2024 Mobile Guardian security breach

The examples and perspective in this article deal primarily with Singapore and do not represent a worldwide view of the subject. You may improve this article, discuss the issue on the talk page, or create a new article, as appropriate. (March 2026) (Learn how and when to remove this message)

The 2024 Mobile Guardian security breach was a cybersecurity incident that affected Mobile Guardian, a mobile device management platform. In August 2024, Mobile Guardian experienced a cyberattack that affected users in multiple countries. As a result, multiple students in various countries lost a significant portion of their data in their personal learning devices (PLD).^[1][a] In response, the Ministry of Education (MOE) removed the Mobile Guardian application from all student devices, and terminated its contract with Mobile Guardian.^[2][3][4]

Mobile Guardian is a cloud-based mobile device management (MDM) platform developed by Mobile Guardian Limited. The MDM was founded in 2011, and is headquartered in Reigate, Surrey.^[5][6] The platform was designed for K–12 schools and parents.^[7] The service has been adopted by schools internationally, including its appointment as the MDM vendor for ChromeOS and iOS devices in Singaporean schools.^[8]

Mobile Guardian has been used by schools in North America, Europe, the Middle East and Singapore.^[8] The app is used by 2,500 schools in over 50 countries worldwide.^[9]

From April to July 2024, Mobile Guardian experienced multiple cybersecurity incidents prior to the cybersecurity breach that happened in August 2024.

In April 2024, the company disclosed unauthorised access to its user management portal. The names and e-mail addresses of parents and school staff from five primary and 122 secondary schools were accessed in Singapore.^[10][11] The Singaporean MOE lodged a police report, and informed all affected parents and teachers.^[11][12] The MOE stated its DMA was unaffected.^[12] On 30 May 2024, a potential vulnerability of the Mobile Guardian application was reported to the MOE. According to the MOE, it had been previously patched. In June 2024, an independent certified penetration tester further confirmed the issue had been fully resolved.^[13][14] On 30 July 2024, the DMA experienced glitches. Students with it installed on their PLDs reported issues with switching off or on their devices, and connecting to the Wi-Fi. In total, over 1000 students from at least five MOE secondary schools were affected. On 1 August 2024, Mobile Guardian rolled out an update to all app users to resolve the issue.^[15][16] Investigations by Mobile Guardian found that the incident was due to a human error in configuration.^[17]

On 4 August 2024, Mobile Guardian was alerted to suspicious activity on the platform, and detected unauthorised access to its system at 10pm Singapore time. MOE was also alerted by some schools at nighttime on the same day that students utilising iPads and Chromebooks as PLDs were unable to access their applications and information stored in their devices. Investigations later made by Mobile Guardian identified that a cyberattack occurred.^[18] The cyberattack had a global effect on users of the platform, including in North America, Europe and Singapore.^[19] This incident resulted in a portion of its userbase having their devices unenrolled from the platform. As a result, 13,000 Singaporean student devices from 26 secondary schools were remotely wiped.^[1][19][20] In total, data for 67,000 parents and 22,000 school staff was also accessed.^[21]

According to MOE, the cybersecurity breach that occurred in August was unrelated to the glitch that happened on July.^[9][22] Mobile Guardian additionally stated, "There is no evidence to suggest that the perpetrator had access to users' data."^[20] The cybersecurity firm, Group-IB later reported that over 300 account credentials related to the Mobile Guardian administration appeared for sale, 70 of which were on sale in the dark web.^[23][24] Channel News Asia reported that several students stated concerns that the data breach would negatively affect the results of their upcoming O-Level examinations.^[25] The Singapore Examinations and Assessment Board (SEAB) also reported that 52 students taking the O-Levels for art had their coursework affected by the data breach.^[26]

In response to the cyberattack, Mobile Guardian temporarily halted its services, which resulted in users being unable to log in to the Mobile Guardian platform, and students using the DMA experiencing restricted access on their devices.^[9][20] The Singaporean Ministry of Education also deployed information technology (IT) roving teams, which included 300 additional IT engineers and staff,^[27][28] and provided supplementary learning resources to affected schools.^[18][19][29] The MOE also provided students who wanted to troubleshoot their own PLDs with instruction sheets as a form of guidance.^[27][29] The MOE removed the Mobile Guardian application from students' PLDs as a precaution and subsequently terminated its contract with the vendor.^{[2][3][17][26]}

According to then Minister of Education Chan Chun Sing, about one in six of all affected users experienced data loss from the cyberattack. Fewer than five per cent of students were unable to recover all their data, as their devices had not been backed up prior to the security breach.^[27]

In January 2025, Mobile Guardian was replaced as a DMA in all PLDs in Singaporean secondary schools. Jamf was implemented on iPads, whereas Lightspeed Systems was implemented on Chromebooks.^[30]

• List of cyberattacks
• Educational technology
• 2024 in Singapore

• Official website
• Mobile Guardian Help Center
• Mobile Guardian on the App Store
• Mobile Guardian on Google Play