Release of Investigation Reports into Cybersecurity Incidents Affecting ASPIRE 2A and A*STAR Exanet Network and Data Recovery Measures Taken
Ministry of Trade and IndustrySpeakers
Summary
This question concerns cybersecurity incidents affecting the National Supercomputing Centre Singapore's ASPIRE 2A and ASTAR's Exanet network, raised by Mr Gerald Giam Yean Song regarding investigation reports, recovery measures, and data exfiltration. In response, Minister Dr Tan See Leng stated that investigations conducted with external forensic specialists found no evidence of data compromise or exfiltration. He explained that the detailed investigation reports will not be publicly released to prevent aiding malicious actors. The affected systems were isolated, rebuilt, scanned, and cleared before returning to service alongside immediate implementation of tighter access controls and enhanced endpoint protection. Furthermore, NSCC and ASTAR have accelerated cybersecurity initiatives, including sophisticated red teaming, and applied lessons learnt across the research infrastructure.
Transcript
53 Mr Gerald Giam Yean Song asked the Minister for Trade and Industry (Energy and Industry) (a) whether full investigation reports on the recent cybersecurity incidents affecting National Supercomputing Centre Singapore's ASPIRE 2A and A*STAR's Exanet network will be publicly released; (b) what specific recovery, validation and hardening measures were taken; and (c) whether any data was exfiltrated and, if so, what data was compromised.
Dr Tan See Leng: Following the cybersecurity incidents affecting the National Supercomputing Centre Singapore's (NSCC's) ASPIRE 2A system on 22 May 2026 and Agency for Science, Technology and Research's (A*STAR's) Exanet network on 24 July 2026, the affected systems were promptly isolated, and investigations were immediately conducted to establish the nature, extent and impact of the incidents.
External forensic specialists were also engaged to investigate and establish the root cause in each case. Detailed investigations found no evidence of data compromise or exfiltration in either incident. The detailed investigation reports will not be publicly released, as doing so could provide information useful to malicious actors.
The affected ASPIRE 2A system and computing devices in the Exanet network were rebuilt, scanned for any residual elements of the attack, inspected and cleared for use before being returned to service. Additional security measures, including tighter enforcement of access controls and enhancement of endpoint protection, were immediately implemented to strengthen safeguards against unauthorised access.
NSCC and A*STAR conduct regular reviews of their cybersecurity protocols to ensure these remain robust and current and have accelerated their cybersecurity initiatives which had commenced prior to the incidents, such as enhancing cybersecurity threat simulation through more sophisticated red teaming. Lessons learnt from these incidents have also been applied across our research infrastructure.