UK-based Mobile Guardian, a prominent player in mobile device management for educational institutions, disclosed a significant security breach on August 4th, posing risks to clients in Singapore, Europe and North America. The incident involved unauthorised access to iOS and ChromeOS devices managed by their tools, rendering them inaccessible.
The most severe impact was felt in Singapore, where the breach led to 13,000 devices being remotely wiped, prompting the Ministry of Education (MoE) to sever ties with the vendor.
The company is known for its suite of device management, web filtering and classroom management tools tailored for the education sector. It informed its customers that a “small percentage” of devices were unenrolled from its management system due to the attack, leading to unintended remote wiping.
“On the 4th of August, at 2 PM GMT, Mobile Guardian was alerted to suspicious activity on our platform and detected unauthorised access to our Platform,” said the company. “Our security team immediately took steps to halt Mobile Guardian services to contain the incident. We are investigating the breach.”
The company also reassured that it had found no evidence that the perpetrator had access to users’ data.
Despite these assurances, the ramifications are substantial, especially for their prominent clients. The MoE in Singapore, a client of Mobiel Guardian since 2020, said that the breach wiped out 13,000 school students’ devices.
In response, the Ministry removed Mobile Guardian’s software from its devices as a precautionary measure. Additionally, MoE is exploring alternative solutions to ensure the security of its devices amidst the ongoing security incident.
“As a precautionary measure, MOE will remove the Mobile Guardian Device Management Application from all iPads and Chromebooks. Efforts are underway to safely restore these devices to normal usage. MOE is considering other mitigating measures to regulate device usage to support learning during this period,” the Ministry said.
This is Mobile Guardian’s third cyber security incident. In April, the company faced an unauthorised access incident that exposed parents’ and school staff’s names and email addresses from 127 Singaporean schools.
More recently, a technical glitch last week left some students unable to connect to the internet on their iPads, a problem attributed to a configuration error unrelated to the breach.
The Ministry of Education of Singapore confirmed, “This security incident on 4 August is not related to the earlier technical issues faced by students at the end of July 2024.”
In the News: Nvidia scrapes content from YouTube and Netflix for AI training
