ministry said.

The Ministry of Education said the security incident that occurred on August 4 was unrelated to the technical issues students faced last week.

The Straits Times newspaper reported earlier that more than 1,000 students from at least five secondary schools under the Education Ministry were affected by the Mobile Guardian app bug.

As early as July 30, some students reported that they were unable to turn their iPads on or off, while others were unable to connect to Wi-Fi and received an error message: “The Guided Access app is unavailable. Please contact your administrator.”

According to MOE, the cause of the fault was human error in the configuration of Mobile Guardian.

In a statement posted on its website on August 5, Mobile Guardian said that since the security incident, “servers have been taken down to prevent further damage from the perpetrator.”

Mobile Guardian said it received a notification of suspicious activity on its platform at 10pm Singapore time on August 4 and detected unauthorised access to its system.

The company is currently investigating the breach, which has affected users across the world, including the United States, Europe, and Singapore.

“This resulted in a small percentage of devices being deregistered from Mobile Guardian and having their content remotely wiped,” Mobile Guardian reported.

Users should contact their local IT administrator or IT department to reactivate their device, Mobile Guardian reported.

This is the second cybersecurity incident involving Mobile Guardian in six months.

In April, Mobile Guardian’s user management portal at its headquarters in Surrey, UK, was hacked, exposing the names and email addresses of parents and teachers at five primary schools and 122 secondary schools in Singapore.

Parents who spoke to ST after the latest incident said they were at a loss as their children lost years of school notes and assignments. Some students also had no warning that their devices would be completely wiped.

Some students’ notes have already been deleted due to technical issues that occurred in late July.

One mother, who wanted to be known only as Madam Chan, said her 15-year-old daughter at Raffles Girls’ School (RGS) reported problems with her device as early as July 31. However, the school did not provide any details on the exact nature of the problem.

The 59-year-old, who works in human resources, said the school informed students on Aug. 1 that their devices would have to undergo a factory reset — a process that erases all data from the device and restores it to its default settings.

“This process led to several students losing their notes, even though the school advised them to find a workaround and back up their notes before performing a factory reset,” she added.

She added that many students, including her daughter, were unable to back up their devices due to connectivity issues, which resulted in them losing some of their notes.

After the incident in late July, some parents, including Ms. Chan, said they planned to go to an Apple Store to have staff uninstall the app. Ms. Chan said her daughter was afraid to even turn on the device because she might lose more notes.

“Many parents, like me, are frustrated and don’t know what to do,” she said. “Our biggest concern is getting our kids back their notes, as well as all their assignments and digital drawings they’ve done over the years.”

Ms Chan added that other parents on the RGS Year 3 parents’ WhatsApp group, which has about 290 members, said only 50 meetings were available per day for the school’s IT department, with some students having to wait three to four hours for help with their devices, they said.

“This is a very stressful situation in every way,” she said. She added that the situation was different for each student and there were no clear instructions on what they could do to back up their devices.

Another parent, who only wants to be known as Mr Alex, said that at St Andrew’s Secondary School, many students took photos of documents on their phones to save notes before going to the IT department to factory reset their devices.

“As a parent, I am very nervous as this is unnecessarily distracting for the boys and could disrupt their revision for their final assessment,” said a parent in his 40s who has a son at the school.

“A lot of their work is done on their personal learning device,” he said. “On the other hand, I’m happy to use it as a learning point to teach my son about his inherent weakness of relying on technology.”

Mr Alex said students who had saved their notes on external sites like Google were safe from these issues, but others would face losing years of notes due to the reset.

Another parent, whose 13-year-old son attends Nan Hua High School, said: “Parents are unsure how we can help our children.”

The 52-year-old housewife, who wanted to be known only as Madam Lee, said: “We wasted a lot of time trying to figure out the cause of the problem.”

She expressed concerns about whether the removal of the Mobile Guardian app was a permanent decision or a temporary solution, and whether children would be free to download other apps without supervision in the meantime.

Ms Lee said her son’s device had been damaged since July 31 and that it was due to be reformatted on August 5.

“We don’t really know if the hack that happened last night caused any further damage or if it didn’t affect the device at all because it was already causing problems to begin with,” she said.

Apart from Mobile Guardian, another device management app that MOE uses is Blocksi, which is based in California, United States.

ST has contacted the Singapore Cybersecurity Agency and the Ministry of Energy for further information.